1233 files changed, 26137 insertions, 8842 deletions

diff --git a/.mailmap b/.mailmap
index 67dc22ffc9a8..1d6f4e7280dc 100644
--- a/.mailmap
+++ b/.mailmap
@@ -99,6 +99,8 @@ Linas Vepstas <linas@austin.ibm.com>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@web.de>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@ascom.ch>
 Mark Brown <broonie@sirena.org.uk>
+Martin Kepplinger <martink@posteo.de> <martin.kepplinger@theobroma-systems.com>
+Martin Kepplinger <martink@posteo.de> <martin.kepplinger@ginzinger.com>
 Matthieu CASTET <castet.matthieu@free.fr>
 Mauro Carvalho Chehab <mchehab@kernel.org> <mchehab@brturbo.com.br>
 Mauro Carvalho Chehab <mchehab@kernel.org> <maurochehab@gmail.com>
@@ -171,6 +173,7 @@ Vlad Dogaru <ddvlad@gmail.com> <vlad.dogaru@intel.com>
 Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@virtuozzo.com>
 Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@parallels.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
+Yakir Yang <kuankuan.y@gmail.com> <ykk@rock-chips.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
 Gustavo Padovan <padovan@profusion.mobi>
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 2ba45caabada..facc20a3f962 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1725,6 +1725,12 @@
                         kernel and module base offset ASLR (Address Space
                         Layout Randomization).
 
+        kasan_multi_shot
+                        [KNL] Enforce KASAN (Kernel Address Sanitizer) to print
+                        report on every invalid memory access. Without this
+                        parameter KASAN will print report only for the first
+                        invalid access.
+
         keepinitrd      [HW,ARM]
 
         kernelcore=     [KNL,X86,IA-64,PPC]
diff --git a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
index 30c546900b60..07dbb358182c 100644
--- a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
+++ b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
@@ -45,7 +45,7 @@ The following clocks are available:
    - 1 15       SATA
    - 1 16       SATA USB
    - 1 17       Main
-   - 1 18       SD/MMC
+   - 1 18       SD/MMC/GOP
    - 1 21       Slow IO (SPI, NOR, BootROM, I2C, UART)
    - 1 22       USB3H0
    - 1 23       USB3H1
@@ -65,7 +65,7 @@ Required properties:
         "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
 
 Example:
@@ -78,6 +78,6 @@ Example:
                 gate-clock-output-names = "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
                         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
                         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
                         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
         };
diff --git a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
index a78265993665..ca5204b3bc21 100644
--- a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
+++ b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
@@ -4,7 +4,6 @@ Required properties:
   - compatible: value should be one of the following
                 "samsung,exynos3250-mipi-dsi" /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-mipi-dsi" /* for Exynos4 SoCs */
-                "samsung,exynos4415-mipi-dsi" /* for Exynos4415 SoC */
                 "samsung,exynos5410-mipi-dsi" /* for Exynos5410/5420/5440 SoCs */
                 "samsung,exynos5422-mipi-dsi" /* for Exynos5422/5800 SoCs */
                 "samsung,exynos5433-mipi-dsi" /* for Exynos5433 SoCs */
diff --git a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
index 18645e0228b0..5837402c3ade 100644
--- a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
+++ b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
@@ -11,7 +11,6 @@ Required properties:
                 "samsung,s5pv210-fimd"; /* for S5PV210 SoC */
                 "samsung,exynos3250-fimd"; /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-fimd"; /* for Exynos4 SoCs */
-                "samsung,exynos4415-fimd"; /* for Exynos4415 SoC */
                 "samsung,exynos5250-fimd"; /* for Exynos5250 SoCs */
                 "samsung,exynos5420-fimd"; /* for Exynos5420/5422/5800 SoCs */
 
diff --git a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
index ea9c1c9607f6..520d61dad6dd 100644
--- a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
@@ -13,7 +13,7 @@ Required Properties:
         - "rockchip,rk2928-dw-mshc": for Rockchip RK2928 and following,
                                                         before RK3288
         - "rockchip,rk3288-dw-mshc": for Rockchip RK3288
-        - "rockchip,rk1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK1108
+        - "rockchip,rv1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RV1108
         - "rockchip,rk3036-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3036
         - "rockchip,rk3368-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3368
         - "rockchip,rk3399-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3399
diff --git a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
index b7fa3b97986d..a339dbb15493 100644
--- a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
@@ -44,13 +44,19 @@ Hip05 Example (note that Hip06 is the same except compatible):
         };
 
 HiSilicon Hip06/Hip07 PCIe host bridge DT (almost-ECAM) description.
+
+Some BIOSes place the host controller in a mode where it is ECAM
+compliant for all devices other than the root complex. In such cases,
+the host controller should be described as below.
+
 The properties and their meanings are identical to those described in
 host-generic-pci.txt except as listed below.
 
 Properties of the host controller node that differ from
 host-generic-pci.txt:
 
-- compatible     : Must be "hisilicon,pcie-almost-ecam"
+- compatible     : Must be "hisilicon,hip06-pcie-ecam", or
+                   "hisilicon,hip07-pcie-ecam"
 
 - reg            : Two entries: First the ECAM configuration space for any
                    other bus underneath the root bus. Second, the base
@@ -59,7 +65,7 @@ host-generic-pci.txt:
 
 Example:
         pcie0: pcie@a0090000 {
-                compatible = "hisilicon,pcie-almost-ecam";
+                compatible = "hisilicon,hip06-pcie-ecam";
                 reg = <0 0xb0000000 0 0x2000000>,  /*  ECAM configuration space */
                       <0 0xa0090000 0 0x10000>; /* host bridge registers */
                 bus-range = <0  31>;
diff --git a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt b/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
deleted file mode 100644
index e68ae5dec9c9..000000000000
--- a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Broadcom USB3 phy binding for northstar plus SoC
-The USB3 phy is internal to the SoC and is accessed using mdio interface.
-
-Required mdio bus properties:
-- reg: Should be 0x0 for SoC internal USB3 phy
-- #address-cells: must be 1
-- #size-cells: must be 0
-
-Required USB3 PHY properties:
-- compatible: should be "brcm,nsp-usb3-phy"
-- reg: USB3 Phy address on SoC internal MDIO bus and it should be 0x10.
-- usb3-ctrl-syscon: handler of syscon node defining physical address
-  of usb3 control register.
-- #phy-cells: must be 0
-
-Required usb3 control properties:
-- compatible: should be "brcm,nsp-usb3-ctrl"
-- reg: offset and length of the control registers
-
-Example:
-
-        mdio@0 {
-                reg = <0x0>;
-                #address-cells = <1>;
-                #size-cells = <0>;
-
-                usb3_phy: usb-phy@10 {
-                        compatible = "brcm,nsp-usb3-phy";
-                        reg = <0x10>;
-                        usb3-ctrl-syscon = <&usb3_ctrl>;
-                        #phy-cells = <0>;
-                        status = "disabled";
-                };
-        };
-
-        usb3_ctrl: syscon@104408 {
-                compatible = "brcm,nsp-usb3-ctrl", "syscon";
-                reg = <0x104408 0x3fc>;
-        };
diff --git a/Documentation/devicetree/bindings/rng/omap_rng.txt b/Documentation/devicetree/bindings/rng/omap_rng.txt
index 471477299ece..9cf7876ab434 100644
--- a/Documentation/devicetree/bindings/rng/omap_rng.txt
+++ b/Documentation/devicetree/bindings/rng/omap_rng.txt
@@ -12,7 +12,8 @@ Required properties:
 - reg : Offset and length of the register set for the module
 - interrupts : the interrupt number for the RNG module.
                 Used for "ti,omap4-rng" and "inside-secure,safexcel-eip76"
-- clocks: the trng clock source
+- clocks: the trng clock source. Only mandatory for the
+  "inside-secure,safexcel-eip76" compatible.
 
 Example:
 /* AM335x */
diff --git a/Documentation/devicetree/bindings/sound/cs35l35.txt b/Documentation/devicetree/bindings/sound/cs35l35.txt
new file mode 100644
index 000000000000..016b768bc722
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/cs35l35.txt
@@ -0,0 +1,180 @@
+CS35L35 Boosted Speaker Amplifier
+
+Required properties:
+
+  - compatible : "cirrus,cs35l35"
+
+  - reg : the I2C address of the device for I2C
+
+  - VA-supply, VP-supply : power supplies for the device,
+    as covered in
+    Documentation/devicetree/bindings/regulator/regulator.txt.
+
+  - interrupt-parent : Specifies the phandle of the interrupt controller to
+    which the IRQs from CS35L35 are delivered to.
+  - interrupts : IRQ line info CS35L35.
+    (See Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
+    for further information relating to interrupt properties)
+
+Optional properties:
+  - reset-gpios : gpio used to reset the amplifier
+
+  - cirrus,stereo-config : Boolean to determine if there are 2 AMPs for a
+  Stereo configuration
+
+  - cirrus,audio-channel : Set Location of Audio Signal on Serial Port
+  0 = Data Packet received on Left I2S Channel
+  1 = Data Packet received on Right I2S Channel
+
+  - cirrus,advisory-channel : Set Location of Advisory Signal on Serial Port
+  0 = Data Packet received on Left I2S Channel
+  1 = Data Packet received on Right I2S Channel
+
+  - cirrus,shared-boost : Boolean to enable ClassH tracking of Advisory Signal
+  if 2 Devices share Boost BST_CTL
+
+  - cirrus,external-boost : Boolean to specify the device is using an external
+  boost supply, note that sharing a boost from another cs35l35 would constitute
+  using an external supply for the slave device
+
+  - cirrus,sp-drv-strength : Value for setting the Serial Port drive strength
+  Table 3-10 of the datasheet lists drive-strength specifications
+  0 = 1x (Default)
+  1 = .5x
+  - cirrus,sp-drv-unused : Determines how unused slots should be driven on the
+  Serial Port.
+  0 - Hi-Z
+  2 - Drive 0's (Default)
+  3 - Drive 1's
+
+  - cirrus,bst-pdn-fet-on : Boolean to determine if the Boost PDN control
+  powers down with a rectification FET On or Off. If VSPK is supplied
+  externally then FET is off.
+
+  - cirrus,boost-ctl-millivolt : Boost Voltage Value.  Configures the boost
+    converter's output voltage in mV. The range is from 2600mV to 9000mV with
+    increments of 100mV.
+    (Default) VP
+
+  - cirrus,boost-peak-milliamp : Boost-converter peak current limit in mA.
+  Configures the peak current by monitoring the current through the boost FET.
+  Range starts at 1680mA and goes to a maximum of 4480mA with increments of
+  110mA.
+  (Default) 2.46 Amps
+
+  - cirrus,amp-gain-zc : Boolean to determine if to use Amplifier gain-change
+  zero-cross
+
+Optional H/G Algorithm sub-node:
+
+  The cs35l35 node can have a single "cirrus,classh-internal-algo" sub-node
+  that will disable automatic control of the internal H/G Algorithm.
+
+  It is strongly recommended that the Datasheet be referenced when adjusting
+  or using these Class H Algorithm controls over the internal Algorithm.
+  Serious damage can occur to the Device and surrounding components.
+
+  - cirrus,classh-internal-algo : Sub-node for the Internal Class H Algorithm
+  See Section 4.3 Internal Class H Algorithm in the Datasheet.
+  If not used, the device manages the ClassH Algorithm internally.
+
+Optional properties for the "cirrus,classh-internal-algo" Sub-node
+
+  Section 7.29 Class H Control
+  - cirrus,classh-bst-overide : Boolean
+  - cirrus,classh-bst-max-limit
+  - cirrus,classh-mem-depth
+
+  Section 7.30 Class H Headroom Control
+  - cirrus,classh-headroom
+
+  Section 7.31 Class H Release Rate
+  - cirrus,classh-release-rate
+
+  Section 7.32 Class H Weak FET Drive Control
+  - cirrus,classh-wk-fet-disable
+  - cirrus,classh-wk-fet-delay
+  - cirrus,classh-wk-fet-thld
+
+  Section 7.34 Class H VP Control
+  - cirrus,classh-vpch-auto
+  - cirrus,classh-vpch-rate
+  - cirrus,classh-vpch-man
+
+Optional Monitor Signal Format sub-node:
+
+  The cs35l35 node can have a single "cirrus,monitor-signal-format" sub-node
+  for adjusting the Depth, Location and Frame of the Monitoring Signals
+  for Algorithms.
+
+  See Sections 4.8.2 through 4.8.4 Serial-Port Control in the Datasheet
+
+  -cirrus,monitor-signal-format : Sub-node for the Monitor Signaling Formating
+  on the I2S Port. Each of the 3 8 bit values in the array contain the settings
+  for depth, location, and frame.
+
+  If not used, the defaults for the 6 monitor signals is used.
+
+  Sections 7.44 - 7.53 lists values for the depth, location, and frame
+  for each monitoring signal.
+
+  - cirrus,imon : 4 8 bit values to set the depth, location, frame and ADC
+  scale of the IMON monitor signal.
+
+  - cirrus,vmon : 3 8 bit values to set the depth, location, and frame
+  of the VMON monitor signal.
+
+  - cirrus,vpmon : 3 8 bit values to set the depth, location, and frame
+  of the VPMON monitor signal.
+
+  - cirrus,vbstmon : 3 8 bit values to set the depth, location, and frame
+  of the VBSTMON monitor signal
+
+  - cirrus,vpbrstat : 3 8 bit values to set the depth, location, and frame
+  of the VPBRSTAT monitor signal
+
+  - cirrus,zerofill : 3 8 bit values to set the depth, location, and frame\
+  of the ZEROFILL packet in the monitor signal
+
+Example:
+
+cs35l35: cs35l35@20 {
+        compatible = "cirrus,cs35l35";
+        reg = <0x20>;
+        VA-supply = <&dummy_vreg>;
+        VP-supply = <&dummy_vreg>;
+        reset-gpios = <&axi_gpio 54 0>;
+        interrupt-parent = <&gpio8>;
+        interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+        cirrus,boost-ctl-millivolt = <9000>;
+
+        cirrus,stereo-config;
+        cirrus,audio-channel = <0x00>;
+        cirrus,advisory-channel = <0x01>;
+        cirrus,shared-boost;
+
+        cirrus,classh-internal-algo {
+                cirrus,classh-bst-overide;
+                cirrus,classh-bst-max-limit = <0x01>;
+                cirrus,classh-mem-depth = <0x01>;
+                cirrus,classh-release-rate = <0x08>;
+                cirrus,classh-headroom-millivolt = <0x0B>;
+                cirrus,classh-wk-fet-disable = <0x01>;
+                cirrus,classh-wk-fet-delay = <0x04>;
+                cirrus,classh-wk-fet-thld = <0x01>;
+                cirrus,classh-vpch-auto = <0x01>;
+                cirrus,classh-vpch-rate = <0x02>;
+                cirrus,classh-vpch-man = <0x05>;
+        };
+
+        /* Depth, Location, Frame */
+        cirrus,monitor-signal-format {
+                cirrus,imon = /bits/ 8 <0x03 0x00 0x01>;
+                cirrus,vmon = /bits/ 8 <0x03 0x00 0x00>;
+                cirrus,vpmon = /bits/ 8 <0x03 0x04 0x00>;
+                cirrus,vbstmon = /bits/ 8 <0x03 0x04 0x01>;
+                cirrus,vpbrstat = /bits/ 8 <0x00 0x04 0x00>;
+                cirrus,zerofill = /bits/ 8 <0x00 0x00 0x00>;
+        };
+
+};
diff --git a/Documentation/devicetree/bindings/sound/dioo,dio2125.txt b/Documentation/devicetree/bindings/sound/dioo,dio2125.txt
new file mode 100644
index 000000000000..63dbfe0f11d0
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/dioo,dio2125.txt
@@ -0,0 +1,12 @@
+DIO2125 Audio Driver
+
+Required properties:
+- compatible : "dioo,dio2125"
+- enable-gpios : the gpio connected to the enable pin of the dio2125
+
+Example:
+
+amp: analog-amplifier {
+        compatible = "dioo,dio2125";
+        enable-gpios = <&gpio GPIOH_3 0>;
+};
diff --git a/Documentation/devicetree/bindings/sound/everest,es7134.txt b/Documentation/devicetree/bindings/sound/everest,es7134.txt
new file mode 100644
index 000000000000..5495a3cb8b7b
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/everest,es7134.txt
@@ -0,0 +1,10 @@
+ES7134 i2s DA converter
+
+Required properties:
+- compatible : "everest,es7134" or "everest,es7144"
+
+Example:
+
+i2s_codec: external-codec {
+        compatible = "everest,es7134";
+};
diff --git a/Documentation/devicetree/bindings/sound/fsl,ssi.txt b/Documentation/devicetree/bindings/sound/fsl,ssi.txt
index 5b76be45d18b..d415888e1316 100644
--- a/Documentation/devicetree/bindings/sound/fsl,ssi.txt
+++ b/Documentation/devicetree/bindings/sound/fsl,ssi.txt
@@ -20,24 +20,8 @@ Required properties:
                     have.
 - interrupt-parent: The phandle for the interrupt controller that
                     services interrupts for this device.
-- fsl,playback-dma: Phandle to a node for the DMA channel to use for
-                    playback of audio.  This is typically dictated by SOC
-                    design.  See the notes below.
-- fsl,capture-dma:  Phandle to a node for the DMA channel to use for
-                    capture (recording) of audio.  This is typically dictated
-                    by SOC design.  See the notes below.
 - fsl,fifo-depth:   The number of elements in the transmit and receive FIFOs.
                     This number is the maximum allowed value for SFCSR[TFWM0].
-- fsl,ssi-asynchronous:
-                    If specified, the SSI is to be programmed in asynchronous
-                    mode.  In this mode, pins SRCK, STCK, SRFS, and STFS must
-                    all be connected to valid signals.  In synchronous mode,
-                    SRCK and SRFS are ignored.  Asynchronous mode allows
-                    playback and capture to use different sample sizes and
-                    sample rates.  Some drivers may require that SRCK and STCK
-                    be connected together, and SRFS and STFS be connected
-                    together.  This would still allow different sample sizes,
-                    but not different sample rates.
  - clocks:          "ipg" - Required clock for the SSI unit
                     "baud" - Required clock for SSI master mode. Otherwise this
                       clock is not used
@@ -61,6 +45,24 @@ Optional properties:
 - fsl,mode:         The operating mode for the AC97 interface only.
                     "ac97-slave" - AC97 mode, SSI is clock slave
                     "ac97-master" - AC97 mode, SSI is clock master
+- fsl,ssi-asynchronous:
+                    If specified, the SSI is to be programmed in asynchronous
+                    mode.  In this mode, pins SRCK, STCK, SRFS, and STFS must
+                    all be connected to valid signals.  In synchronous mode,
+                    SRCK and SRFS are ignored.  Asynchronous mode allows
+                    playback and capture to use different sample sizes and
+                    sample rates.  Some drivers may require that SRCK and STCK
+                    be connected together, and SRFS and STFS be connected
+                    together.  This would still allow different sample sizes,
+                    but not different sample rates.
+- fsl,playback-dma: Phandle to a node for the DMA channel to use for
+                    playback of audio.  This is typically dictated by SOC
+                    design.  See the notes below.
+                    Only used on Power Architecture.
+- fsl,capture-dma:  Phandle to a node for the DMA channel to use for
+                    capture (recording) of audio.  This is typically dictated
+                    by SOC design.  See the notes below.
+                    Only used on Power Architecture.
 
 Child 'codec' node required properties:
 - compatible:       Compatible list, contains the name of the codec
diff --git a/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt b/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt
new file mode 100644
index 000000000000..7a296784eb37
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt
@@ -0,0 +1,42 @@
+* Hisilicon 6210 i2s controller
+
+Required properties:
+
+- compatible: should be one of the following:
+   - "hisilicon,hi6210-i2s"
+- reg: physical base address of the i2s controller unit and length of
+   memory mapped region.
+- interrupts: should contain the i2s interrupt.
+- clocks: a list of phandle + clock-specifier pairs, one for each entry
+  in clock-names.
+- clock-names: should contain following:
+   - "dacodec"
+   - "i2s-base"
+- dmas: DMA specifiers for tx dma. See the DMA client binding,
+  Documentation/devicetree/bindings/dma/dma.txt
+- dma-names: should be "tx" and "rx"
+- hisilicon,sysctrl-syscon: phandle to sysctrl syscon
+- #sound-dai-cells: Should be set to 1 (for multi-dai)
+   - The dai cell indexes reference the following interfaces:
+       0: S2 interface
+       (Currently that is the only one available, but more may be
+        supported in the future)
+
+Example for the hi6210 i2s controller:
+
+i2s0: i2s@f7118000{
+        compatible = "hisilicon,hi6210-i2s";
+        reg = <0x0 0xf7118000 0x0 0x8000>; /* i2s unit */
+        interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>; /* 155 "DigACodec_intr"-32 */
+        clocks = <&sys_ctrl HI6220_DACODEC_PCLK>,
+                 <&sys_ctrl HI6220_BBPPLL0_DIV>;
+        clock-names = "dacodec", "i2s-base";
+        dmas = <&dma0 15 &dma0 14>;
+        dma-names = "rx", "tx";
+        hisilicon,sysctrl-syscon = <&sys_ctrl>;
+        #sound-dai-cells = <1>;
+};
+
+Then when referencing the i2s controller:
+        sound-dai = <&i2s0 0>; /* index 0 => S2 interface */
+
diff --git a/Documentation/devicetree/bindings/sound/max98925.txt b/Documentation/devicetree/bindings/sound/max98925.txt
deleted file mode 100644
index 27be63e2aa0d..000000000000
--- a/Documentation/devicetree/bindings/sound/max98925.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-max98925 audio CODEC
-
-This device supports I2C.
-
-Required properties:
-
-  - compatible : "maxim,max98925"
-
-  - vmon-slot-no : slot number used to send voltage information
-
-  - imon-slot-no : slot number used to send current information
-
-  - reg : the I2C address of the device for I2C
-
-Example:
-
-codec: max98925@1a {
-        compatible = "maxim,max98925";
-        vmon-slot-no = <0>;
-        imon-slot-no = <2>;
-        reg = <0x1a>;
-};
diff --git a/Documentation/devicetree/bindings/sound/max98926.txt b/Documentation/devicetree/bindings/sound/max98926.txt
deleted file mode 100644
index 0b7f4e4d5f9a..000000000000
--- a/Documentation/devicetree/bindings/sound/max98926.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-max98926 audio CODEC
-
-This device supports I2C.
-
-Required properties:
-
-  - compatible : "maxim,max98926"
-
-  - vmon-slot-no : slot number used to send voltage information
-                   or in inteleave mode this will be used as
-                   interleave slot.
-
-  - imon-slot-no : slot number used to send current information
-
-  - interleave-mode : When using two MAX98926 in a system it is
-                      possible to create ADC data that that will
-                      overflow the frame size. Digital Audio Interleave
-                      mode provides a means to output VMON and IMON data
-                      from two devices on a single DOUT line when running
-                      smaller frames sizes such as 32 BCLKS per LRCLK or
-                      48 BCLKS per LRCLK.
-
-  - reg : the I2C address of the device for I2C
-
-Example:
-
-codec: max98926@1a {
-   compatible = "maxim,max98926";
-   vmon-slot-no = <0>;
-   imon-slot-no = <2>;
-   reg = <0x1a>;
-};
diff --git a/Documentation/devicetree/bindings/sound/max9892x.txt b/Documentation/devicetree/bindings/sound/max9892x.txt
new file mode 100644
index 000000000000..f6171591ddc6
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/max9892x.txt
@@ -0,0 +1,41 @@
+Maxim Integrated MAX98925/MAX98926/MAX98927 Speaker Amplifier
+
+This device supports I2C.
+
+Required properties:
+
+  - compatible : should be one of the following
+    - "maxim,max98925"
+    - "maxim,max98926"
+    - "maxim,max98927"
+
+  - vmon-slot-no : slot number used to send voltage information
+                   or in inteleave mode this will be used as
+                   interleave slot.
+                   MAX98925/MAX98926 slot range : 0 ~ 30,  Default : 0
+                   MAX98927 slot range : 0 ~ 15,  Default : 0
+
+  - imon-slot-no : slot number used to send current information
+                   MAX98925/MAX98926 slot range : 0 ~ 30,  Default : 0
+                   MAX98927 slot range : 0 ~ 15,  Default : 0
+
+  - interleave-mode : When using two MAX9892X in a system it is
+                   possible to create ADC data that that will
+                   overflow the frame size. Digital Audio Interleave
+                   mode provides a means to output VMON and IMON data
+                   from two devices on a single DOUT line when running
+                   smaller frames sizes such as 32 BCLKS per LRCLK or
+                   48 BCLKS per LRCLK.
+                   Range : 0 (off), 1 (on),  Default : 0
+
+  - reg : the I2C address of the device for I2C
+
+Example:
+
+codec: max98927@3a {
+   compatible = "maxim,max98927";
+   vmon-slot-no = <0>;
+   imon-slot-no = <1>;
+   interleave-mode = <0>;
+   reg = <0x3a>;
+};
diff --git a/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt b/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt
new file mode 100644
index 000000000000..809b609ea9d0
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt
@@ -0,0 +1,24 @@
+MT2701 with WM8960 CODEC
+
+Required properties:
+- compatible: "mediatek,mt2701-wm8960-machine"
+- mediatek,platform: the phandle of MT2701 ASoC platform
+- audio-routing: a list of the connections between audio
+- mediatek,audio-codec: the phandles of wm8960 codec
+- pinctrl-names: Should contain only one value - "default"
+- pinctrl-0: Should specify pin control groups used for this controller.
+
+Example:
+
+        sound:sound {
+                compatible = "mediatek,mt2701-wm8960-machine";
+                mediatek,platform = <&afe>;
+                audio-routing =
+                        "Headphone", "HP_L",
+                        "Headphone", "HP_R",
+                        "LINPUT1", "AMIC",
+                        "RINPUT1", "AMIC";
+                mediatek,audio-codec = <&wm8960>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&aud_pins_default>;
+        };
diff --git a/Documentation/devicetree/bindings/sound/nau8824.txt b/Documentation/devicetree/bindings/sound/nau8824.txt
new file mode 100644
index 000000000000..e0058b97e49a
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/nau8824.txt
@@ -0,0 +1,88 @@
+Nuvoton NAU8824 audio codec
+
+This device supports I2C only.
+
+Required properties:
+  - compatible : Must be "nuvoton,nau8824"
+
+  - reg : the I2C address of the device. This is either 0x1a (CSB=0) or 0x1b (CSB=1).
+
+Optional properties:
+  - nuvoton,jkdet-polarity: JKDET pin polarity. 0 - active high, 1 - active low.
+
+  - nuvoton,vref-impedance: VREF Impedance selection
+      0 - Open
+      1 - 25 kOhm
+      2 - 125 kOhm
+      3 - 2.5 kOhm
+
+  - nuvoton,micbias-voltage: Micbias voltage level.
+      0 - VDDA
+      1 - VDDA
+      2 - VDDA * 1.1
+      3 - VDDA * 1.2
+      4 - VDDA * 1.3
+      5 - VDDA * 1.4
+      6 - VDDA * 1.53
+      7 - VDDA * 1.53
+
+  - nuvoton,sar-threshold-num: Number of buttons supported
+  - nuvoton,sar-threshold: Impedance threshold for each button. Array that contains up to 8 buttons configuration. SAR value is calculated as
+    SAR = 255 * MICBIAS / SAR_VOLTAGE * R / (2000 + R)
+    where MICBIAS is configured by 'nuvoton,micbias-voltage', SAR_VOLTAGE is configured by 'nuvoton,sar-voltage', R - button impedance.
+    Refer datasheet section 10.2 for more information about threshold calculation.
+
+  - nuvoton,sar-hysteresis: Button impedance measurement hysteresis.
+
+  - nuvoton,sar-voltage: Reference voltage for button impedance measurement.
+      0 - VDDA
+      1 - VDDA
+      2 - VDDA * 1.1
+      3 - VDDA * 1.2
+      4 - VDDA * 1.3
+      5 - VDDA * 1.4
+      6 - VDDA * 1.53
+      7 - VDDA * 1.53
+
+  - nuvoton,sar-compare-time: SAR compare time
+      0 - 500 ns
+      1 - 1 us
+      2 - 2 us
+      3 - 4 us
+
+  - nuvoton,sar-sampling-time: SAR sampling time
+      0 - 2 us
+      1 - 4 us
+      2 - 8 us
+      3 - 16 us
+
+  - nuvoton,short-key-debounce: Button short key press debounce time.
+      0 - 30 ms
+      1 - 50 ms
+      2 - 100 ms
+
+  - nuvoton,jack-eject-debounce: Jack ejection debounce time.
+      0 - 0 ms
+      1 - 1 ms
+      2 - 10 ms
+
+
+Example:
+
+  headset: nau8824@1a {
+      compatible = "nuvoton,nau8824";
+      reg = <0x1a>;
+      interrupt-parent = <&gpio>;
+      interrupts = <TEGRA_GPIO(E, 6) IRQ_TYPE_LEVEL_LOW>;
+      nuvoton,vref-impedance = <2>;
+      nuvoton,micbias-voltage = <6>;
+      // Setup 4 buttons impedance according to Android specification
+      nuvoton,sar-threshold-num = <4>;
+      nuvoton,sar-threshold = <0xc 0x1e 0x38 0x60>;
+      nuvoton,sar-hysteresis = <0>;
+      nuvoton,sar-voltage = <6>;
+      nuvoton,sar-compare-time = <1>;
+      nuvoton,sar-sampling-time = <1>;
+      nuvoton,short-key-debounce = <0>;
+      nuvoton,jack-eject-debounce = <1>;
+  };
diff --git a/Documentation/devicetree/bindings/sound/rockchip-i2s.txt b/Documentation/devicetree/bindings/sound/rockchip-i2s.txt
index a6600f6dea64..206aba1b34bb 100644
--- a/Documentation/devicetree/bindings/sound/rockchip-i2s.txt
+++ b/Documentation/devicetree/bindings/sound/rockchip-i2s.txt
@@ -9,6 +9,7 @@ Required properties:
    - "rockchip,rk3066-i2s": for rk3066
    - "rockchip,rk3188-i2s", "rockchip,rk3066-i2s": for rk3188
    - "rockchip,rk3288-i2s", "rockchip,rk3066-i2s": for rk3288
+   - "rockchip,rk3368-i2s", "rockchip,rk3066-i2s": for rk3368
    - "rockchip,rk3399-i2s", "rockchip,rk3066-i2s": for rk3399
 - reg: physical base address of the controller and length of memory mapped
   region.
diff --git a/Documentation/devicetree/bindings/sound/samsung,odroid.txt b/Documentation/devicetree/bindings/sound/samsung,odroid.txt
new file mode 100644
index 000000000000..c1ac70cb0afb
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/samsung,odroid.txt
@@ -0,0 +1,57 @@
+Samsung Exynos Odroid XU3/XU4 audio complex with MAX98090 codec
+
+Required properties:
+
+ - compatible - "samsung,odroidxu3-audio" - for Odroid XU3 board,
+                "samsung,odroidxu4-audio" - for Odroid XU4 board
+ - model - the user-visible name of this sound complex
+ - 'cpu' subnode with a 'sound-dai' property containing the phandle of the I2S
+    controller
+ - 'codec' subnode with a 'sound-dai' property containing list of phandles
+    to the CODEC nodes, first entry must be corresponding to the MAX98090
+    CODEC and the second entry must be the phandle of the HDMI IP block node
+ - clocks - should contain entries matching clock names in the clock-names
+    property
+ - clock-names - should contain following entries:
+    - "epll" - indicating the EPLL output clock
+    - "i2s_rclk" - indicating the RCLK (root) clock of the I2S0 controller
+ - samsung,audio-widgets - this property specifies off-codec audio elements
+   like headphones or speakers, for details see widgets.txt
+ - samsung,audio-routing - a list of the connections between audio
+   components;  each entry is a pair of strings, the first being the
+   connection's sink, the second being the connection's source;
+   valid names for sources and sinks are the MAX98090's pins (as
+   documented in its binding), and the jacks on the board
+
+   For Odroid X2:
+     "Headphone Jack", "Mic Jack", "DMIC"
+
+   For Odroid U3, XU3:
+     "Headphone Jack", "Speakers"
+
+   For Odroid XU4:
+     no entries
+
+Example:
+
+sound {
+        compatible = "samsung,odroidxu3-audio";
+        samsung,cpu-dai = <&i2s0>;
+        samsung,codec-dai = <&max98090>;
+        model = "Odroid-XU3";
+        samsung,audio-routing =
+                "Headphone Jack", "HPL",
+                "Headphone Jack", "HPR",
+                "IN1", "Mic Jack",
+                "Mic Jack", "MICBIAS";
+
+        clocks = <&clock CLK_FOUT_EPLL>, <&i2s0 CLK_I2S_RCLK_SRC>;
+        clock-names = "epll", "sclk_i2s";
+
+        cpu {
+                sound-dai = <&i2s0 0>;
+        };
+        codec {
+                sound-dai = <&hdmi>, <&max98090>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/sound/sgtl5000.txt b/Documentation/devicetree/bindings/sound/sgtl5000.txt
index 5666da7b8605..7a73a9d62015 100644
--- a/Documentation/devicetree/bindings/sound/sgtl5000.txt
+++ b/Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -26,6 +26,15 @@ Optional properties:
         If this node is not mentioned or the value is unknown, then
         the value is set to 1.25V.
 
+- lrclk-strength: the LRCLK pad strength. Possible values are:
+0, 1, 2 and 3 as per the table below:
+
+VDDIO           1.8V            2.5V            3.3V
+0 =             Disable
+1 =             1.66 mA         2.87 mA         4.02  mA
+2 =             3.33 mA         5.74 mA         8.03  mA
+3 =             4.99 mA         8.61 mA         12.05 mA
+
 Example:
 
 codec: sgtl5000@0a {
diff --git a/Documentation/devicetree/bindings/sound/st,stm32-sai.txt b/Documentation/devicetree/bindings/sound/st,stm32-sai.txt
new file mode 100644
index 000000000000..c59a3d779e06
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/st,stm32-sai.txt
@@ -0,0 +1,89 @@
+STMicroelectronics STM32 Serial Audio Interface (SAI).
+
+The SAI interface (Serial Audio Interface) offers a wide set of audio protocols
+as I2S standards, LSB or MSB-justified, PCM/DSP, TDM, and AC'97.
+The SAI contains two independent audio sub-blocks. Each sub-block has
+its own clock generator and I/O lines controller.
+
+Required properties:
+  - compatible: Should be "st,stm32f4-sai"
+  - reg: Base address and size of SAI common register set.
+  - clocks: Must contain phandle and clock specifier pairs for each entry
+        in clock-names.
+  - clock-names: Must contain "x8k" and "x11k"
+        "x8k": SAI parent clock for sampling rates multiple of 8kHz.
+        "x11k": SAI parent clock for sampling rates multiple of 11.025kHz.
+  - interrupts: cpu DAI interrupt line shared by SAI sub-blocks
+
+Optional properties:
+  - resets: Reference to a reset controller asserting the SAI
+
+SAI subnodes:
+Two subnodes corresponding to SAI sub-block instances A et B can be defined.
+Subnode can be omitted for unsused sub-block.
+
+SAI subnodes required properties:
+  - compatible: Should be "st,stm32-sai-sub-a" or "st,stm32-sai-sub-b"
+        for SAI sub-block A or B respectively.
+  - reg: Base address and size of SAI sub-block register set.
+  - clocks: Must contain one phandle and clock specifier pair
+        for sai_ck which feeds the internal clock generator.
+  - clock-names: Must contain "sai_ck".
+  - dmas: see Documentation/devicetree/bindings/dma/stm32-dma.txt
+  - dma-names: identifier string for each DMA request line
+        "tx": if sai sub-block is configured as playback DAI
+        "rx": if sai sub-block is configured as capture DAI
+  - pinctrl-names: should contain only value "default"
+  - pinctrl-0: see Documentation/devicetree/bindings/pinctrl/pinctrl-stm32.txt
+
+Example:
+sound_card {
+        compatible = "audio-graph-card";
+        dais = <&sai1b_port>;
+};
+
+sai1: sai1@40015800 {
+        compatible = "st,stm32f4-sai";
+        #address-cells = <1>;
+        #size-cells = <1>;
+        ranges;
+        reg = <0x40015800 0x4>;
+        clocks = <&rcc 1 CLK_SAIQ_PDIV>, <&rcc 1 CLK_I2SQ_PDIV>;
+        clock-names = "x8k", "x11k";
+        interrupts = <87>;
+
+        sai1b: audio-controller@40015824 {
+                #sound-dai-cells = <0>;
+                compatible = "st,stm32-sai-sub-b";
+                reg = <0x40015824 0x1C>;
+                clocks = <&rcc 1 CLK_SAI2>;
+                clock-names = "sai_ck";
+                dmas = <&dma2 5 0 0x400 0x0>;
+                dma-names = "tx";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_sai1b>;
+
+                ports {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        sai1b_port: port@0 {
+                                reg = <0>;
+                                cpu_endpoint: endpoint {
+                                        remote-endpoint = <&codec_endpoint>;
+                                        audio-graph-card,format = "i2s";
+                                        audio-graph-card,bitclock-master = <&codec_endpoint>;
+                                        audio-graph-card,frame-master = <&codec_endpoint>;
+                                };
+                        };
+                };
+        };
+};
+
+audio-codec {
+        codec_port: port {
+                codec_endpoint: endpoint {
+                        remote-endpoint = <&cpu_endpoint>;
+                };
+        };
+};
diff --git a/Documentation/devicetree/bindings/sound/tas2552.txt b/Documentation/devicetree/bindings/sound/tas2552.txt
index c49992c0b62a..2d71eb05c1d3 100644
--- a/Documentation/devicetree/bindings/sound/tas2552.txt
+++ b/Documentation/devicetree/bindings/sound/tas2552.txt
@@ -5,7 +5,8 @@ The tas2552 serial control bus communicates through I2C protocols
 Required properties:
         - compatible - One of:
                 "ti,tas2552" - TAS2552
-        - reg -  I2C slave address
+        - reg -  I2C slave address: it can be 0x40 if ADDR pin is 0
+                                    or 0x41 if ADDR pin is 1.
         - supply-*: Required supply regulators are:
                 "vbat"          battery voltage
                 "iovdd"         I/O Voltage
@@ -14,17 +15,20 @@ Required properties:
 Optional properties:
         - enable-gpio - gpio pin to enable/disable the device
 
-tas2552 can receive it's reference clock via MCLK, BCLK, IVCLKIN pin or use the
+tas2552 can receive its reference clock via MCLK, BCLK, IVCLKIN pin or use the
 internal 1.8MHz. This CLKIN is used by the PLL. In addition to PLL, the PDM
 reference clock is also selectable: PLL, IVCLKIN, BCLK or MCLK.
 For system integration the dt-bindings/sound/tas2552.h header file provides
-defined values to selct and configure the PLL and PDM reference clocks.
+defined values to select and configure the PLL and PDM reference clocks.
 
 Example:
 
 tas2552: tas2552@41 {
         compatible = "ti,tas2552";
         reg = <0x41>;
+        vbat-supply = <&reg_vbat>;
+        iovdd-supply = <&reg_iovdd>;
+        avdd-supply = <&reg_avdd>;
         enable-gpio = <&gpio4 2 GPIO_ACTIVE_HIGH>;
 };
 
diff --git a/Documentation/devicetree/bindings/sound/wm8903.txt b/Documentation/devicetree/bindings/sound/wm8903.txt
index 94ec32c194bb..afc51caf1137 100644
--- a/Documentation/devicetree/bindings/sound/wm8903.txt
+++ b/Documentation/devicetree/bindings/sound/wm8903.txt
@@ -28,6 +28,14 @@ Optional properties:
     performed. If any entry has the value 0xffffffff, that GPIO's
     configuration will not be modified.
 
+  - AVDD-supply : Analog power supply regulator on the AVDD pin.
+
+  - CPVDD-supply : Charge pump supply regulator on the CPVDD pin.
+
+  - DBVDD-supply : Digital buffer supply regulator for the DBVDD pin.
+
+  - DCVDD-supply : Digital core supply regulator for the DCVDD pin.
+
 Pins on the device (for linking into audio routes):
 
   * IN1L
@@ -54,6 +62,11 @@ codec: wm8903@1a {
         reg = <0x1a>;
         interrupts = < 347 >;
 
+        AVDD-supply = <&fooreg_a>;
+        CPVDD-supply = <&fooreg_b>;
+        DBVDD-supply = <&fooreg_c>;
+        DCVDC-supply = <&fooreg_d>;
+
         gpio-controller;
         #gpio-cells = <2>;
 
diff --git a/Documentation/devicetree/bindings/sound/zte,tdm.txt b/Documentation/devicetree/bindings/sound/zte,tdm.txt
new file mode 100644
index 000000000000..2a07ca655264
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/zte,tdm.txt
@@ -0,0 +1,30 @@
+ZTE TDM DAI driver
+
+Required properties:
+
+- compatible : should be one of the following.
+       * zte,zx296718-tdm
+- reg : physical base address of the controller and length of memory mapped
+    region.
+- clocks : Pairs of phandle and specifier referencing the controller's clocks.
+- clock-names: "wclk" for the wclk.
+               "pclk" for the pclk.
+-#clock-cells: should be 1.
+- zte,tdm-dma-sysctrl : Reference to the sysctrl controller controlling
+    the dma. includes:
+        phandle of sysctrl.
+        register offset in sysctrl for control dma.
+        mask of the register that be written to sysctrl.
+
+Example:
+
+        tdm: tdm@1487000 {
+                compatible = "zte,zx296718-tdm";
+                reg = <0x01487000 0x1000>;
+                clocks = <&audiocrm AUDIO_TDM_WCLK>, <&audiocrm AUDIO_TDM_PCLK>;
+                clock-names = "wclk", "pclk";
+                #clock-cells = <1>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&tdm_global_pin>;
+                zte,tdm-dma-sysctrl = <&sysctrl 0x10c 4>;
+        };
diff --git a/Documentation/extcon/intel-int3496.txt b/Documentation/extcon/intel-int3496.txt
index af0b366c25b7..8155dbc7fad3 100644
--- a/Documentation/extcon/intel-int3496.txt
+++ b/Documentation/extcon/intel-int3496.txt
@@ -20,3 +20,8 @@ Index 1: The output gpio for enabling Vbus output from the device to the otg
 Index 2: The output gpio for muxing of the data pins between the USB host and
          the USB peripheral controller, write 1 to mux to the peripheral
          controller
+
+There is a mapping between indices and GPIO connection IDs as follows
+        id      index 0
+        vbus    index 1
+        mux     index 2
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index fdcfdd79682a..fe25787ff6d4 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -58,8 +58,7 @@ prototypes:
         int (*permission) (struct inode *, int, unsigned int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start, u64 len);
         void (*update_time)(struct inode *, struct timespec *, int);
diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
index 95280079c0b3..5fb17f49f7a2 100644
--- a/Documentation/filesystems/porting
+++ b/Documentation/filesystems/porting
@@ -600,3 +600,9 @@ in your dentry operations instead.
 [recommended]
         ->readlink is optional for symlinks.  Don't set, unless filesystem needs
         to fake something for readlink(2).
+--
+[mandatory]
+        ->getattr() is now passed a struct path rather than a vfsmount and
+        dentry separately, and it now has request_mask and query_flags arguments
+        to specify the fields and sync type requested by statx.  Filesystems not
+        supporting any statx-specific features may ignore the new arguments.
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 569211703721..94dd27ef4a76 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -382,8 +382,7 @@ struct inode_operations {
         int (*permission) (struct inode *, int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         void (*update_time)(struct inode *, struct timespec *, int);
         int (*atomic_open)(struct inode *, struct dentry *, struct file *,
diff --git a/Documentation/gcc-plugins.txt b/Documentation/gcc-plugins.txt
index 891c69464434..433eaefb4aa1 100644
--- a/Documentation/gcc-plugins.txt
+++ b/Documentation/gcc-plugins.txt
@@ -18,8 +18,8 @@ because gcc versions 4.5 and 4.6 are compiled by a C compiler,
 gcc-4.7 can be compiled by a C or a C++ compiler,
 and versions 4.8+ can only be compiled by a C++ compiler.
 
-Currently the GCC plugin infrastructure supports only the x86, arm and arm64
-architectures.
+Currently the GCC plugin infrastructure supports only the x86, arm, arm64 and
+powerpc architectures.
 
 This infrastructure was ported from grsecurity [6] and PaX [7].
 
diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
index 54bd5faa8782..f2af35f6d6b2 100644
--- a/Documentation/pinctrl.txt
+++ b/Documentation/pinctrl.txt
@@ -77,9 +77,15 @@ static struct pinctrl_desc foo_desc = {
 
 int __init foo_probe(void)
 {
+        int error;
+
         struct pinctrl_dev *pctl;
 
-        return pinctrl_register_and_init(&foo_desc, <PARENT>, NULL, &pctl);
+        error = pinctrl_register_and_init(&foo_desc, <PARENT>, NULL, &pctl);
+        if (error)
+                return error;
+
+        return pinctrl_enable(pctl);
 }
 
 To enable the pinctrl subsystem and the subgroups for PINMUX and PINCONF and
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index 11ec2d93a5e0..61e9c78bd6d1 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -124,7 +124,7 @@ specified in the following format in the sign-off area:
 
 .. code-block:: none
 
-     Cc: <stable@vger.kernel.org> # 3.3.x-
+     Cc: <stable@vger.kernel.org> # 3.3.x
 
 The tag has the meaning of:
 
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 3c248f772ae6..fd106899afd1 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -3377,6 +3377,69 @@ struct kvm_ppc_resize_hpt {
         __u32 pad;
 };
 
+4.104 KVM_X86_GET_MCE_CAP_SUPPORTED
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: system ioctl
+Parameters: u64 mce_cap (out)
+Returns: 0 on success, -1 on error
+
+Returns supported MCE capabilities. The u64 mce_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register. Supported
+capabilities will have the corresponding bits set.
+
+4.105 KVM_X86_SETUP_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: u64 mcg_cap (in)
+Returns: 0 on success,
+         -EFAULT if u64 mcg_cap cannot be read,
+         -EINVAL if the requested number of banks is invalid,
+         -EINVAL if requested MCE capability is not supported.
+
+Initializes MCE support for use. The u64 mcg_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register and
+specifies which capabilities should be enabled. The maximum
+supported number of error-reporting banks can be retrieved when
+checking for KVM_CAP_MCE. The supported capabilities can be
+retrieved with KVM_X86_GET_MCE_CAP_SUPPORTED.
+
+4.106 KVM_X86_SET_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: struct kvm_x86_mce (in)
+Returns: 0 on success,
+         -EFAULT if struct kvm_x86_mce cannot be read,
+         -EINVAL if the bank number is invalid,
+         -EINVAL if VAL bit is not set in status field.
+
+Inject a machine check error (MCE) into the guest. The input
+parameter is:
+
+struct kvm_x86_mce {
+        __u64 status;
+        __u64 addr;
+        __u64 misc;
+        __u64 mcg_status;
+        __u8 bank;
+        __u8 pad1[7];
+        __u64 pad2[3];
+};
+
+If the MCE being reported is an uncorrected error, KVM will
+inject it as an MCE exception into the guest. If the guest
+MCG_STATUS register reports that an MCE is in progress, KVM
+causes an KVM_EXIT_SHUTDOWN vmexit.
+
+Otherwise, if the MCE is a corrected error, KVM will just
+store it in the corresponding bank (provided this bank is
+not holding a previously reported uncorrected error).
+
 5. The kvm_run structure
 ------------------------
 
diff --git a/Documentation/virtual/kvm/devices/arm-vgic.txt b/Documentation/virtual/kvm/devices/arm-vgic.txt
index 76e61c883347..b2f60ca8b60c 100644
--- a/Documentation/virtual/kvm/devices/arm-vgic.txt
+++ b/Documentation/virtual/kvm/devices/arm-vgic.txt
@@ -83,6 +83,12 @@ Groups:
 
     Bits for undefined preemption levels are RAZ/WI.
 
+    For historical reasons and to provide ABI compatibility with userspace we
+    export the GICC_PMR register in the format of the GICH_VMCR.VMPriMask
+    field in the lower 5 bits of a word, meaning that userspace must always
+    use the lower 5 bits to communicate with the KVM device and must shift the
+    value left by 3 places to obtain the actual priority mask level.
+
   Limitations:
     - Priorities are not implemented, and registers are RAZ/WI
     - Currently only implemented for KVM_DEV_TYPE_ARM_VGIC_V2.
diff --git a/MAINTAINERS b/MAINTAINERS
index c776906f67a9..38d3e4ed7208 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2585,12 +2585,26 @@ F:	include/uapi/linux/if_bonding.h
 
 BPF (Safe dynamic programs and tools)
 M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
 L:      netdev@vger.kernel.org
 L:      linux-kernel@vger.kernel.org
 S:      Supported
+F:      arch/x86/net/bpf_jit*
+F:      Documentation/networking/filter.txt
+F:      include/linux/bpf*
+F:      include/linux/filter.h
+F:      include/uapi/linux/bpf*
+F:      include/uapi/linux/filter.h
 F:      kernel/bpf/
-F:      tools/testing/selftests/bpf/
+F:      kernel/trace/bpf_trace.c
 F:      lib/test_bpf.c
+F:      net/bpf/
+F:      net/core/filter.c
+F:      net/sched/act_bpf.c
+F:      net/sched/cls_bpf.c
+F:      samples/bpf/
+F:      tools/net/bpf*
+F:      tools/testing/selftests/bpf/
 
 BROADCOM B44 10/100 ETHERNET DRIVER
 M:      Michael Chan <michael.chan@broadcom.com>
@@ -3216,7 +3230,6 @@ F:	drivers/platform/chrome/
 
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
-M:      Sujith Sankar <ssujith@cisco.com>
 M:      Govindarajulu Varadarajan <_govind@gmx.com>
 M:      Neel Patel <neepatel@cisco.com>
 S:      Supported
@@ -4118,14 +4131,13 @@ F:	drivers/block/drbd/
 F:      lib/lru_cache.c
 F:      Documentation/blockdev/drbd/
 
-DRIVER CORE, KOBJECTS, DEBUGFS, KERNFS AND SYSFS
+DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
 S:      Supported
 F:      Documentation/kobject.txt
 F:      drivers/base/
 F:      fs/debugfs/
-F:      fs/kernfs/
 F:      fs/sysfs/
 F:      include/linux/debugfs.h
 F:      include/linux/kobj*
@@ -4776,6 +4788,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/mpc85xx_edac.[ch]
 
+EDAC-PND2
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/pnd2_edac.[ch]
+
 EDAC-PASEMI
 M:      Egor Martovetsky <egor@pasemi.com>
 L:      linux-edac@vger.kernel.org
@@ -4923,6 +4941,7 @@ F:	include/linux/netfilter_bridge/
 F:      net/bridge/
 
 ETHERNET PHY LIBRARY
+M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -7084,9 +7103,9 @@ S:	Maintained
 F:      fs/autofs4/
 
 KERNEL BUILD + files below scripts/ (unless maintained elsewhere)
+M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 M:      Michal Marek <mmarek@suse.com>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git for-next
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git rc-fixes
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git
 L:      linux-kbuild@vger.kernel.org
 S:      Maintained
 F:      Documentation/kbuild/
@@ -7203,6 +7222,14 @@ F:	arch/mips/include/uapi/asm/kvm*
 F:      arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
 
+KERNFS
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Tejun Heo <tj@kernel.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
+S:      Supported
+F:      include/linux/kernfs.h
+F:      fs/kernfs/
+
 KEXEC
 M:      Eric Biederman <ebiederm@xmission.com>
 W:      http://kernel.org/pub/linux/utils/kernel/kexec/
@@ -7774,13 +7801,6 @@ F:	include/net/mac80211.h
 F:      net/mac80211/
 F:      drivers/net/wireless/mac80211_hwsim.[ch]
 
-MACVLAN DRIVER
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_macvlan.h
-
 MAILBOX API
 M:      Jassi Brar <jassisinghbrar@gmail.com>
 L:      linux-kernel@vger.kernel.org
@@ -7853,6 +7873,8 @@ F:	drivers/net/ethernet/marvell/mvneta.*
 MARVELL MWIFIEX WIRELESS DRIVER
 M:      Amitkumar Karwar <akarwar@marvell.com>
 M:      Nishant Sarmukadam <nishants@marvell.com>
+M:      Ganapathi Bhat <gbhat@marvell.com>
+M:      Xinming Hu <huxm@marvell.com>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/marvell/mwifiex/
@@ -8753,6 +8775,7 @@ W:	http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+B:      mailto:netdev@vger.kernel.org
 S:      Maintained
 F:      net/
 F:      include/net/
@@ -10814,6 +10837,7 @@ F:	drivers/s390/block/dasd*
 F:      block/partitions/ibm.c
 
 S390 NETWORK DRIVERS
+M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
 M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
 L:      linux-s390@vger.kernel.org
 W:      http://www.ibm.com/developerworks/linux/linux390/
@@ -10844,6 +10868,7 @@ S:	Supported
 F:      drivers/s390/scsi/zfcp_*
 
 S390 IUCV NETWORK LAYER
+M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
 M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
 L:      linux-s390@vger.kernel.org
 W:      http://www.ibm.com/developerworks/linux/linux390/
@@ -12454,7 +12479,6 @@ F:	drivers/clk/ti/
 F:      include/linux/clk/ti.h
 
 TI ETHERNET SWITCH DRIVER (CPSW)
-M:      Mugunthan V N <mugunthanvnm@ti.com>
 R:      Grygorii Strashko <grygorii.strashko@ti.com>
 L:      linux-omap@vger.kernel.org
 L:      netdev@vger.kernel.org
@@ -13295,7 +13319,7 @@ F:	drivers/virtio/
 F:      tools/virtio/
 F:      drivers/net/virtio_net.c
 F:      drivers/block/virtio_blk.c
-F:      include/linux/virtio_*.h
+F:      include/linux/virtio*.h
 F:      include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
 
@@ -13383,14 +13407,6 @@ W:	https://linuxtv.org
 S:      Maintained
 F:      drivers/media/platform/vivid/*
 
-VLAN (802.1Q)
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_*vlan.h
-F:      net/8021q/
-
 VLYNQ BUS
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
diff --git a/Makefile b/Makefile
index b2faa9319372..779302695453 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc8
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -372,7 +372,7 @@ LDFLAGS_MODULE  =
 CFLAGS_KERNEL   =
 AFLAGS_KERNEL   =
 LDFLAGS_vmlinux =
-CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
+CFLAGS_GCOV     := -fprofile-arcs -ftest-coverage -fno-tree-loop-im $(call cc-disable-warning,maybe-uninitialized,)
 CFLAGS_KCOV     := $(call cc-option,-fsanitize-coverage=trace-pc,)
 
 
@@ -653,6 +653,12 @@ KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
 # Tell gcc to never replace conditional load with a non-conditional one
 KBUILD_CFLAGS   += $(call cc-option,--param=allow-store-data-races=0)
 
+# check for 'asm goto'
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
+        KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
+        KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
+endif
+
 include scripts/Makefile.gcc-plugins
 
 ifdef CONFIG_READABLE_ASM
@@ -798,12 +804,6 @@ KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
 # use the deterministic mode of AR if available
 KBUILD_ARFLAGS := $(call ar-option,D)
 
-# check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
-        KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
-        KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
-endif
-
 include scripts/Makefile.kasan
 include scripts/Makefile.extrawarn
 include scripts/Makefile.ubsan
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 0b961093ca5c..6d76e528ab8f 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1290,7 +1290,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
         /* copy relevant bits of struct timex. */
         if (copy_from_user(&txc, txc_p, offsetof(struct timex32, time)) ||
             copy_from_user(&txc.tick, &txc_p->tick, sizeof(struct timex32) - 
-                           offsetof(struct timex32, time)))
+                           offsetof(struct timex32, tick)))
           return -EFAULT;
 
         ret = do_adjtimex(&txc);        
diff --git a/arch/arc/boot/dts/skeleton.dtsi b/arch/arc/boot/dts/skeleton.dtsi
index 65808fe0a290..2891cb266cf0 100644
--- a/arch/arc/boot/dts/skeleton.dtsi
+++ b/arch/arc/boot/dts/skeleton.dtsi
@@ -26,6 +26,7 @@
                         device_type = "cpu";
                         compatible = "snps,arc770d";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs.dtsi b/arch/arc/boot/dts/skeleton_hs.dtsi
index 2dfe8037dfbb..5e944d3e5b74 100644
--- a/arch/arc/boot/dts/skeleton_hs.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs.dtsi
@@ -21,6 +21,7 @@
                         device_type = "cpu";
                         compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs_idu.dtsi b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
index 4c11079f3565..54b277d7dea0 100644
--- a/arch/arc/boot/dts/skeleton_hs_idu.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
@@ -19,8 +19,27 @@
 
                 cpu@0 {
                         device_type = "cpu";
-                        compatible = "snps,archs38xN";
+                        compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
+                };
+                cpu@1 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <1>;
+                        clocks = <&core_clk>;
+                };
+                cpu@2 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <2>;
+                        clocks = <&core_clk>;
+                };
+                cpu@3 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <3>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
index f0df59b23e21..459fc656b759 100644
--- a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
@@ -112,13 +112,19 @@
                         interrupts = <7>;
                         bus-width = <4>;
                 };
+        };
 
-                /* Embedded Vision subsystem UIO mappings; only relevant for EV VDK */
-                uio_ev: uio@0xD0000000 {
-                        compatible = "generic-uio";
-                        reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
-                        reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
-                        interrupts = <23>;
-                };
+        /*
+         * Embedded Vision subsystem UIO mappings; only relevant for EV VDK
+         *
+         * This node is intentionally put outside of MB above becase
+         * it maps areas outside of MB's 0xEz-0xFz.
+         */
+        uio_ev: uio@0xD0000000 {
+                compatible = "generic-uio";
+                reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
+                reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
+                interrupt-parent = <&mb_intc>;
+                interrupts = <23>;
         };
 };
diff --git a/arch/arc/include/asm/kprobes.h b/arch/arc/include/asm/kprobes.h
index 00bdbe167615..2e52d18e6bc7 100644
--- a/arch/arc/include/asm/kprobes.h
+++ b/arch/arc/include/asm/kprobes.h
@@ -54,9 +54,7 @@ int kprobe_fault_handler(struct pt_regs *regs, unsigned long cause);
 void kretprobe_trampoline(void);
 void trap_is_kprobe(unsigned long address, struct pt_regs *regs);
 #else
-static void trap_is_kprobe(unsigned long address, struct pt_regs *regs)
-{
-}
+#define trap_is_kprobe(address, regs)
 #endif /* CONFIG_KPROBES */
 
 #endif /* _ARC_KPROBES_H */
diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index 2585632eaa68..cc558a25b8fa 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -100,15 +100,21 @@ END(handle_interrupt)
 ;################### Non TLB Exception Handling #############################
 
 ENTRY(EV_SWI)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_SWI)
 
 ENTRY(EV_DivZero)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DivZero)
 
 ENTRY(EV_DCError)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DCError)
 
 ; ---------------------------------------------
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 3093fa898a23..fa62404ba58f 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/delay.h>
 #include <linux/root_dev.h>
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/clocksource.h>
 #include <linux/console.h>
@@ -488,8 +489,9 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 {
         char *str;
         int cpu_id = ptr_to_cpu(v);
-        struct device_node *core_clk = of_find_node_by_name(NULL, "core_clk");
-        u32 freq = 0;
+        struct device *cpu_dev = get_cpu_device(cpu_id);
+        struct clk *cpu_clk;
+        unsigned long freq = 0;
 
         if (!cpu_online(cpu_id)) {
                 seq_printf(m, "processor [%d]\t: Offline\n", cpu_id);
@@ -502,9 +504,15 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 
         seq_printf(m, arc_cpu_mumbojumbo(cpu_id, str, PAGE_SIZE));
 
-        of_property_read_u32(core_clk, "clock-frequency", &freq);
+        cpu_clk = clk_get(cpu_dev, NULL);
+        if (IS_ERR(cpu_clk)) {
+                seq_printf(m, "CPU speed \t: Cannot get clock for processor [%d]\n",
+                           cpu_id);
+        } else {
+                freq = clk_get_rate(cpu_clk);
+        }
         if (freq)
-                seq_printf(m, "CPU speed\t: %u.%02u Mhz\n",
+                seq_printf(m, "CPU speed\t: %lu.%02lu Mhz\n",
                            freq / 1000000, (freq / 10000) % 100);
 
         seq_printf(m, "Bogo MIPS\t: %lu.%02lu\n",
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index d408fa21a07c..928562967f3c 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -633,6 +633,9 @@ noinline static void slc_entire_op(const int op)
 
         write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
 
+        /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
+        read_aux_reg(r);
+
         /* Important to wait for flush to complete */
         while (read_aux_reg(r) & SLC_CTRL_BUSY);
 }
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index efb5eae290a8..d42b98f15e8b 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -371,6 +371,8 @@
 
         phy1: ethernet-phy@1 {
                 reg = <7>;
+                eee-broken-100tx;
+                eee-broken-1000t;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 9e43c443738a..9ba4b18c0cb2 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -672,6 +672,7 @@
         ti,non-removable;
         bus-width = <4>;
         cap-power-off-card;
+        keep-power-in-suspend;
         pinctrl-names = "default";
         pinctrl-0 = <&mmc2_pins>;
 
diff --git a/arch/arm/boot/dts/am335x-pcm-953.dtsi b/arch/arm/boot/dts/am335x-pcm-953.dtsi
index 02981eae96b9..1ec8e0d80191 100644
--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
+++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
@@ -63,14 +63,14 @@
                         label = "home";
                         linux,code = <KEY_HOME>;
                         gpios = <&gpio3 7 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button@1 {
                         label = "menu";
                         linux,code = <KEY_MENU>;
                         gpios = <&gpio3 8 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
         };
diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
index 0d341c545b01..e5ac1d81d15c 100644
--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
+++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
@@ -315,6 +315,13 @@
                         /* ID & VBUS GPIOs provided in board dts */
                 };
         };
+
+        tpic2810: tpic2810@60 {
+                compatible = "ti,tpic2810";
+                reg = <0x60>;
+                gpio-controller;
+                #gpio-cells = <2>;
+        };
 };
 
 &mcspi3 {
@@ -330,13 +337,6 @@
                 spi-max-frequency = <1000000>;
                 spi-cpol;
         };
-
-        tpic2810: tpic2810@60 {
-                compatible = "ti,tpic2810";
-                reg = <0x60>;
-                gpio-controller;
-                #gpio-cells = <2>;
-        };
 };
 
 &uart3 {
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 4fbb089cf5ad..00de62dc0042 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -66,14 +66,14 @@
                 timer@20200 {
                         compatible = "arm,cortex-a9-global-timer";
                         reg = <0x20200 0x100>;
-                        interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
                 local-timer@20600 {
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x20600 0x100>;
-                        interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 13 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
diff --git a/arch/arm/boot/dts/bcm953012k.dts b/arch/arm/boot/dts/bcm953012k.dts
index bfd923096a8c..ae31a5826e91 100644
--- a/arch/arm/boot/dts/bcm953012k.dts
+++ b/arch/arm/boot/dts/bcm953012k.dts
@@ -48,15 +48,14 @@
         };
 
         memory {
-                reg = <0x00000000 0x10000000>;
+                reg = <0x80000000 0x10000000>;
         };
 };
 
 &uart0 {
-        clock-frequency = <62499840>;
+        status = "okay";
 };
 
 &uart1 {
-        clock-frequency = <62499840>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/bcm958522er.dts b/arch/arm/boot/dts/bcm958522er.dts
index 3f04a40eb90c..df05e7f568af 100644
--- a/arch/arm/boot/dts/bcm958522er.dts
+++ b/arch/arm/boot/dts/bcm958522er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525er.dts b/arch/arm/boot/dts/bcm958525er.dts
index 9fd542200d3d..4a3ab19c6281 100644
--- a/arch/arm/boot/dts/bcm958525er.dts
+++ b/arch/arm/boot/dts/bcm958525er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525xmc.dts b/arch/arm/boot/dts/bcm958525xmc.dts
index 41e7fd350fcd..81f78435d8c7 100644
--- a/arch/arm/boot/dts/bcm958525xmc.dts
+++ b/arch/arm/boot/dts/bcm958525xmc.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 31 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958622hr.dts b/arch/arm/boot/dts/bcm958622hr.dts
index 477c4860db52..c88b8fefcb2f 100644
--- a/arch/arm/boot/dts/bcm958622hr.dts
+++ b/arch/arm/boot/dts/bcm958622hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958623hr.dts b/arch/arm/boot/dts/bcm958623hr.dts
index c0a499d5ba44..d503fa0dde31 100644
--- a/arch/arm/boot/dts/bcm958623hr.dts
+++ b/arch/arm/boot/dts/bcm958623hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
index f7eb5854a224..cc0363b843c1 100644
--- a/arch/arm/boot/dts/bcm958625hr.dts
+++ b/arch/arm/boot/dts/bcm958625hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm988312hr.dts b/arch/arm/boot/dts/bcm988312hr.dts
index 16666324fda8..74e15a3cd9f8 100644
--- a/arch/arm/boot/dts/bcm988312hr.dts
+++ b/arch/arm/boot/dts/bcm988312hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 2c9e56f4aac5..bbfb9d5a70a9 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -283,6 +283,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <0>;
@@ -319,6 +320,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <1>;
diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
index 49f466fe0b1d..dcfc97591433 100644
--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
@@ -121,11 +121,6 @@
         };
 };
 
-&cpu0 {
-        arm-supply = <&sw1a_reg>;
-        soc-supply = <&sw1c_reg>;
-};
-
 &fec1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet1>;
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 8f9a69ca818c..efe53998c961 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -121,7 +121,7 @@
 &i2c3 {
         clock-frequency = <400000>;
         at24@50 {
-                compatible = "at24,24c02";
+                compatible = "atmel,24c64";
                 readonly;
                 reg = <0x50>;
         };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 22332be72140..528b4e9c6d3d 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -266,7 +266,7 @@
                 };
 
                 usb1: ohci@00400000 {
-                        compatible = "atmel,sama5d2-ohci", "usb-ohci";
+                        compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00400000 0x100000>;
                         interrupts = <41 IRQ_TYPE_LEVEL_HIGH 2>;
                         clocks = <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 82d8c4771293..162e1eb5373d 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -14,6 +14,7 @@
 #include <dt-bindings/mfd/dbx500-prcmu.h>
 #include <dt-bindings/arm/ux500_pm_domains.h>
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/clock/ste-ab8500.h>
 #include "skeleton.dtsi"
 
 / {
@@ -603,6 +604,11 @@
                                 interrupt-controller;
                                 #interrupt-cells = <2>;
 
+                                ab8500_clock: clock-controller {
+                                        compatible = "stericsson,ab8500-clk";
+                                        #clock-cells = <1>;
+                                };
+
                                 ab8500_gpio: ab8500-gpio {
                                         compatible = "stericsson,ab8500-gpio";
                                         gpio-controller;
@@ -686,6 +692,8 @@
 
                                 ab8500-pwm {
                                         compatible = "stericsson,ab8500-pwm";
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_INT>;
+                                        clock-names = "intclk";
                                 };
 
                                 ab8500-debugfs {
@@ -700,6 +708,9 @@
                                         V-AMIC2-supply = <&ab8500_ldo_anamic2_reg>;
                                         V-DMIC-supply = <&ab8500_ldo_dmic_reg>;
 
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_AUDIO>;
+                                        clock-names = "audioclk";
+
                                         stericsson,earpeice-cmv = <950>; /* Units in mV. */
                                 };
 
@@ -1095,6 +1106,14 @@
                         status = "disabled";
                 };
 
+                sound {
+                        compatible = "stericsson,snd-soc-mop500";
+                        stericsson,cpu-dai = <&msp1 &msp3>;
+                        stericsson,audio-codec = <&codec>;
+                        clocks = <&prcmu_clk PRCMU_SYSCLK>, <&ab8500_clock AB8500_SYSCLK_ULP>, <&ab8500_clock AB8500_SYSCLK_INT>;
+                        clock-names = "sysclk", "ulpclk", "intclk";
+                };
+
                 msp0: msp@80123000 {
                         compatible = "stericsson,ux500-msp-i2s";
                         reg = <0x80123000 0x1000>;
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index f37f9e10713c..9e359e4f342e 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -186,15 +186,6 @@
                         status = "okay";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index dd5514def604..ade1d0d4e5f4 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -159,15 +159,6 @@
                                      "", "", "", "", "", "", "", "";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
index 72ec0d5ae052..bbf1c8cbaac6 100644
--- a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
+++ b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
@@ -167,7 +167,7 @@
                                         reg = <8>;
                                         label = "cpu";
                                         ethernet = <&gmac>;
-                                        phy-mode = "rgmii";
+                                        phy-mode = "rgmii-txid";
                                         fixed-link {
                                                 speed = <1000>;
                                                 full-duplex;
diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
index a952cc0703cc..8a3ed21cb7bc 100644
--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
@@ -495,7 +495,7 @@
                         resets = <&ccu RST_BUS_GPU>;
 
                         assigned-clocks = <&ccu CLK_GPU>;
-                        assigned-clock-rates = <408000000>;
+                        assigned-clock-rates = <384000000>;
                 };
 
                 gic: interrupt-controller@01c81000 {
diff --git a/arch/arm/boot/dts/sun8i-a33.dtsi b/arch/arm/boot/dts/sun8i-a33.dtsi
index 0467fb365bfc..306af6cadf26 100644
--- a/arch/arm/boot/dts/sun8i-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a33.dtsi
@@ -66,12 +66,6 @@
                         opp-microvolt = <1200000>;
                         clock-latency-ns = <244144>; /* 8 32k periods */
                 };
-
-                opp@1200000000 {
-                        opp-hz = /bits/ 64 <1200000000>;
-                        opp-microvolt = <1320000>;
-                        clock-latency-ns = <244144>; /* 8 32k periods */
-                };
         };
 
         cpus {
@@ -81,16 +75,22 @@
                         operating-points-v2 = <&cpu0_opp_table>;
                 };
 
+                cpu@1 {
+                        operating-points-v2 = <&cpu0_opp_table>;
+                };
+
                 cpu@2 {
                         compatible = "arm,cortex-a7";
                         device_type = "cpu";
                         reg = <2>;
+                        operating-points-v2 = <&cpu0_opp_table>;
                 };
 
                 cpu@3 {
                         compatible = "arm,cortex-a7";
                         device_type = "cpu";
                         reg = <3>;
+                        operating-points-v2 = <&cpu0_opp_table>;
                 };
         };
 
diff --git a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
index 7097c18ff487..d6bd15898db6 100644
--- a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+++ b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
@@ -50,8 +50,6 @@
 
         backlight: backlight {
                 compatible = "pwm-backlight";
-                pinctrl-names = "default";
-                pinctrl-0 = <&bl_en_pin>;
                 pwms = <&pwm 0 50000 PWM_POLARITY_INVERTED>;
                 brightness-levels = <0 10 20 30 40 50 60 70 80 90 100>;
                 default-brightness-level = <8>;
@@ -93,11 +91,6 @@
 };
 
 &pio {
-        bl_en_pin: bl_en_pin@0 {
-                pins = "PH6";
-                function = "gpio_in";
-        };
-
         mmc0_cd_pin: mmc0_cd_pin@0 {
                 pins = "PB4";
                 function = "gpio_in";
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index f2462a6bdba6..decd388d613d 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -188,6 +188,7 @@ CONFIG_WL12XX=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SPI=m
 CONFIG_WLCORE_SDIO=m
+CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_EVDEV=m
 CONFIG_KEYBOARD_ATKBD=m
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 96dba7cd8be7..314eb6abe1ff 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -1124,6 +1124,9 @@ static void cpu_hyp_reinit(void)
                 if (__hyp_get_vectors() == hyp_default_vectors)
                         cpu_init_hyp_mode(NULL);
         }
+
+        if (vgic_present)
+                kvm_vgic_init_cpu_hardware();
 }
 
 static void cpu_hyp_reset(void)
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 962616fd4ddd..582a972371cf 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -292,11 +292,18 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
         phys_addr_t addr = start, end = start + size;
         phys_addr_t next;
 
+        assert_spin_locked(&kvm->mmu_lock);
         pgd = kvm->arch.pgd + stage2_pgd_index(addr);
         do {
                 next = stage2_pgd_addr_end(addr, end);
                 if (!stage2_pgd_none(*pgd))
                         unmap_stage2_puds(kvm, pgd, addr, next);
+                /*
+                 * If the range is too large, release the kvm->mmu_lock
+                 * to prevent starvation and lockup detector warnings.
+                 */
+                if (next != end)
+                        cond_resched_lock(&kvm->mmu_lock);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -803,6 +810,7 @@ void stage2_unmap_vm(struct kvm *kvm)
         int idx;
 
         idx = srcu_read_lock(&kvm->srcu);
+        down_read(&current->mm->mmap_sem);
         spin_lock(&kvm->mmu_lock);
 
         slots = kvm_memslots(kvm);
@@ -810,6 +818,7 @@ void stage2_unmap_vm(struct kvm *kvm)
                 stage2_unmap_memslot(kvm, memslot);
 
         spin_unlock(&kvm->mmu_lock);
+        up_read(&current->mm->mmap_sem);
         srcu_read_unlock(&kvm->srcu, idx);
 }
 
@@ -829,7 +838,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
         if (kvm->arch.pgd == NULL)
                 return;
 
+        spin_lock(&kvm->mmu_lock);
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+        spin_unlock(&kvm->mmu_lock);
+
         /* Free the HW pgd, one page at a time */
         free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE);
         kvm->arch.pgd = NULL;
@@ -1801,6 +1813,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
             (KVM_PHYS_SIZE >> PAGE_SHIFT))
                 return -EFAULT;
 
+        down_read(&current->mm->mmap_sem);
         /*
          * A memory region could potentially cover multiple VMAs, and any holes
          * between them, so iterate over all of them to find out if we can map
@@ -1844,8 +1857,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
                         pa += vm_start - vma->vm_start;
 
                         /* IO region dirty page logging not allowed */
-                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)
-                                return -EINVAL;
+                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
 
                         ret = kvm_phys_addr_ioremap(kvm, gpa, pa,
                                                     vm_end - vm_start,
@@ -1857,7 +1872,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         } while (hva < reg_end);
 
         if (change == KVM_MR_FLAGS_ONLY)
-                return ret;
+                goto out;
 
         spin_lock(&kvm->mmu_lock);
         if (ret)
@@ -1865,6 +1880,8 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         else
                 stage2_flush_memslot(kvm, memslot);
         spin_unlock(&kvm->mmu_lock);
+out:
+        up_read(&current->mm->mmap_sem);
         return ret;
 }
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 3d89b7905bd9..a277981f414d 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -289,6 +289,22 @@ static void at91_ddr_standby(void)
                 at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
 }
 
+static void sama5d3_ddr_standby(void)
+{
+        u32 lpr0;
+        u32 saved_lpr0;
+
+        saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
+        lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
+        lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN;
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
+
+        cpu_do_idle();
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
+}
+
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
@@ -323,7 +339,7 @@ static const struct of_device_id const ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
         { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
-        { .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby },
+        { .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby },
         { /*sentinel*/ }
 };
 
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 093458b62c8d..c89757abb0ae 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -241,6 +241,3 @@ obj-$(CONFIG_MACH_OMAP2_TUSB6010)	+= usb-tusb6010.o
 
 onenand-$(CONFIG_MTD_ONENAND_OMAP2)     := gpmc-onenand.o
 obj-y                                   += $(onenand-m) $(onenand-y)
-
-nand-$(CONFIG_MTD_NAND_OMAP2)           := gpmc-nand.o
-obj-y                                   += $(nand-m) $(nand-y)
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index c4f2ace91ea2..3089d3bfa19b 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -270,6 +270,7 @@ extern const struct smp_operations omap4_smp_ops;
 extern int omap4_mpuss_init(void);
 extern int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state);
 extern int omap4_hotplug_cpu(unsigned int cpu, unsigned int power_state);
+extern u32 omap4_get_cpu1_ns_pa_addr(void);
 #else
 static inline int omap4_enter_lowpower(unsigned int cpu,
                                         unsigned int power_state)
diff --git a/arch/arm/mach-omap2/gpmc-nand.c b/arch/arm/mach-omap2/gpmc-nand.c
deleted file mode 100644
index f6ac027f3c3b..000000000000
--- a/arch/arm/mach-omap2/gpmc-nand.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * gpmc-nand.c
- *
- * Copyright (C) 2009 Texas Instruments
- * Vimal Singh <vimalsingh@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-#include <linux/io.h>
-#include <linux/omap-gpmc.h>
-#include <linux/mtd/nand.h>
-#include <linux/platform_data/mtd-nand-omap2.h>
-
-#include <asm/mach/flash.h>
-
-#include "soc.h"
-
-/* minimum size for IO mapping */
-#define NAND_IO_SIZE    4
-
-static bool gpmc_hwecc_bch_capable(enum omap_ecc ecc_opt)
-{
-        /* platforms which support all ECC schemes */
-        if (soc_is_am33xx() || soc_is_am43xx() || cpu_is_omap44xx() ||
-                 soc_is_omap54xx() || soc_is_dra7xx())
-                return 1;
-
-        if (ecc_opt == OMAP_ECC_BCH4_CODE_HW_DETECTION_SW ||
-                 ecc_opt == OMAP_ECC_BCH8_CODE_HW_DETECTION_SW) {
-                if (cpu_is_omap24xx())
-                        return 0;
-                else if (cpu_is_omap3630() && (GET_OMAP_REVISION() == 0))
-                        return 0;
-                else
-                        return 1;
-        }
-
-        /* OMAP3xxx do not have ELM engine, so cannot support ECC schemes
-         * which require H/W based ECC error detection */
-        if ((cpu_is_omap34xx() || cpu_is_omap3630()) &&
-            ((ecc_opt == OMAP_ECC_BCH4_CODE_HW) ||
-                 (ecc_opt == OMAP_ECC_BCH8_CODE_HW)))
-                return 0;
-
-        /* legacy platforms support only HAM1 (1-bit Hamming) ECC scheme */
-        if (ecc_opt == OMAP_ECC_HAM1_CODE_HW ||
-            ecc_opt == OMAP_ECC_HAM1_CODE_SW)
-                return 1;
-        else
-                return 0;
-}
-
-/* This function will go away once the device-tree convertion is complete */
-static void gpmc_set_legacy(struct omap_nand_platform_data *gpmc_nand_data,
-                            struct gpmc_settings *s)
-{
-        /* Enable RD PIN Monitoring Reg */
-        if (gpmc_nand_data->dev_ready) {
-                s->wait_on_read = true;
-                s->wait_on_write = true;
-        }
-
-        if (gpmc_nand_data->devsize == NAND_BUSWIDTH_16)
-                s->device_width = GPMC_DEVWIDTH_16BIT;
-        else
-                s->device_width = GPMC_DEVWIDTH_8BIT;
-}
-
-int gpmc_nand_init(struct omap_nand_platform_data *gpmc_nand_data,
-                   struct gpmc_timings *gpmc_t)
-{
-        int err = 0;
-        struct gpmc_settings s;
-        struct platform_device *pdev;
-        struct resource gpmc_nand_res[] = {
-                { .flags = IORESOURCE_MEM, },
-                { .flags = IORESOURCE_IRQ, },
-                { .flags = IORESOURCE_IRQ, },
-        };
-
-        BUG_ON(gpmc_nand_data->cs >= GPMC_CS_NUM);
-
-        err = gpmc_cs_request(gpmc_nand_data->cs, NAND_IO_SIZE,
-                              (unsigned long *)&gpmc_nand_res[0].start);
-        if (err < 0) {
-                pr_err("omap2-gpmc: Cannot request GPMC CS %d, error %d\n",
-                       gpmc_nand_data->cs, err);
-                return err;
-        }
-        gpmc_nand_res[0].end = gpmc_nand_res[0].start + NAND_IO_SIZE - 1;
-        gpmc_nand_res[1].start = gpmc_get_client_irq(GPMC_IRQ_FIFOEVENTENABLE);
-        gpmc_nand_res[2].start = gpmc_get_client_irq(GPMC_IRQ_COUNT_EVENT);
-
-        memset(&s, 0, sizeof(struct gpmc_settings));
-        gpmc_set_legacy(gpmc_nand_data, &s);
-
-        s.device_nand = true;
-
-        if (gpmc_t) {
-                err = gpmc_cs_set_timings(gpmc_nand_data->cs, gpmc_t, &s);
-                if (err < 0) {
-                        pr_err("omap2-gpmc: Unable to set gpmc timings: %d\n",
-                               err);
-                        return err;
-                }
-        }
-
-        err = gpmc_cs_program_settings(gpmc_nand_data->cs, &s);
-        if (err < 0)
-                goto out_free_cs;
-
-        err = gpmc_configure(GPMC_CONFIG_WP, 0);
-        if (err < 0)
-                goto out_free_cs;
-
-        if (!gpmc_hwecc_bch_capable(gpmc_nand_data->ecc_opt)) {
-                pr_err("omap2-nand: Unsupported NAND ECC scheme selected\n");
-                err = -EINVAL;
-                goto out_free_cs;
-        }
-
-
-        pdev = platform_device_alloc("omap2-nand", gpmc_nand_data->cs);
-        if (pdev) {
-                err = platform_device_add_resources(pdev, gpmc_nand_res,
-                                                    ARRAY_SIZE(gpmc_nand_res));
-                if (!err)
-                        pdev->dev.platform_data = gpmc_nand_data;
-        } else {
-                err = -ENOMEM;
-        }
-        if (err)
-                goto out_free_pdev;
-
-        err = platform_device_add(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "Unable to register NAND device\n");
-                goto out_free_pdev;
-        }
-
-        return 0;
-
-out_free_pdev:
-        platform_device_put(pdev);
-out_free_cs:
-        gpmc_cs_free(gpmc_nand_data->cs);
-
-        return err;
-}
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 8633c703546a..2944af820558 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr)
         return ret;
 }
 
-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
 {
         int err;
         struct device *dev = &gpmc_onenand_device.dev;
@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
         if (err < 0) {
                 dev_err(dev, "Cannot request GPMC CS %d, error %d\n",
                         gpmc_onenand_data->cs, err);
-                return;
+                return err;
         }
 
         gpmc_onenand_resource.end = gpmc_onenand_resource.start +
                                                         ONENAND_IO_SIZE - 1;
 
-        if (platform_device_register(&gpmc_onenand_device) < 0) {
+        err = platform_device_register(&gpmc_onenand_device);
+        if (err) {
                 dev_err(dev, "Unable to register OneNAND device\n");
                 gpmc_cs_free(gpmc_onenand_data->cs);
-                return;
         }
+
+        return err;
 }
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index fe36ce2734d4..4c6f14cf92a8 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -17,6 +17,7 @@
 
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
 #include "omap44xx.h"
 
@@ -66,7 +67,7 @@ wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
         cmp     r0, r4
         bne     wait_2
         ldr     r12, =API_HYP_ENTRY
-        adr     r0, hyp_boot
+        badr    r0, hyp_boot
         smc     #0
 hyp_boot:
         b       omap_secondary_startup
diff --git a/arch/arm/mach-omap2/omap-hotplug.c b/arch/arm/mach-omap2/omap-hotplug.c
index d3fb5661bb5d..433db6d0b073 100644
--- a/arch/arm/mach-omap2/omap-hotplug.c
+++ b/arch/arm/mach-omap2/omap-hotplug.c
@@ -50,7 +50,7 @@ void omap4_cpu_die(unsigned int cpu)
                 omap4_hotplug_cpu(cpu, PWRDM_POWER_OFF);
 
                 if (omap_secure_apis_support())
-                        boot_cpu = omap_read_auxcoreboot0();
+                        boot_cpu = omap_read_auxcoreboot0() >> 9;
                 else
                         boot_cpu =
                                 readl_relaxed(base + OMAP_AUX_CORE_BOOT_0) >> 5;
diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
index 113ab2dd2ee9..03ec6d307c82 100644
--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
@@ -64,6 +64,7 @@
 #include "prm-regbits-44xx.h"
 
 static void __iomem *sar_base;
+static u32 old_cpu1_ns_pa_addr;
 
 #if defined(CONFIG_PM) && defined(CONFIG_SMP)
 
@@ -212,6 +213,11 @@ static void __init save_l2x0_context(void)
 {}
 #endif
 
+u32 omap4_get_cpu1_ns_pa_addr(void)
+{
+        return old_cpu1_ns_pa_addr;
+}
+
 /**
  * omap4_enter_lowpower: OMAP4 MPUSS Low Power Entry Function
  * The purpose of this function is to manage low power programming
@@ -460,22 +466,30 @@ int __init omap4_mpuss_init(void)
 void __init omap4_mpuss_early_init(void)
 {
         unsigned long startup_pa;
+        void __iomem *ns_pa_addr;
 
-        if (!(cpu_is_omap44xx() || soc_is_omap54xx()))
+        if (!(soc_is_omap44xx() || soc_is_omap54xx()))
                 return;
 
         sar_base = omap4_get_sar_ram_base();
 
-        if (cpu_is_omap443x())
+        /* Save old NS_PA_ADDR for validity checks later on */
+        if (soc_is_omap44xx())
+                ns_pa_addr = sar_base + CPU1_WAKEUP_NS_PA_ADDR_OFFSET;
+        else
+                ns_pa_addr = sar_base + OMAP5_CPU1_WAKEUP_NS_PA_ADDR_OFFSET;
+        old_cpu1_ns_pa_addr = readl_relaxed(ns_pa_addr);
+
+        if (soc_is_omap443x())
                 startup_pa = __pa_symbol(omap4_secondary_startup);
-        else if (cpu_is_omap446x())
+        else if (soc_is_omap446x())
                 startup_pa = __pa_symbol(omap4460_secondary_startup);
         else if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
                 startup_pa = __pa_symbol(omap5_secondary_hyp_startup);
         else
                 startup_pa = __pa_symbol(omap5_secondary_startup);
 
-        if (cpu_is_omap44xx())
+        if (soc_is_omap44xx())
                 writel_relaxed(startup_pa, sar_base +
                                CPU1_WAKEUP_NS_PA_ADDR_OFFSET);
         else
diff --git a/arch/arm/mach-omap2/omap-smc.S b/arch/arm/mach-omap2/omap-smc.S
index fd90125bffc7..72506e6cf9e7 100644
--- a/arch/arm/mach-omap2/omap-smc.S
+++ b/arch/arm/mach-omap2/omap-smc.S
@@ -94,6 +94,5 @@ ENTRY(omap_read_auxcoreboot0)
         ldr     r12, =0x103
         dsb
         smc     #0
-        mov     r0, r0, lsr #9
         ldmfd   sp!, {r2-r12, pc}
 ENDPROC(omap_read_auxcoreboot0)
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 003353b0b794..3faf454ba487 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -21,6 +21,7 @@
 #include <linux/io.h>
 #include <linux/irqchip/arm-gic.h>
 
+#include <asm/sections.h>
 #include <asm/smp_scu.h>
 #include <asm/virt.h>
 
@@ -40,10 +41,14 @@
 
 #define OMAP5_CORE_COUNT        0x2
 
+#define AUX_CORE_BOOT0_GP_RELEASE       0x020
+#define AUX_CORE_BOOT0_HS_RELEASE       0x200
+
 struct omap_smp_config {
         unsigned long cpu1_rstctrl_pa;
         void __iomem *cpu1_rstctrl_va;
         void __iomem *scu_base;
+        void __iomem *wakeupgen_base;
         void *startup_addr;
 };
 
@@ -140,7 +145,6 @@ static int omap4_boot_secondary(unsigned int cpu, struct task_struct *idle)
         static struct clockdomain *cpu1_clkdm;
         static bool booted;
         static struct powerdomain *cpu1_pwrdm;
-        void __iomem *base = omap_get_wakeupgen_base();
 
         /*
          * Set synchronisation state between this boot processor
@@ -155,9 +159,11 @@ static int omap4_boot_secondary(unsigned int cpu, struct task_struct *idle)
          * A barrier is added to ensure that write buffer is drained
          */
         if (omap_secure_apis_support())
-                omap_modify_auxcoreboot0(0x200, 0xfffffdff);
+                omap_modify_auxcoreboot0(AUX_CORE_BOOT0_HS_RELEASE,
+                                         0xfffffdff);
         else
-                writel_relaxed(0x20, base + OMAP_AUX_CORE_BOOT_0);
+                writel_relaxed(AUX_CORE_BOOT0_GP_RELEASE,
+                               cfg.wakeupgen_base + OMAP_AUX_CORE_BOOT_0);
 
         if (!cpu1_clkdm && !cpu1_pwrdm) {
                 cpu1_clkdm = clkdm_lookup("mpu1_clkdm");
@@ -261,9 +267,72 @@ static void __init omap4_smp_init_cpus(void)
                 set_cpu_possible(i, true);
 }
 
+/*
+ * For now, just make sure the start-up address is not within the booting
+ * kernel space as that means we just overwrote whatever secondary_startup()
+ * code there was.
+ */
+static bool __init omap4_smp_cpu1_startup_valid(unsigned long addr)
+{
+        if ((addr >= __pa(PAGE_OFFSET)) && (addr <= __pa(__bss_start)))
+                return false;
+
+        return true;
+}
+
+/*
+ * We may need to reset CPU1 before configuring, otherwise kexec boot can end
+ * up trying to use old kernel startup address or suspend-resume will
+ * occasionally fail to bring up CPU1 on 4430 if CPU1 fails to enter deeper
+ * idle states.
+ */
+static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
+{
+        unsigned long cpu1_startup_pa, cpu1_ns_pa_addr;
+        bool needs_reset = false;
+        u32 released;
+
+        if (omap_secure_apis_support())
+                released = omap_read_auxcoreboot0() & AUX_CORE_BOOT0_HS_RELEASE;
+        else
+                released = readl_relaxed(cfg.wakeupgen_base +
+                                         OMAP_AUX_CORE_BOOT_0) &
+                                                AUX_CORE_BOOT0_GP_RELEASE;
+        if (released) {
+                pr_warn("smp: CPU1 not parked?\n");
+
+                return;
+        }
+
+        cpu1_startup_pa = readl_relaxed(cfg.wakeupgen_base +
+                                        OMAP_AUX_CORE_BOOT_1);
+        cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
+
+        /* Did the configured secondary_startup() get overwritten? */
+        if (!omap4_smp_cpu1_startup_valid(cpu1_startup_pa))
+                needs_reset = true;
+
+        /*
+         * If omap4 or 5 has NS_PA_ADDR configured, CPU1 may be in a
+         * deeper idle state in WFI and will wake to an invalid address.
+         */
+        if ((soc_is_omap44xx() || soc_is_omap54xx()) &&
+            !omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
+                needs_reset = true;
+
+        if (!needs_reset || !c->cpu1_rstctrl_va)
+                return;
+
+        pr_info("smp: CPU1 parked within kernel, needs reset (0x%lx 0x%lx)\n",
+                cpu1_startup_pa, cpu1_ns_pa_addr);
+
+        writel_relaxed(1, c->cpu1_rstctrl_va);
+        readl_relaxed(c->cpu1_rstctrl_va);
+        writel_relaxed(0, c->cpu1_rstctrl_va);
+}
+
 static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
 {
-        void __iomem *base = omap_get_wakeupgen_base();
         const struct omap_smp_config *c = NULL;
 
         if (soc_is_omap443x())
@@ -281,6 +350,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
         /* Must preserve cfg.scu_base set earlier */
         cfg.cpu1_rstctrl_pa = c->cpu1_rstctrl_pa;
         cfg.startup_addr = c->startup_addr;
+        cfg.wakeupgen_base = omap_get_wakeupgen_base();
 
         if (soc_is_dra74x() || soc_is_omap54xx()) {
                 if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
@@ -299,15 +369,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
         if (cfg.scu_base)
                 scu_enable(cfg.scu_base);
 
-        /*
-         * Reset CPU1 before configuring, otherwise kexec will
-         * end up trying to use old kernel startup address.
-         */
-        if (cfg.cpu1_rstctrl_va) {
-                writel_relaxed(1, cfg.cpu1_rstctrl_va);
-                readl_relaxed(cfg.cpu1_rstctrl_va);
-                writel_relaxed(0, cfg.cpu1_rstctrl_va);
-        }
+        omap4_smp_maybe_reset_cpu1(&cfg);
 
         /*
          * Write the address of secondary startup routine into the
@@ -319,7 +381,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
                 omap_auxcoreboot_addr(__pa_symbol(cfg.startup_addr));
         else
                 writel_relaxed(__pa_symbol(cfg.startup_addr),
-                               base + OMAP_AUX_CORE_BOOT_1);
+                               cfg.wakeupgen_base + OMAP_AUX_CORE_BOOT_1);
 }
 
 const struct smp_operations omap4_smp_ops __initconst = {
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index e920dd83e443..f989145480c8 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -222,6 +222,14 @@ static int _omap_device_notifier_call(struct notifier_block *nb,
                                 dev_err(dev, "failed to idle\n");
                 }
                 break;
+        case BUS_NOTIFY_BIND_DRIVER:
+                od = to_omap_device(pdev);
+                if (od && (od->_state == OMAP_DEVICE_STATE_ENABLED) &&
+                    pm_runtime_status_suspended(dev)) {
+                        od->_driver_status = BUS_NOTIFY_BIND_DRIVER;
+                        pm_runtime_set_active(dev);
+                }
+                break;
         case BUS_NOTIFY_ADD_DEVICE:
                 if (pdev->dev.of_node)
                         omap_device_build_from_dt(pdev);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 56f917ec8621..1435fee39a89 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2112,11 +2112,20 @@ static struct omap_hwmod_ocp_if omap3_l4_core__i2c3 = {
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr1_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR1_BASE,
+                .pa_end         = OMAP34XX_SR1_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2124,15 +2133,25 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr2_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR2_BASE,
+                .pa_end         = OMAP34XX_SR2_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2140,6 +2159,7 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -3111,16 +3131,20 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_hwmod_ocp_ifs[] __initdata = {
  * Return: 0 if device named @dev_name is not likely to be accessible,
  * or 1 if it is likely to be accessible.
  */
-static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
-                                                       const char *dev_name)
+static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
+                                                        const char *dev_name)
 {
+        struct device_node *node;
+        bool available;
+
         if (!bus)
-                return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0;
+                return omap_type() == OMAP2_DEVICE_TYPE_GP;
 
-        if (of_device_is_available(of_find_node_by_name(bus, dev_name)))
-                return 1;
+        node = of_get_child_by_name(bus, dev_name);
+        available = of_device_is_available(node);
+        of_node_put(node);
 
-        return 0;
+        return available;
 }
 
 int __init omap3xxx_hwmod_init(void)
@@ -3189,15 +3213,20 @@ int __init omap3xxx_hwmod_init(void)
 
         if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) {
                 r = omap_hwmod_register_links(h_sham);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
 
         if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) {
                 r = omap_hwmod_register_links(h_aes);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
+        of_node_put(bus);
 
         /*
          * Register hwmod links specific to certain ES levels of a
diff --git a/arch/arm/mach-orion5x/Kconfig b/arch/arm/mach-orion5x/Kconfig
index 633442ad4e4c..2a7bb6ccdcb7 100644
--- a/arch/arm/mach-orion5x/Kconfig
+++ b/arch/arm/mach-orion5x/Kconfig
@@ -6,6 +6,7 @@ menuconfig ARCH_ORION5X
         select GPIOLIB
         select MVEBU_MBUS
         select PCI
+        select PHYLIB if NETDEVICES
         select PLAT_ORION_LEGACY
         help
           Support for the following Marvell Orion 5x series SoCs:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 63eabb06f9f1..475811f5383a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -935,13 +935,31 @@ static void arm_coherent_dma_free(struct device *dev, size_t size, void *cpu_add
         __arm_dma_free(dev, size, cpu_addr, handle, attrs, true);
 }
 
+/*
+ * The whole dma_get_sgtable() idea is fundamentally unsafe - it seems
+ * that the intention is to allow exporting memory allocated via the
+ * coherent DMA APIs through the dma_buf API, which only accepts a
+ * scattertable.  This presents a couple of problems:
+ * 1. Not all memory allocated via the coherent DMA APIs is backed by
+ *    a struct page
+ * 2. Passing coherent DMA memory into the streaming APIs is not allowed
+ *    as we will try to flush the memory through a different alias to that
+ *    actually being used (and the flushes are redundant.)
+ */
 int arm_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
                  void *cpu_addr, dma_addr_t handle, size_t size,
                  unsigned long attrs)
 {
-        struct page *page = pfn_to_page(dma_to_pfn(dev, handle));
+        unsigned long pfn = dma_to_pfn(dev, handle);
+        struct page *page;
         int ret;
 
+        /* If the PFN is not valid, we do not have a struct page */
+        if (!pfn_valid(pfn))
+                return -ENXIO;
+
+        page = pfn_to_page(pfn);
+
         ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
         if (unlikely(ret))
                 return ret;
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 3b5c7aaf9c76..33a45bd96860 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -303,7 +303,10 @@ static inline void set_vbar(unsigned long val)
  */
 static inline bool security_extensions_enabled(void)
 {
-        return !!cpuid_feature_extract(CPUID_EXT_PFR1, 4);
+        /* Check CPUID Identification Scheme before ID_PFR1 read */
+        if ((read_cpuid_id() & 0x000f0000) == 0x000f0000)
+                return !!cpuid_feature_extract(CPUID_EXT_PFR1, 4);
+        return 0;
 }
 
 static unsigned long __init setup_vectors_base(void)
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index 9255b6d67ba5..aff6994950ba 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -468,6 +468,7 @@ void __init orion_ge11_init(struct mv643xx_eth_platform_data *eth_data,
                     eth_data, &orion_ge11);
 }
 
+#ifdef CONFIG_ARCH_ORION5X
 /*****************************************************************************
  * Ethernet switch
  ****************************************************************************/
@@ -480,6 +481,9 @@ void __init orion_ge00_switch_init(struct dsa_chip_data *d)
         struct mdio_board_info *bd;
         unsigned int i;
 
+        if (!IS_BUILTIN(CONFIG_PHYLIB))
+                return;
+
         for (i = 0; i < ARRAY_SIZE(d->port_names); i++)
                 if (!strcmp(d->port_names[i], "cpu"))
                         break;
@@ -493,6 +497,7 @@ void __init orion_ge00_switch_init(struct dsa_chip_data *d)
 
         mdiobus_register_board_info(&orion_ge00_switch_board_info, 1);
 }
+#endif
 
 /*****************************************************************************
  * I2C
diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
index b6dc9d838a9a..ad1f4e6a9e33 100644
--- a/arch/arm/probes/kprobes/core.c
+++ b/arch/arm/probes/kprobes/core.c
@@ -266,11 +266,20 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
 #endif
 
         if (p) {
-                if (cur) {
+                if (!p->ainsn.insn_check_cc(regs->ARM_cpsr)) {
+                        /*
+                         * Probe hit but conditional execution check failed,
+                         * so just skip the instruction and continue as if
+                         * nothing had happened.
+                         * In this case, we can skip recursing check too.
+                         */
+                        singlestep_skip(p, regs);
+                } else if (cur) {
                         /* Kprobe is pending, so we're recursing. */
                         switch (kcb->kprobe_status) {
                         case KPROBE_HIT_ACTIVE:
                         case KPROBE_HIT_SSDONE:
+                        case KPROBE_HIT_SS:
                                 /* A pre- or post-handler probe got us here. */
                                 kprobes_inc_nmissed_count(p);
                                 save_previous_kprobe(kcb);
@@ -279,11 +288,16 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
                                 singlestep(p, regs, kcb);
                                 restore_previous_kprobe(kcb);
                                 break;
+                        case KPROBE_REENTER:
+                                /* A nested probe was hit in FIQ, it is a BUG */
+                                pr_warn("Unrecoverable kprobe detected at %p.\n",
+                                        p->addr);
+                                /* fall through */
                         default:
                                 /* impossible cases */
                                 BUG();
                         }
-                } else if (p->ainsn.insn_check_cc(regs->ARM_cpsr)) {
+                } else {
                         /* Probe hit and conditional execution check ok. */
                         set_current_kprobe(p);
                         kcb->kprobe_status = KPROBE_HIT_ACTIVE;
@@ -304,13 +318,6 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
                                 }
                                 reset_current_kprobe();
                         }
-                } else {
-                        /*
-                         * Probe hit but conditional execution check failed,
-                         * so just skip the instruction and continue as if
-                         * nothing had happened.
-                         */
-                        singlestep_skip(p, regs);
                 }
         } else if (cur) {
                 /* We probably hit a jprobe.  Call its break handler. */
@@ -434,6 +441,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
+        kprobe_opcode_t *correct_ret_addr = NULL;
 
         INIT_HLIST_HEAD(&empty_rp);
         kretprobe_hash_lock(current, &head, &flags);
@@ -456,14 +464,34 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         /* another task is sharing our hash bucket */
                         continue;
 
+                orig_ret_address = (unsigned long)ri->ret_addr;
+
+                if (orig_ret_address != trampoline_address)
+                        /*
+                         * This is the real return address. Any other
+                         * instances associated with this task are for
+                         * other calls deeper on the call stack
+                         */
+                        break;
+        }
+
+        kretprobe_assert(ri, orig_ret_address, trampoline_address);
+
+        correct_ret_addr = ri->ret_addr;
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
+                if (ri->task != current)
+                        /* another task is sharing our hash bucket */
+                        continue;
+
+                orig_ret_address = (unsigned long)ri->ret_addr;
                 if (ri->rp && ri->rp->handler) {
                         __this_cpu_write(current_kprobe, &ri->rp->kp);
                         get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+                        ri->ret_addr = correct_ret_addr;
                         ri->rp->handler(ri, regs);
                         __this_cpu_write(current_kprobe, NULL);
                 }
 
-                orig_ret_address = (unsigned long)ri->ret_addr;
                 recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
@@ -475,7 +503,6 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         break;
         }
 
-        kretprobe_assert(ri, orig_ret_address, trampoline_address);
         kretprobe_hash_unlock(current, &flags);
 
         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
index c893726aa52d..1c98a87786ca 100644
--- a/arch/arm/probes/kprobes/test-core.c
+++ b/arch/arm/probes/kprobes/test-core.c
@@ -977,7 +977,10 @@ static void coverage_end(void)
 void __naked __kprobes_test_case_start(void)
 {
         __asm__ __volatile__ (
-                "stmdb  sp!, {r4-r11}                           \n\t"
+                "mov    r2, sp                                  \n\t"
+                "bic    r3, r2, #7                              \n\t"
+                "mov    sp, r3                                  \n\t"
+                "stmdb  sp!, {r2-r11}                           \n\t"
                 "sub    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
                 "bic    r0, lr, #1  @ r0 = inline data          \n\t"
                 "mov    r1, sp                                  \n\t"
@@ -997,7 +1000,8 @@ void __naked __kprobes_test_case_end_32(void)
                 "movne  pc, r0                                  \n\t"
                 "mov    r0, r4                                  \n\t"
                 "add    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
-                "ldmia  sp!, {r4-r11}                           \n\t"
+                "ldmia  sp!, {r2-r11}                           \n\t"
+                "mov    sp, r2                                  \n\t"
                 "mov    pc, r0                                  \n\t"
         );
 }
@@ -1013,7 +1017,8 @@ void __naked __kprobes_test_case_end_16(void)
                 "bxne   r0                                      \n\t"
                 "mov    r0, r4                                  \n\t"
                 "add    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
-                "ldmia  sp!, {r4-r11}                           \n\t"
+                "ldmia  sp!, {r2-r11}                           \n\t"
+                "mov    sp, r2                                  \n\t"
                 "bx     r0                                      \n\t"
         );
 }
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 1c64ea2d23f9..0565779e66fa 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -179,8 +179,10 @@
                 usbphy: phy@01c19400 {
                         compatible = "allwinner,sun50i-a64-usb-phy";
                         reg = <0x01c19400 0x14>,
+                              <0x01c1a800 0x4>,
                               <0x01c1b800 0x4>;
                         reg-names = "phy_ctrl",
+                                    "pmu0",
                                     "pmu1";
                         clocks = <&ccu CLK_USB_PHY0>,
                                  <&ccu CLK_USB_PHY1>;
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index 9f9e203c09c5..bcb03fc32665 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -114,6 +114,7 @@
         pcie0: pcie@20020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x20020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -144,6 +145,7 @@
         pcie4: pcie@50020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x50020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -174,6 +176,7 @@
         pcie8: pcie@60c00000 {
                 compatible = "brcm,iproc-pcie-paxc";
                 reg = <0 0x60c00000 0 0x1000>;
+                dma-coherent;
                 linux,pci-domain = <8>;
 
                 bus-range = <0x0 0x1>;
@@ -203,6 +206,7 @@
                               <0x61030000 0x100>;
                         reg-names = "amac_base", "idm_base", "nicpm_base";
                         interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         phy-handle = <&gphy0>;
                         phy-mode = "rgmii";
                         status = "disabled";
@@ -213,6 +217,7 @@
                         reg = <0x612c0000 0x445>;  /* PDC FS0 regs */
                         interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -222,6 +227,7 @@
                         reg = <0x612e0000 0x445>;  /* PDC FS1 regs */
                         interrupts = <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -231,6 +237,7 @@
                         reg = <0x61300000 0x445>;  /* PDC FS2 regs */
                         interrupts = <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -240,6 +247,7 @@
                         reg = <0x61320000 0x445>;  /* PDC FS3 regs */
                         interrupts = <GIC_SPI 193 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -644,6 +652,7 @@
                 sata: ahci@663f2000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
                         reg = <0x663f2000 0x1000>;
+                        dma-coherent;
                         reg-names = "ahci";
                         interrupts = <GIC_SPI 438 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
@@ -667,6 +676,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66420000 0x100>;
                         interrupts = <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
@@ -676,6 +686,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66430000 0x100>;
                         interrupts = <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
diff --git a/arch/arm64/include/asm/current.h b/arch/arm64/include/asm/current.h
index 86c404171305..f6580d4afb0e 100644
--- a/arch/arm64/include/asm/current.h
+++ b/arch/arm64/include/asm/current.h
@@ -3,8 +3,6 @@
 
 #include <linux/compiler.h>
 
-#include <asm/sysreg.h>
-
 #ifndef __ASSEMBLY__
 
 struct task_struct;
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index e78ac26324bd..bdbeb06dc11e 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
 
-#define __NR_compat_syscalls            394
+#define __NR_compat_syscalls            398
 #endif
 
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index b7e8ef16ff0d..c66b51aab195 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -809,6 +809,14 @@ __SYSCALL(__NR_copy_file_range, sys_copy_file_range)
 __SYSCALL(__NR_preadv2, compat_sys_preadv2)
 #define __NR_pwritev2 393
 __SYSCALL(__NR_pwritev2, compat_sys_pwritev2)
+#define __NR_pkey_mprotect 394
+__SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
+#define __NR_pkey_alloc 395
+__SYSCALL(__NR_pkey_alloc, sys_pkey_alloc)
+#define __NR_pkey_free 396
+__SYSCALL(__NR_pkey_free, sys_pkey_free)
+#define __NR_statx 397
+__SYSCALL(__NR_statx, sys_statx)
 
 /*
  * Please add new compat syscalls above this comment and update
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index 769f24ef628c..d7e90d97f5c4 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -131,11 +131,15 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
         /*
          * The kernel Image should not extend across a 1GB/32MB/512MB alignment
          * boundary (for 4KB/16KB/64KB granule kernels, respectively). If this
-         * happens, increase the KASLR offset by the size of the kernel image.
+         * happens, increase the KASLR offset by the size of the kernel image
+         * rounded up by SWAPPER_BLOCK_SIZE.
          */
         if ((((u64)_text + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT) !=
-            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT))
-                offset = (offset + (u64)(_end - _text)) & mask;
+            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT)) {
+                u64 kimg_sz = _end - _text;
+                offset = (offset + round_up(kimg_sz, SWAPPER_BLOCK_SIZE))
+                                & mask;
+        }
 
         if (IS_ENABLED(CONFIG_KASAN))
                 /*
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index ef1caae02110..9b1036570586 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -944,7 +944,7 @@ static bool have_cpu_die(void)
 #ifdef CONFIG_HOTPLUG_CPU
         int any_cpu = raw_smp_processor_id();
 
-        if (cpu_ops[any_cpu]->cpu_die)
+        if (cpu_ops[any_cpu] && cpu_ops[any_cpu]->cpu_die)
                 return true;
 #endif
         return false;
diff --git a/arch/arm64/kernel/vdso/.gitignore b/arch/arm64/kernel/vdso/.gitignore
index b8cc94e9698b..f8b69d84238e 100644
--- a/arch/arm64/kernel/vdso/.gitignore
+++ b/arch/arm64/kernel/vdso/.gitignore
@@ -1,2 +1 @@
 vdso.lds
-vdso-offsets.h
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 4bf899fb451b..1b35b8bddbfb 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -42,7 +42,20 @@
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 
-static const char *fault_name(unsigned int esr);
+struct fault_info {
+        int     (*fn)(unsigned long addr, unsigned int esr,
+                      struct pt_regs *regs);
+        int     sig;
+        int     code;
+        const char *name;
+};
+
+static const struct fault_info fault_info[];
+
+static inline const struct fault_info *esr_to_fault_info(unsigned int esr)
+{
+        return fault_info + (esr & 63);
+}
 
 #ifdef CONFIG_KPROBES
 static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
@@ -197,10 +210,12 @@ static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
                             struct pt_regs *regs)
 {
         struct siginfo si;
+        const struct fault_info *inf;
 
         if (unhandled_signal(tsk, sig) && show_unhandled_signals_ratelimited()) {
+                inf = esr_to_fault_info(esr);
                 pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
-                        tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
+                        tsk->comm, task_pid_nr(tsk), inf->name, sig,
                         addr, esr);
                 show_pte(tsk->mm, addr);
                 show_regs(regs);
@@ -219,14 +234,16 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->active_mm;
+        const struct fault_info *inf;
 
         /*
          * If we are in kernel mode at this point, we have no context to
          * handle this fault with.
          */
-        if (user_mode(regs))
-                __do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
-        else
+        if (user_mode(regs)) {
+                inf = esr_to_fault_info(esr);
+                __do_user_fault(tsk, addr, esr, inf->sig, inf->code, regs);
+        } else
                 __do_kernel_fault(mm, addr, esr, regs);
 }
 
@@ -488,12 +505,7 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
         return 1;
 }
 
-static const struct fault_info {
-        int     (*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-        int     sig;
-        int     code;
-        const char *name;
-} fault_info[] = {
+static const struct fault_info fault_info[] = {
         { do_bad,               SIGBUS,  0,             "ttbr address size fault"       },
         { do_bad,               SIGBUS,  0,             "level 1 address size fault"    },
         { do_bad,               SIGBUS,  0,             "level 2 address size fault"    },
@@ -560,19 +572,13 @@ static const struct fault_info {
         { do_bad,               SIGBUS,  0,             "unknown 63"                    },
 };
 
-static const char *fault_name(unsigned int esr)
-{
-        const struct fault_info *inf = fault_info + (esr & 63);
-        return inf->name;
-}
-
 /*
  * Dispatch a data abort to the relevant handler.
  */
 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
                                          struct pt_regs *regs)
 {
-        const struct fault_info *inf = fault_info + (esr & 63);
+        const struct fault_info *inf = esr_to_fault_info(esr);
         struct siginfo info;
 
         if (!inf->fn(addr, esr, regs))
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index e25584d72396..7514a000e361 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -294,10 +294,6 @@ static __init int setup_hugepagesz(char *opt)
                 hugetlb_add_hstate(PMD_SHIFT - PAGE_SHIFT);
         } else if (ps == PUD_SIZE) {
                 hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
-        } else if (ps == (PAGE_SIZE * CONT_PTES)) {
-                hugetlb_add_hstate(CONT_PTE_SHIFT);
-        } else if (ps == (PMD_SIZE * CONT_PMDS)) {
-                hugetlb_add_hstate((PMD_SHIFT + CONT_PMD_SHIFT) - PAGE_SHIFT);
         } else {
                 hugetlb_bad_size();
                 pr_err("hugepagesz: Unsupported page size %lu K\n", ps >> 10);
@@ -306,13 +302,3 @@ static __init int setup_hugepagesz(char *opt)
         return 1;
 }
 __setup("hugepagesz=", setup_hugepagesz);
-
-#ifdef CONFIG_ARM64_64K_PAGES
-static __init int add_default_hugepagesz(void)
-{
-        if (size_to_hstate(CONT_PTES * PAGE_SIZE) == NULL)
-                hugetlb_add_hstate(CONT_PTE_SHIFT);
-        return 0;
-}
-arch_initcall(add_default_hugepagesz);
-#endif
diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c
index a27e1f02ce18..8801dc98fd44 100644
--- a/arch/c6x/kernel/ptrace.c
+++ b/arch/c6x/kernel/ptrace.c
@@ -70,46 +70,6 @@ static int gpr_get(struct task_struct *target,
                                    0, sizeof(*regs));
 }
 
-static int gpr_set(struct task_struct *target,
-                   const struct user_regset *regset,
-                   unsigned int pos, unsigned int count,
-                   const void *kbuf, const void __user *ubuf)
-{
-        int ret;
-        struct pt_regs *regs = task_pt_regs(target);
-
-        /* Don't copyin TSR or CSR */
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 0, PT_TSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_TSR * sizeof(long),
-                                        (PT_TSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_TSR + 1) * sizeof(long),
-                                 PT_CSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_CSR * sizeof(long),
-                                        (PT_CSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_CSR + 1) * sizeof(long), -1);
-        return ret;
-}
-
 enum c6x_regset {
         REGSET_GPR,
 };
@@ -121,7 +81,6 @@ static const struct user_regset c6x_regsets[] = {
                 .size = sizeof(u32),
                 .align = sizeof(u32),
                 .get = gpr_get,
-                .set = gpr_set
         },
 };
 
diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c
index 92075544a19a..0dc1c8f622bc 100644
--- a/arch/h8300/kernel/ptrace.c
+++ b/arch/h8300/kernel/ptrace.c
@@ -95,7 +95,8 @@ static int regs_get(struct task_struct *target,
         long *reg = (long *)&regs;
 
         /* build user regs in buffer */
-        for (r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -113,7 +114,8 @@ static int regs_set(struct task_struct *target,
         long *reg;
 
         /* build user regs in buffer */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -122,7 +124,7 @@ static int regs_set(struct task_struct *target,
                 return ret;
 
         /* write back to pt_regs */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 h8300_put_reg(target, r, *reg++);
         return 0;
 }
diff --git a/arch/ia64/include/asm/asm-prototypes.h b/arch/ia64/include/asm/asm-prototypes.h
new file mode 100644
index 000000000000..a2c139808cfe
--- /dev/null
+++ b/arch/ia64/include/asm/asm-prototypes.h
@@ -0,0 +1,29 @@
+#ifndef _ASM_IA64_ASM_PROTOTYPES_H
+#define _ASM_IA64_ASM_PROTOTYPES_H
+
+#include <asm/cacheflush.h>
+#include <asm/checksum.h>
+#include <asm/esi.h>
+#include <asm/ftrace.h>
+#include <asm/page.h>
+#include <asm/pal.h>
+#include <asm/string.h>
+#include <asm/uaccess.h>
+#include <asm/unwind.h>
+#include <asm/xor.h>
+
+extern const char ia64_ivt[];
+
+signed int __divsi3(signed int, unsigned int);
+signed int __modsi3(signed int, unsigned int);
+
+signed long long __divdi3(signed long long, unsigned long long);
+signed long long __moddi3(signed long long, unsigned long long);
+
+unsigned int __udivsi3(unsigned int, unsigned int);
+unsigned int __umodsi3(unsigned int, unsigned int);
+
+unsigned long long __udivdi3(unsigned long long, unsigned long long);
+unsigned long long __umoddi3(unsigned long long, unsigned long long);
+
+#endif /* _ASM_IA64_ASM_PROTOTYPES_H */
diff --git a/arch/ia64/lib/Makefile b/arch/ia64/lib/Makefile
index 1f3d3877618f..0a40b14407b1 100644
--- a/arch/ia64/lib/Makefile
+++ b/arch/ia64/lib/Makefile
@@ -24,25 +24,25 @@ AFLAGS___modsi3.o	=	     -DMODULO
 AFLAGS___umodsi3.o      = -DUNSIGNED -DMODULO
 
 $(obj)/__divdi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__udivdi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__moddi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__umoddi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__divsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__udivsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__modsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__umodsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 048bf076f7df..531cb9eb3319 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -60,6 +61,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -71,6 +73,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -101,6 +104,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -371,6 +377,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -383,6 +390,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -404,7 +412,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -564,6 +571,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -594,6 +603,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -605,6 +615,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -629,4 +640,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index d4de24963f5f..ca91d39555da 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -362,6 +369,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -378,7 +386,6 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -523,6 +530,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -553,6 +562,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -564,6 +574,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -588,4 +599,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index fc0fd3f871f3..23a3d8a691e2 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -362,6 +368,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -372,6 +379,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_ATARILANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -389,7 +397,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -544,6 +551,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -574,6 +583,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -585,6 +595,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -609,4 +620,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 52e984a0aa69..95deb95140fe 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index aaeed4422cc9..afae6958db2d 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -363,6 +370,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_HPLANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -379,7 +387,6 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -525,6 +532,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -555,6 +564,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -566,6 +576,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -590,4 +601,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 3bbc9b2f0dac..b010734729a7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -57,6 +58,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -68,6 +70,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -98,6 +101,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -369,6 +375,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -379,6 +386,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -398,7 +406,6 @@ CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -547,6 +554,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -577,6 +586,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -588,6 +598,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -612,4 +623,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 8f2c0decb2f8..0e414549b235 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -21,6 +21,7 @@ CONFIG_SOLARIS_X86_PARTITION=y
 CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -67,6 +68,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -78,6 +80,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -108,6 +111,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -308,6 +312,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -402,6 +408,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -419,6 +426,7 @@ CONFIG_HPLANCE=y
 CONFIG_MVME147_NET=y
 CONFIG_SUN3LANCE=y
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -444,7 +452,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -627,6 +634,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -657,6 +666,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -668,6 +678,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -692,4 +703,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index c743dd22e96f..b2e687a0ec3d 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68030=y
@@ -55,6 +56,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -66,6 +68,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -96,6 +99,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -293,6 +297,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -351,6 +357,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MVME147_NET=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 2ccaca858f05..cbd8ee24d1bc 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 5599f3fd5fcd..1e82cc944339 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -358,6 +364,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -369,6 +376,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -388,7 +396,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -538,6 +545,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -568,6 +577,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -579,6 +589,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -603,4 +614,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 313bf0a562ad..f9e77f57a972 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -546,6 +555,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -557,6 +567,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -581,4 +592,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 38b61365f769..3c394fcfb368 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3X=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -547,6 +556,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -558,6 +568,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -582,4 +593,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/include/asm/bitops.h b/arch/m68k/include/asm/bitops.h
index b4a9b0d5928d..dda58cfe8c22 100644
--- a/arch/m68k/include/asm/bitops.h
+++ b/arch/m68k/include/asm/bitops.h
@@ -148,7 +148,7 @@ static inline void bfchg_mem_change_bit(int nr, volatile unsigned long *vaddr)
 #define __change_bit(nr, vaddr) change_bit(nr, vaddr)
 
 
-static inline int test_bit(int nr, const unsigned long *vaddr)
+static inline int test_bit(int nr, const volatile unsigned long *vaddr)
 {
         return (vaddr[nr >> 5] & (1UL << (nr & 31))) != 0;
 }
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index a857d82ec509..aab1edd0d4ba 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             379
+#define NR_syscalls             380
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 9fe674bf911f..25589f5b8669 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -384,5 +384,6 @@
 #define __NR_copy_file_range    376
 #define __NR_preadv2            377
 #define __NR_pwritev2           378
+#define __NR_statx              379
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index d6fd6d9ced24..8c9fcfafe0dd 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -399,3 +399,4 @@ ENTRY(sys_call_table)
         .long sys_copy_file_range
         .long sys_preadv2
         .long sys_pwritev2
+        .long sys_statx
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 273e61225c27..07238b39638c 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -197,20 +197,21 @@ extern long __must_check strnlen_user(const char __user *src, long count);
 
 #define strlen_user(str) strnlen_user(str, 32767)
 
-extern unsigned long __must_check __copy_user_zeroing(void *to,
-                                                      const void __user *from,
-                                                      unsigned long n);
+extern unsigned long raw_copy_from_user(void *to, const void __user *from,
+                                        unsigned long n);
 
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         if (likely(access_ok(VERIFY_READ, from, n)))
-                return __copy_user_zeroing(to, from, n);
-        memset(to, 0, n);
-        return n;
+                res = raw_copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
-#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n)
+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n)
 #define __copy_from_user_inatomic __copy_from_user
 
 extern unsigned long __must_check __copy_user(void __user *to,
diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c
index 5fd16ee5280c..e615603a4b0a 100644
--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -26,6 +26,16 @@
  * user_regset definitions.
  */
 
+static unsigned long user_txstatus(const struct pt_regs *regs)
+{
+        unsigned long data = (unsigned long)regs->ctx.Flags;
+
+        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
+                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+
+        return data;
+}
+
 int metag_gp_regs_copyout(const struct pt_regs *regs,
                           unsigned int pos, unsigned int count,
                           void *kbuf, void __user *ubuf)
@@ -64,9 +74,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
-        data = (unsigned long)regs->ctx.Flags;
-        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
-                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+        data = user_txstatus(regs);
         ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                   &data, 4*25, 4*26);
         if (ret)
@@ -121,6 +129,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
+        data = user_txstatus(regs);
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &data, 4*25, 4*26);
         if (ret)
@@ -246,6 +255,8 @@ int metag_rp_state_copyin(struct pt_regs *regs,
         unsigned long long *ptr;
         int ret, i;
 
+        if (count < 4*13)
+                return -EINVAL;
         /* Read the entire pipeline before making any changes */
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &rp, 0, 4*13);
@@ -305,7 +316,7 @@ static int metag_tls_set(struct task_struct *target,
                         const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        void __user *tls;
+        void __user *tls = target->thread.tls_ptr;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
diff --git a/arch/metag/lib/usercopy.c b/arch/metag/lib/usercopy.c
index b3ebfe9c8e88..2792fc621088 100644
--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -29,7 +29,6 @@
                 COPY                                             \
                 "1:\n"                                           \
                 "       .section .fixup,\"ax\"\n"                \
-                "       MOV D1Ar1,#0\n"                          \
                 FIXUP                                            \
                 "       MOVT    D1Ar1,#HI(1b)\n"                 \
                 "       JUMP    D1Ar1,#LO(1b)\n"                 \
@@ -260,27 +259,31 @@
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #32\n"                                  \
                 "23:\n"                                                 \
-                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "SUB    %3, %3, #32\n"                                  \
                 "24:\n"                                                 \
+                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "25:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "25:\n"                                                 \
+                "27:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "28:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
-                "27:\n"                                                 \
+                "30:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "28:\n"                                                 \
+                "31:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %0, %0, #8\n"                                   \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "SETL   [%0++], D0.7, D1.7\n"                           \
                 "SUB    %3, %3, #32\n"                                  \
                 "1:"                                                    \
@@ -312,11 +315,15 @@
                 "       .long 26b,3b\n"                                 \
                 "       .long 27b,3b\n"                                 \
                 "       .long 28b,3b\n"                                 \
-                "       .long 29b,4b\n"                                 \
+                "       .long 29b,3b\n"                                 \
+                "       .long 30b,3b\n"                                 \
+                "       .long 31b,3b\n"                                 \
+                "       .long 32b,3b\n"                                 \
+                "       .long 33b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -342,7 +349,7 @@
 #define __asm_copy_to_user_64bit_rapf_loop(to,  from, ret, n, id)\
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -403,47 +410,55 @@
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #16\n"                                  \
                 "23:\n"                                                 \
-                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "24:\n"                                                 \
-                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
                 "SUB    %3, %3, #16\n"                                  \
-                "25:\n"                                                 \
+                "24:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "25:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "27:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "28:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
+                "SUB    %3, %3, #16\n"                                  \
+                "30:\n"                                                 \
+                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "31:\n"                                                 \
+                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "30:\n"                                                 \
+                "34:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "35:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "31:\n"                                                 \
+                "36:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "32:\n"                                                 \
+                "37:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "38:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "33:\n"                                                 \
+                "39:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "34:\n"                                                 \
+                "40:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "41:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "35:\n"                                                 \
+                "42:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "36:\n"                                                 \
+                "43:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "44:\n"                                                 \
                 "SUB    %0, %0, #4\n"                                   \
-                "37:\n"                                                 \
+                "45:\n"                                                 \
                 "SETD   [%0++], D0.7\n"                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "1:"                                                    \
@@ -483,11 +498,19 @@
                 "       .long 34b,3b\n"                                 \
                 "       .long 35b,3b\n"                                 \
                 "       .long 36b,3b\n"                                 \
-                "       .long 37b,4b\n"                                 \
+                "       .long 37b,3b\n"                                 \
+                "       .long 38b,3b\n"                                 \
+                "       .long 39b,3b\n"                                 \
+                "       .long 40b,3b\n"                                 \
+                "       .long 41b,3b\n"                                 \
+                "       .long 42b,3b\n"                                 \
+                "       .long 43b,3b\n"                                 \
+                "       .long 44b,3b\n"                                 \
+                "       .long 45b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -513,7 +536,7 @@
 #define __asm_copy_to_user_32bit_rapf_loop(to, from, ret, n, id)\
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -538,23 +561,31 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_to_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
                 while (n > 0) {
                         __asm_copy_to_user_1(dst, src, retn);
                         n--;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_to_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
                 while (n >= 2) {
                         __asm_copy_to_user_2(dst, src, retn);
                         n -= 2;
+                        if (retn)
+                                return retn + n;
                 }
         }
 
@@ -569,6 +600,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (n >= RAPF_MIN_BUF_SIZE) {
@@ -581,6 +614,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
 #endif
@@ -588,11 +623,15 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         while (n >= 16) {
                 __asm_copy_to_user_16(dst, src, retn);
                 n -= 16;
+                if (retn)
+                        return retn + n;
         }
 
         while (n >= 4) {
                 __asm_copy_to_user_4(dst, src, retn);
                 n -= 4;
+                if (retn)
+                        return retn + n;
         }
 
         switch (n) {
@@ -609,6 +648,10 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 break;
         }
 
+        /*
+         * If we get here, retn correctly reflects the number of failing
+         * bytes.
+         */
         return retn;
 }
 EXPORT_SYMBOL(__copy_user);
@@ -617,16 +660,14 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_user_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"    \
                 "2:     SETB [%0++],D1Ar1\n",   \
-                "3:     ADD  %2,%2,#1\n"        \
-                "       SETB [%0++],D1Ar1\n",   \
+                "3:     ADD  %2,%2,#1\n",       \
                 "       .long 2b,3b\n")
 
 #define __asm_copy_from_user_2x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETW D1Ar1,[%1++]\n"            \
                 "2:     SETW [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#2\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_2(to, from, ret) \
@@ -636,145 +677,26 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_from_user_2x_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"            \
                 "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
+                "5:     ADD  %2,%2,#1\n",               \
                 "       .long 4b,5b\n")
 
 #define __asm_copy_from_user_4x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETD D1Ar1,[%1++]\n"            \
                 "2:     SETD [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#4\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_4(to, from, ret) \
         __asm_copy_from_user_4x_cont(to, from, ret, "", "", "")
 
-#define __asm_copy_from_user_5(to, from, ret) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 4b,5b\n")
-
-#define __asm_copy_from_user_6x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "4:     SETW [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_6(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_7(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_8x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "4:     SETD [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#4\n"                        \
-                "       SETD [%0++],D1Ar1\n" FIXUP,             \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_8(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_9(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_10x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "6:     SETW [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_10(to, from, ret) \
-        __asm_copy_from_user_10x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_11(to, from, ret)          \
-        __asm_copy_from_user_10x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_12x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "6:     SETD [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_12(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_13(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_14x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "8:     SETW [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_14(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_15(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "10:    SETB [%0++],D1Ar1\n",           \
-                "11:    ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 10b,11b\n")
-
-#define __asm_copy_from_user_16x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "8:     SETD [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_16(to, from, ret) \
-        __asm_copy_from_user_16x_cont(to, from, ret, "", "", "")
-
 #define __asm_copy_from_user_8x64(to, from, ret) \
         asm volatile (                          \
                 "       GETL D0Ar2,D1Ar1,[%1++]\n"      \
                 "2:     SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "1:\n"                                  \
                 "       .section .fixup,\"ax\"\n"       \
-                "       MOV D1Ar1,#0\n"                 \
-                "       MOV D0Ar2,#0\n"                 \
                 "3:     ADD  %2,%2,#8\n"                \
-                "       SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "       MOVT    D0Ar2,#HI(1b)\n"        \
                 "       JUMP    D0Ar2,#LO(1b)\n"        \
                 "       .previous\n"                    \
@@ -789,36 +711,57 @@ EXPORT_SYMBOL(__copy_user);
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 8 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*8 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_64bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #8\n")
+                "LSR    D0Ar2, D0Ar2, #5\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x38\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #32\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 /*      rewind 'from' pointer when a fault occurs
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 4 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*4 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_32bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #4\n")
+                "LSR    D0Ar2, D0Ar2, #6\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x1c\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #16\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 
-/* Copy from user to kernel, zeroing the bytes that were inaccessible in
-   userland.  The return-value is the number of bytes that were
-   inaccessible.  */
-unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
-                                  unsigned long n)
+/*
+ * Copy from user to kernel. The return-value is the number of bytes that were
+ * inaccessible.
+ */
+unsigned long raw_copy_from_user(void *pdst, const void __user *psrc,
+                                 unsigned long n)
 {
         register char *dst asm ("A0.2") = pdst;
         register const char __user *src asm ("A1.2") = psrc;
@@ -830,6 +773,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_from_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
@@ -837,12 +782,14 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_1(dst, src, retn);
                         n--;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_from_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
@@ -850,16 +797,10 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_2(dst, src, retn);
                         n -= 2;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
-        /* We only need one check after the unalignment-adjustments,
-           because if both adjustments were done, either both or
-           neither reference had an exception.  */
-        if (retn != 0)
-                goto copy_exception_bytes;
-
 #ifdef USE_RAPF
         /* 64 bit copy loop */
         if (!(((unsigned long) src | (unsigned long) dst) & 7)) {
@@ -872,7 +813,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
@@ -888,7 +829,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 #endif
@@ -898,7 +839,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                 n -= 4;
 
                 if (retn)
-                        goto copy_exception_bytes;
+                        return retn + n;
         }
 
         /* If we get here, there were no memory read faults.  */
@@ -924,21 +865,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         /* If we get here, retn correctly reflects the number of failing
            bytes.  */
         return retn;
-
- copy_exception_bytes:
-        /* We already have "retn" bytes cleared, and need to clear the
-           remaining "n" bytes.  A non-optimized simple byte-for-byte in-line
-           memset is preferred here, since this isn't speed-critical code and
-           we'd rather have this a leaf-function than calling memset.  */
-        {
-                char *endp;
-                for (endp = dst + n; dst < endp; dst++)
-                        *dst = 0;
-        }
-
-        return retn + n;
 }
-EXPORT_SYMBOL(__copy_user_zeroing);
+EXPORT_SYMBOL(raw_copy_from_user);
 
 #define __asm_clear_8x64(to, ret) \
         asm volatile (                                  \
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index a008a9f03072..e0bb576410bb 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1531,7 +1531,7 @@ config CPU_MIPS64_R6
         select CPU_SUPPORTS_HIGHMEM
         select CPU_SUPPORTS_MSA
         select GENERIC_CSUM
-        select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+        select MIPS_O32_FP64_SUPPORT if 32BIT || MIPS32_O32
         select HAVE_KVM
         help
           Choose this option to build a kernel for release 6 or later of the
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index f94455f964ec..a2813fe381cf 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -21,6 +21,7 @@
 #include <asm/cpu-features.h>
 #include <asm/fpu_emulator.h>
 #include <asm/hazards.h>
+#include <asm/ptrace.h>
 #include <asm/processor.h>
 #include <asm/current.h>
 #include <asm/msa.h>
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 956db6e201d1..ddd1c918103b 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -18,9 +18,24 @@
 #include <irq.h>
 
 #define IRQ_STACK_SIZE                  THREAD_SIZE
+#define IRQ_STACK_START                 (IRQ_STACK_SIZE - sizeof(unsigned long))
 
 extern void *irq_stack[NR_CPUS];
 
+/*
+ * The highest address on the IRQ stack contains a dummy frame put down in
+ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows:
+ *
+ *   top ------------
+ *       | task sp  | <- irq_stack[cpu] + IRQ_STACK_START
+ *       ------------
+ *       |          | <- First frame of IRQ context
+ *       ------------
+ *
+ * task sp holds a copy of the task stack pointer where the struct pt_regs
+ * from exception entry can be found.
+ */
+
 static inline bool on_irq_stack(int cpu, unsigned long sp)
 {
         unsigned long low = (unsigned long)irq_stack[cpu];
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index f485afe51514..a8df44d60607 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -127,7 +127,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
                 "       andi    %[ticket], %[ticket], 0xffff            \n"
                 "       bne     %[ticket], %[my_ticket], 4f             \n"
                 "        subu   %[ticket], %[my_ticket], %[ticket]      \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "4:     andi    %[ticket], %[ticket], 0xffff            \n"
                 "       sll     %[ticket], 5                            \n"
@@ -202,7 +202,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
                 "       sc      %[ticket], %[ticket_ptr]                \n"
                 "       beqz    %[ticket], 1b                           \n"
                 "        li     %[ticket], 1                            \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "3:     b       2b                                      \n"
                 "        li     %[ticket], 0                            \n"
@@ -382,7 +382,7 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
                 "       .set    reorder                                 \n"
                 __WEAK_LLSC_MB
                 "       li      %2, 1                                   \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
                 : GCC_OFF_SMALL_ASM() (rw->lock)
                 : "memory");
@@ -422,7 +422,7 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
                         "       lui     %1, 0x8000                      \n"
                         "       sc      %1, %0                          \n"
                         "       li      %2, 1                           \n"
-                        "2:                                             \n"
+                        "2:     .insn                                   \n"
                         : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp),
                           "=&r" (ret)
                         : GCC_OFF_SMALL_ASM() (rw->lock)
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index 3e940dbe0262..78faf4292e90 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -386,17 +386,18 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 363)
 #define __NR_pkey_alloc                 (__NR_Linux + 364)
 #define __NR_pkey_free                  (__NR_Linux + 365)
+#define __NR_statx                      (__NR_Linux + 366)
 
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             365
+#define __NR_Linux_syscalls             366
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         365
+#define __NR_O32_Linux_syscalls         366
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -730,16 +731,17 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 323)
 #define __NR_pkey_alloc                 (__NR_Linux + 324)
 #define __NR_pkey_free                  (__NR_Linux + 325)
+#define __NR_statx                      (__NR_Linux + 326)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             325
+#define __NR_Linux_syscalls             326
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          325
+#define __NR_64_Linux_syscalls          326
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -1077,15 +1079,16 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 327)
 #define __NR_pkey_alloc                 (__NR_Linux + 328)
 #define __NR_pkey_free                  (__NR_Linux + 329)
+#define __NR_statx                      (__NR_Linux + 330)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             329
+#define __NR_Linux_syscalls             330
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         329
+#define __NR_N32_Linux_syscalls         330
 
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index bb5c5d34ba81..a670c0c11875 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
         DEFINE(_THREAD_SIZE, THREAD_SIZE);
         DEFINE(_THREAD_MASK, THREAD_MASK);
         DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
+        DEFINE(_IRQ_STACK_START, IRQ_STACK_START);
         BLANK();
 }
 
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 59476a607add..a00e87b0256d 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -361,7 +361,7 @@ LEAF(mips_cps_get_bootcfg)
         END(mips_cps_get_bootcfg)
 
 LEAF(mips_cps_boot_vpes)
-        PTR_L   ta2, COREBOOTCFG_VPEMASK(a0)
+        lw      ta2, COREBOOTCFG_VPEMASK(a0)
         PTR_L   ta3, COREBOOTCFG_VPECONFIG(a0)
 
 #if defined(CONFIG_CPU_MIPSR6)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 07718bb5fc9d..12422fd4af23 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -1824,7 +1824,7 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
                 }
 
                 decode_configs(c);
-                c->options |= MIPS_CPU_TLBINV | MIPS_CPU_LDPTE;
+                c->options |= MIPS_CPU_FTLB | MIPS_CPU_TLBINV | MIPS_CPU_LDPTE;
                 c->writecombine = _CACHE_UNCACHED_ACCELERATED;
                 break;
         default:
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 7ec9612cb007..ae810da4d499 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -215,9 +215,11 @@ NESTED(handle_int, PT_SIZE, sp)
         beq     t0, t1, 2f
 
         /* Switch to IRQ stack */
-        li      t1, _IRQ_STACK_SIZE
+        li      t1, _IRQ_STACK_START
         PTR_ADD sp, t0, t1
 
+        /* Save task's sp on IRQ stack so that unwinding can follow it */
+        LONG_S  s1, 0(sp)
 2:
         jal     plat_irq_dispatch
 
@@ -325,9 +327,11 @@ NESTED(except_vec_vi_handler, 0, sp)
         beq     t0, t1, 2f
 
         /* Switch to IRQ stack */
-        li      t1, _IRQ_STACK_SIZE
+        li      t1, _IRQ_STACK_START
         PTR_ADD sp, t0, t1
 
+        /* Save task's sp on IRQ stack so that unwinding can follow it */
+        LONG_S  s1, 0(sp)
 2:
         jalr    v0
 
@@ -519,7 +523,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         BUILD_HANDLER reserved reserved sti verbose     /* others */
 
         .align  5
-        LEAF(handle_ri_rdhwr_vivt)
+        LEAF(handle_ri_rdhwr_tlbp)
         .set    push
         .set    noat
         .set    noreorder
@@ -538,7 +542,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         .set    pop
         bltz    k1, handle_ri   /* slow path */
         /* fall thru */
-        END(handle_ri_rdhwr_vivt)
+        END(handle_ri_rdhwr_tlbp)
 
         LEAF(handle_ri_rdhwr)
         .set    push
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fb6b6b650719..b68e10fc453d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -488,31 +488,52 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
                                               unsigned long pc,
                                               unsigned long *ra)
 {
+        unsigned long low, high, irq_stack_high;
         struct mips_frame_info info;
         unsigned long size, ofs;
+        struct pt_regs *regs;
         int leaf;
-        extern void ret_from_irq(void);
-        extern void ret_from_exception(void);
 
         if (!stack_page)
                 return 0;
 
         /*
-         * If we reached the bottom of interrupt context,
-         * return saved pc in pt_regs.
+         * IRQ stacks start at IRQ_STACK_START
+         * task stacks at THREAD_SIZE - 32
          */
-        if (pc == (unsigned long)ret_from_irq ||
-            pc == (unsigned long)ret_from_exception) {
-                struct pt_regs *regs;
-                if (*sp >= stack_page &&
-                    *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
-                        regs = (struct pt_regs *)*sp;
-                        pc = regs->cp0_epc;
-                        if (!user_mode(regs) && __kernel_text_address(pc)) {
-                                *sp = regs->regs[29];
-                                *ra = regs->regs[31];
-                                return pc;
-                        }
+        low = stack_page;
+        if (!preemptible() && on_irq_stack(raw_smp_processor_id(), *sp)) {
+                high = stack_page + IRQ_STACK_START;
+                irq_stack_high = high;
+        } else {
+                high = stack_page + THREAD_SIZE - 32;
+                irq_stack_high = 0;
+        }
+
+        /*
+         * If we reached the top of the interrupt stack, start unwinding
+         * the interrupted task stack.
+         */
+        if (unlikely(*sp == irq_stack_high)) {
+                unsigned long task_sp = *(unsigned long *)*sp;
+
+                /*
+                 * Check that the pointer saved in the IRQ stack head points to
+                 * something within the stack of the current task
+                 */
+                if (!object_is_on_stack((void *)task_sp))
+                        return 0;
+
+                /*
+                 * Follow pointer to tasks kernel stack frame where interrupted
+                 * state was saved.
+                 */
+                regs = (struct pt_regs *)task_sp;
+                pc = regs->cp0_epc;
+                if (!user_mode(regs) && __kernel_text_address(pc)) {
+                        *sp = regs->regs[29];
+                        *ra = regs->regs[31];
+                        return pc;
                 }
                 return 0;
         }
@@ -533,8 +554,7 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
         if (leaf < 0)
                 return 0;
 
-        if (*sp < stack_page ||
-            *sp + info.frame_size > stack_page + THREAD_SIZE - 32)
+        if (*sp < low || *sp + info.frame_size > high)
                 return 0;
 
         if (leaf)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 339601267265..6931fe722a0b 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -456,7 +456,8 @@ static int fpr_set(struct task_struct *target,
                                           &target->thread.fpu,
                                           0, sizeof(elf_fpregset_t));
 
-        for (i = 0; i < NUM_FPU_REGS; i++) {
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
                 err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &fpr_val, i * sizeof(elf_fpreg_t),
                                          (i + 1) * sizeof(elf_fpreg_t));
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index c29d397eee86..80ed68b2c95e 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -600,3 +600,4 @@ EXPORT(sys_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 4365 */
+        PTR     sys_statx
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 0687f96ee912..49765b44aa9b 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -438,4 +438,5 @@ EXPORT(sys_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 5325 */
+        PTR     sys_statx
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 0331ba39a065..90bad2d1b2d3 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -433,4 +433,5 @@ EXPORT(sysn32_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free
+        PTR     sys_statx                       /* 6330 */
         .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 5a47042dd25f..2dd70bd104e1 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -588,4 +588,5 @@ EXPORT(sys32_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 4365 */
+        PTR     sys_statx
         .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index c7d17cfb32f6..b49e7bf9f950 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -83,7 +83,7 @@ extern asmlinkage void handle_dbe(void);
 extern asmlinkage void handle_sys(void);
 extern asmlinkage void handle_bp(void);
 extern asmlinkage void handle_ri(void);
-extern asmlinkage void handle_ri_rdhwr_vivt(void);
+extern asmlinkage void handle_ri_rdhwr_tlbp(void);
 extern asmlinkage void handle_ri_rdhwr(void);
 extern asmlinkage void handle_cpu(void);
 extern asmlinkage void handle_ov(void);
@@ -2408,9 +2408,18 @@ void __init trap_init(void)
 
         set_except_vector(EXCCODE_SYS, handle_sys);
         set_except_vector(EXCCODE_BP, handle_bp);
-        set_except_vector(EXCCODE_RI, rdhwr_noopt ? handle_ri :
-                          (cpu_has_vtag_icache ?
-                           handle_ri_rdhwr_vivt : handle_ri_rdhwr));
+
+        if (rdhwr_noopt)
+                set_except_vector(EXCCODE_RI, handle_ri);
+        else {
+                if (cpu_has_vtag_icache)
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr_tlbp);
+                else if (current_cpu_type() == CPU_LOONGSON3)
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr_tlbp);
+                else
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr);
+        }
+
         set_except_vector(EXCCODE_CPU, handle_cpu);
         set_except_vector(EXCCODE_OV, handle_ov);
         set_except_vector(EXCCODE_TR, handle_tr);
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 3c3aa05891dd..95bec460b651 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -467,7 +467,7 @@ void __init ltq_soc_init(void)
 
                 if (!np_xbar)
                         panic("Failed to load xbar nodes from devicetree");
-                if (of_address_to_resource(np_pmu, 0, &res_xbar))
+                if (of_address_to_resource(np_xbar, 0, &res_xbar))
                         panic("Failed to get xbar resources");
                 if (!request_mem_region(res_xbar.start, resource_size(&res_xbar),
                         res_xbar.name))
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index e7f798d55fbc..3fe99cb271a9 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1562,6 +1562,7 @@ static void probe_vcache(void)
         vcache_size = c->vcache.sets * c->vcache.ways * c->vcache.linesz;
 
         c->vcache.waybit = 0;
+        c->vcache.waysize = vcache_size / c->vcache.ways;
 
         pr_info("Unified victim cache %ldkB %s, linesize %d bytes.\n",
                 vcache_size >> 10, way_string[c->vcache.ways], c->vcache.linesz);
@@ -1664,6 +1665,7 @@ static void __init loongson3_sc_init(void)
         /* Loongson-3 has 4 cores, 1MB scache for each. scaches are shared */
         scache_size *= 4;
         c->scache.waybit = 0;
+        c->scache.waysize = scache_size / c->scache.ways;
         pr_info("Unified secondary cache %ldkB %s, linesize %d bytes.\n",
                scache_size >> 10, way_string[c->scache.ways], c->scache.linesz);
         if (scache_size)
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 9bfee8988eaf..4f642e07c2b1 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -760,7 +760,8 @@ static void build_huge_update_entries(u32 **p, unsigned int pte,
 static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
                                     struct uasm_label **l,
                                     unsigned int pte,
-                                    unsigned int ptr)
+                                    unsigned int ptr,
+                                    unsigned int flush)
 {
 #ifdef CONFIG_SMP
         UASM_i_SC(p, pte, 0, ptr);
@@ -769,6 +770,22 @@ static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
 #else
         UASM_i_SW(p, pte, 0, ptr);
 #endif
+        if (cpu_has_ftlb && flush) {
+                BUG_ON(!cpu_has_tlbinv);
+
+                UASM_i_MFC0(p, ptr, C0_ENTRYHI);
+                uasm_i_ori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_tlb_write_entry(p, l, r, tlb_indexed);
+
+                uasm_i_xori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_huge_update_entries(p, pte, ptr);
+                build_huge_tlb_write_entry(p, l, r, pte, tlb_random, 0);
+
+                return;
+        }
+
         build_huge_update_entries(p, pte, ptr);
         build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0);
 }
@@ -2199,7 +2216,7 @@ static void build_r4000_tlb_load_handler(void)
                 uasm_l_tlbl_goaround2(&l, p);
         }
         uasm_i_ori(&p, wr.r1, wr.r1, (_PAGE_ACCESSED | _PAGE_VALID));
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbl(&l, p);
@@ -2254,7 +2271,7 @@ static void build_r4000_tlb_store_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbs(&l, p);
@@ -2310,7 +2327,7 @@ static void build_r4000_tlb_modify_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 0);
 #endif
 
         uasm_l_nopage_tlbm(&l, p);
diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
index c4ffd43d3996..48ce701557a4 100644
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -35,7 +35,7 @@ static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
 static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
 static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
 static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) };
-static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) };
+static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) };
 static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-dev", 0, 40, 32),
         FUNC("pci-host2", 1, 40, 32),
@@ -43,7 +43,7 @@ static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-fnc", 3, 40, 32)
 };
 static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) };
-static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) };
+static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) };
 
 static struct rt2880_pmx_group rt3883_pinmux_data[] = {
         GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C),
diff --git a/arch/nios2/kernel/prom.c b/arch/nios2/kernel/prom.c
index 367c5426157b..3901b80d4420 100644
--- a/arch/nios2/kernel/prom.c
+++ b/arch/nios2/kernel/prom.c
@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
         return alloc_bootmem_align(size, align);
 }
 
+int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size,
+                                             bool nomap)
+{
+        reserve_bootmem(base, size, BOOTMEM_DEFAULT);
+        return 0;
+}
+
 void __init early_init_devtree(void *params)
 {
         __be32 *dtb = (u32 *)__dtb_start;
diff --git a/arch/nios2/kernel/setup.c b/arch/nios2/kernel/setup.c
index 6e57ffa5db27..6044d9be28b4 100644
--- a/arch/nios2/kernel/setup.c
+++ b/arch/nios2/kernel/setup.c
@@ -201,6 +201,9 @@ void __init setup_arch(char **cmdline_p)
         }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
+        early_init_fdt_reserve_self();
+        early_init_fdt_scan_reserved_mem();
+
         unflatten_and_copy_device_tree();
 
         setup_cpuinfo();
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index edfbf9d6a6dd..cbd4f4af8108 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -39,10 +39,10 @@
 #define get_user __get_user
 
 #if !defined(CONFIG_64BIT)
-#define LDD_USER(ptr)           __get_user_asm64(ptr)
+#define LDD_USER(val, ptr)      __get_user_asm64(val, ptr)
 #define STD_USER(x, ptr)        __put_user_asm64(x, ptr)
 #else
-#define LDD_USER(ptr)           __get_user_asm("ldd", ptr)
+#define LDD_USER(val, ptr)      __get_user_asm(val, "ldd", ptr)
 #define STD_USER(x, ptr)        __put_user_asm("std", x, ptr)
 #endif
 
@@ -65,6 +65,15 @@ struct exception_table_entry {
         ".previous\n"
 
 /*
+ * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() creates a special exception table entry
+ * (with lowest bit set) for which the fault handler in fixup_exception() will
+ * load -EFAULT into %r8 for a read or write fault, and zeroes the target
+ * register in case of a read fault in get_user().
+ */
+#define ASM_EXCEPTIONTABLE_ENTRY_EFAULT( fault_addr, except_addr )\
+        ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr + 1)
+
+/*
  * The page fault handler stores, in a per-cpu area, the following information
  * if a fixup routine is available.
  */
@@ -88,92 +97,116 @@ struct exception_data {
                 " mtsp %0,%%sr2\n\t"            \
                 : : "r"(get_fs()) : )
 
-#define __get_user(x, ptr)                               \
-({                                                       \
-        register long __gu_err __asm__ ("r8") = 0;       \
-        register long __gu_val __asm__ ("r9") = 0;       \
-                                                         \
-        load_sr2();                                      \
-        switch (sizeof(*(ptr))) {                        \
-            case 1: __get_user_asm("ldb", ptr); break;   \
-            case 2: __get_user_asm("ldh", ptr); break;   \
-            case 4: __get_user_asm("ldw", ptr); break;   \
-            case 8: LDD_USER(ptr);  break;               \
-            default: BUILD_BUG(); break;                 \
-        }                                                \
-                                                         \
-        (x) = (__force __typeof__(*(ptr))) __gu_val;     \
-        __gu_err;                                        \
+#define __get_user_internal(val, ptr)                   \
+({                                                      \
+        register long __gu_err __asm__ ("r8") = 0;      \
+                                                        \
+        switch (sizeof(*(ptr))) {                       \
+        case 1: __get_user_asm(val, "ldb", ptr); break; \
+        case 2: __get_user_asm(val, "ldh", ptr); break; \
+        case 4: __get_user_asm(val, "ldw", ptr); break; \
+        case 8: LDD_USER(val, ptr); break;              \
+        default: BUILD_BUG();                           \
+        }                                               \
+                                                        \
+        __gu_err;                                       \
 })
 
-#define __get_user_asm(ldx, ptr)                        \
-        __asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t"     \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
+#define __get_user(val, ptr)                            \
+({                                                      \
+        load_sr2();                                     \
+        __get_user_internal(val, ptr);                  \
+})
+
+#define __get_user_asm(val, ldx, ptr)                   \
+{                                                       \
+        register long __gu_val;                         \
+                                                        \
+        __asm__("1: " ldx " 0(%%sr2,%2),%0\n"           \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
                 : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = (__force __typeof__(*(ptr))) __gu_val;  \
+}
 
 #if !defined(CONFIG_64BIT)
 
-#define __get_user_asm64(ptr)                           \
-        __asm__("\n1:\tldw 0(%%sr2,%2),%0"              \
-                "\n2:\tldw 4(%%sr2,%2),%R0\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
-                : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+#define __get_user_asm64(val, ptr)                      \
+{                                                       \
+        union {                                         \
+                unsigned long long      l;              \
+                __typeof__(*(ptr))      t;              \
+        } __gu_tmp;                                     \
+                                                        \
+        __asm__("   copy %%r0,%R0\n"                    \
+                "1: ldw 0(%%sr2,%2),%0\n"               \
+                "2: ldw 4(%%sr2,%2),%R0\n"              \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b) \
+                : "=&r"(__gu_tmp.l), "=r"(__gu_err)     \
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = __gu_tmp.t;                             \
+}
 
 #endif /* !defined(CONFIG_64BIT) */
 
 
-#define __put_user(x, ptr)                                      \
+#define __put_user_internal(x, ptr)                             \
 ({                                                              \
         register long __pu_err __asm__ ("r8") = 0;              \
         __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);       \
                                                                 \
-        load_sr2();                                             \
         switch (sizeof(*(ptr))) {                               \
-            case 1: __put_user_asm("stb", __x, ptr); break;     \
-            case 2: __put_user_asm("sth", __x, ptr); break;     \
-            case 4: __put_user_asm("stw", __x, ptr); break;     \
-            case 8: STD_USER(__x, ptr); break;                  \
-            default: BUILD_BUG(); break;                        \
-        }                                                       \
+        case 1: __put_user_asm("stb", __x, ptr); break;         \
+        case 2: __put_user_asm("sth", __x, ptr); break;         \
+        case 4: __put_user_asm("stw", __x, ptr); break;         \
+        case 8: STD_USER(__x, ptr); break;                      \
+        default: BUILD_BUG();                                   \
+        }                                                       \
                                                                 \
         __pu_err;                                               \
 })
 
+#define __put_user(x, ptr)                                      \
+({                                                              \
+        load_sr2();                                             \
+        __put_user_internal(x, ptr);                            \
+})
+
+
 /*
  * The "__put_user/kernel_asm()" macros tell gcc they read from memory
  * instead of writing. This is because they do not write to any memory
  * gcc knows about, so there are no aliasing issues. These macros must
- * also be aware that "fixup_put_user_skip_[12]" are executed in the
- * context of the fault, and any registers used there must be listed
- * as clobbers. In this case only "r1" is used by the current routines.
- * r8/r9 are already listed as err/val.
+ * also be aware that fixups are executed in the context of the fault,
+ * and any registers used there must be listed as clobbers.
+ * r8 is already listed as err.
  */
 
 #define __put_user_asm(stx, x, ptr)                         \
         __asm__ __volatile__ (                              \
-                "\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
+                "1: " stx " %2,0(%%sr2,%1)\n"               \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(x), "0"(__pu_err)           \
-                : "r1")
+                : "r"(ptr), "r"(x), "0"(__pu_err))
 
 
 #if !defined(CONFIG_64BIT)
 
 #define __put_user_asm64(__val, ptr) do {                   \
         __asm__ __volatile__ (                              \
-                "\n1:\tstw %2,0(%%sr2,%1)"                  \
-                "\n2:\tstw %R2,4(%%sr2,%1)\n\t"             \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
+                "1: stw %2,0(%%sr2,%1)\n"                   \
+                "2: stw %R2,4(%%sr2,%1)\n"                  \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(__val), "0"(__pu_err) \
-                : "r1");                                    \
+                : "r"(ptr), "r"(__val), "0"(__pu_err));     \
 } while (0)
 
 #endif /* !defined(CONFIG_64BIT) */
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 7484b3d11e0d..c6d6272a934f 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -47,16 +47,6 @@ EXPORT_SYMBOL(__cmpxchg_u64);
 EXPORT_SYMBOL(lclear_user);
 EXPORT_SYMBOL(lstrnlen_user);
 
-/* Global fixups - defined as int to avoid creation of function pointers */
-extern int fixup_get_user_skip_1;
-extern int fixup_get_user_skip_2;
-extern int fixup_put_user_skip_1;
-extern int fixup_put_user_skip_2;
-EXPORT_SYMBOL(fixup_get_user_skip_1);
-EXPORT_SYMBOL(fixup_get_user_skip_2);
-EXPORT_SYMBOL(fixup_put_user_skip_1);
-EXPORT_SYMBOL(fixup_put_user_skip_2);
-
 #ifndef CONFIG_64BIT
 /* Needed so insmod can set dp value */
 extern int $global$;
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index b76f503eee4a..4516a5b53f38 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -143,6 +143,8 @@ void machine_power_off(void)
         printk(KERN_EMERG "System shut down completed.\n"
                "Please power this system off now.");
 
+        /* prevent soft lockup/stalled CPU messages for endless loop. */
+        rcu_sysrq_start();
         for (;;);
 }
 
diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
index 8fa92b8d839a..f2dac4d73b1b 100644
--- a/arch/parisc/lib/Makefile
+++ b/arch/parisc/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for parisc-specific library files
 #
 
-lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
+lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \
            ucmpdi2.o delay.o
 
 obj-y   := iomap.o
diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
deleted file mode 100644
index a5b72f22c7a6..000000000000
--- a/arch/parisc/lib/fixup.S
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Linux/PA-RISC Project (http://www.parisc-linux.org/)
- *
- *  Copyright (C) 2004  Randolph Chung <tausq@debian.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2, or (at your option)
- *    any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- * 
- * Fixup routines for kernel exception handling.
- */
-#include <asm/asm-offsets.h>
-#include <asm/assembly.h>
-#include <asm/errno.h>
-#include <linux/linkage.h>
-
-#ifdef CONFIG_SMP
-        .macro  get_fault_ip t1 t2
-        loadgp
-        addil LT%__per_cpu_offset,%r27
-        LDREG RT%__per_cpu_offset(%r1),\t1
-        /* t2 = smp_processor_id() */
-        mfctl 30,\t2
-        ldw TI_CPU(\t2),\t2
-#ifdef CONFIG_64BIT
-        extrd,u \t2,63,32,\t2
-#endif
-        /* t2 = &__per_cpu_offset[smp_processor_id()]; */
-        LDREGX \t2(\t1),\t2 
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t1
-        /* t1 = this_cpu_ptr(&exception_data) */
-        add,l \t1,\t2,\t1
-        /* %r27 = t1->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t1), %r27
-        /* t1 = t1->fault_ip */
-        LDREG EXCDATA_IP(\t1), \t1
-        .endm
-#else
-        .macro  get_fault_ip t1 t2
-        loadgp
-        /* t1 = this_cpu_ptr(&exception_data) */
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t2
-        /* %r27 = t2->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t2), %r27
-        /* t1 = t2->fault_ip */
-        LDREG EXCDATA_IP(\t2), \t1
-        .endm
-#endif
-
-        .level LEVEL
-
-        .text
-        .section .fixup, "ax"
-
-        /* get_user() fixups, store -EFAULT in r8, and 0 in r9 */
-ENTRY_CFI(fixup_get_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_1)
-
-ENTRY_CFI(fixup_get_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_2)
-
-        /* put_user() fixups, store -EFAULT in r8 */
-ENTRY_CFI(fixup_put_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_1)
-
-ENTRY_CFI(fixup_put_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_2)
-
diff --git a/arch/parisc/lib/lusercopy.S b/arch/parisc/lib/lusercopy.S
index 56845de6b5df..85c28bb80fb7 100644
--- a/arch/parisc/lib/lusercopy.S
+++ b/arch/parisc/lib/lusercopy.S
@@ -5,6 +5,8 @@
  *    Copyright (C) 2000 Richard Hirst <rhirst with parisc-linux.org>
  *    Copyright (C) 2001 Matthieu Delahaye <delahaym at esiee.fr>
  *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
+ *    Copyright (C) 2017 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2017 John David Anglin <dave.anglin@bell.net>
  *
  *
  *    This program is free software; you can redistribute it and/or modify
@@ -132,4 +134,321 @@ ENDPROC_CFI(lstrnlen_user)
 
         .procend
 
+
+
+/*
+ * unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
+ *
+ * Inputs:
+ * - sr1 already contains space of source region
+ * - sr2 already contains space of destination region
+ *
+ * Returns:
+ * - number of bytes that could not be copied.
+ *   On success, this will be zero.
+ *
+ * This code is based on a C-implementation of a copy routine written by
+ * Randolph Chung, which in turn was derived from the glibc.
+ *
+ * Several strategies are tried to try to get the best performance for various
+ * conditions. In the optimal case, we copy by loops that copy 32- or 16-bytes
+ * at a time using general registers.  Unaligned copies are handled either by
+ * aligning the destination and then using shift-and-write method, or in a few
+ * cases by falling back to a byte-at-a-time copy.
+ *
+ * Testing with various alignments and buffer sizes shows that this code is
+ * often >10x faster than a simple byte-at-a-time copy, even for strangely
+ * aligned operands. It is interesting to note that the glibc version of memcpy
+ * (written in C) is actually quite fast already. This routine is able to beat
+ * it by 30-40% for aligned copies because of the loop unrolling, but in some
+ * cases the glibc version is still slightly faster. This lends more
+ * credibility that gcc can generate very good code as long as we are careful.
+ *
+ * Possible optimizations:
+ * - add cache prefetching
+ * - try not to use the post-increment address modifiers; they may create
+ *   additional interlocks. Assumption is that those were only efficient on old
+ *   machines (pre PA8000 processors)
+ */
+
+        dst = arg0
+        src = arg1
+        len = arg2
+        end = arg3
+        t1  = r19
+        t2  = r20
+        t3  = r21
+        t4  = r22
+        srcspc = sr1
+        dstspc = sr2
+
+        t0 = r1
+        a1 = t1
+        a2 = t2
+        a3 = t3
+        a0 = t4
+
+        save_src = ret0
+        save_dst = ret1
+        save_len = r31
+
+ENTRY_CFI(pa_memcpy)
+        .proc
+        .callinfo NO_CALLS
+        .entry
+
+        /* Last destination address */
+        add     dst,len,end
+
+        /* short copy with less than 16 bytes? */
+        cmpib,COND(>>=),n 15,len,.Lbyte_loop
+
+        /* same alignment? */
+        xor     src,dst,t0
+        extru   t0,31,2,t1
+        cmpib,<>,n  0,t1,.Lunaligned_copy
+
+#ifdef CONFIG_64BIT
+        /* only do 64-bit copies if we can get aligned. */
+        extru   t0,31,3,t1
+        cmpib,<>,n  0,t1,.Lalign_loop32
+
+        /* loop until we are 64-bit aligned */
+.Lalign_loop64:
+        extru   dst,31,3,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_16_start
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop64
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_loop_16_start:
+        ldi     31,t0
+.Lcopy_loop_16:
+        cmpb,COND(>>=),n t0,len,.Lword_loop
+
+10:     ldd     0(srcspc,src),t1
+11:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+12:     std,ma  t1,8(dstspc,dst)
+13:     std,ma  t2,8(dstspc,dst)
+14:     ldd     0(srcspc,src),t1
+15:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+16:     std,ma  t1,8(dstspc,dst)
+17:     std,ma  t2,8(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_16
+        ldo     -32(len),len
+
+.Lword_loop:
+        cmpib,COND(>>=),n 3,len,.Lbyte_loop
+20:     ldw,ma  4(srcspc,src),t1
+21:     stw,ma  t1,4(dstspc,dst)
+        b       .Lword_loop
+        ldo     -4(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+#endif /* CONFIG_64BIT */
+
+        /* loop until we are 32-bit aligned */
+.Lalign_loop32:
+        extru   dst,31,2,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_8
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop32
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+
+.Lcopy_loop_8:
+        cmpib,COND(>>=),n 15,len,.Lbyte_loop
+
+10:     ldw     0(srcspc,src),t1
+11:     ldw     4(srcspc,src),t2
+12:     stw,ma  t1,4(dstspc,dst)
+13:     stw,ma  t2,4(dstspc,dst)
+14:     ldw     8(srcspc,src),t1
+15:     ldw     12(srcspc,src),t2
+        ldo     16(src),src
+16:     stw,ma  t1,4(dstspc,dst)
+17:     stw,ma  t2,4(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_8
+        ldo     -16(len),len
+
+.Lbyte_loop:
+        cmpclr,COND(<>) len,%r0,%r0
+        b,n     .Lcopy_done
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lbyte_loop
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_done:
+        bv      %r0(%r2)
+        sub     end,dst,ret0
+
+
+        /* src and dst are not aligned the same way. */
+        /* need to go the hard way */
+.Lunaligned_copy:
+        /* align until dst is 32bit-word-aligned */
+        extru   dst,31,2,t1
+        cmpib,=,n       0,t1,.Lcopy_dstaligned
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lunaligned_copy
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_dstaligned:
+
+        /* store src, dst and len in safe place */
+        copy    src,save_src
+        copy    dst,save_dst
+        copy    len,save_len
+
+        /* len now needs give number of words to copy */
+        SHRREG  len,2,len
+
+        /*
+         * Copy from a not-aligned src to an aligned dst using shifts.
+         * Handles 4 words per loop.
+         */
+
+        depw,z src,28,2,t0
+        subi 32,t0,t0
+        mtsar t0
+        extru len,31,2,t0
+        cmpib,= 2,t0,.Lcase2
+        /* Make src aligned by rounding it down.  */
+        depi 0,31,2,src
+
+        cmpiclr,<> 3,t0,%r0
+        b,n .Lcase3
+        cmpiclr,<> 1,t0,%r0
+        b,n .Lcase1
+.Lcase0:
+        cmpb,COND(=) %r0,len,.Lcda_finish
+        nop
+
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b,n .Ldo3
+.Lcase1:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        ldo -1(len),len
+        cmpb,COND(=),n %r0,len,.Ldo0
+.Ldo4:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo3:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a3, a0, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo2:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a0, a1, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo1:
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a1, a2, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+        ldo -4(len),len
+        cmpb,COND(<>) %r0,len,.Ldo4
+        nop
+.Ldo0:
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+
+.Lcda_rdfault:
+.Lcda_finish:
+        /* calculate new src, dst and len and jump to byte-copy loop */
+        sub     dst,save_dst,t0
+        add     save_src,t0,src
+        b       .Lbyte_loop
+        sub     save_len,t0,len
+
+.Lcase3:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo2
+        ldo 1(len),len
+.Lcase2:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo1
+        ldo 2(len),len
+
+
+        /* fault exception fixup handlers: */
+#ifdef CONFIG_64BIT
+.Lcopy16_fault:
+        b       .Lcopy_done
+10:     std,ma  t1,8(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+#endif
+
+.Lcopy8_fault:
+        b       .Lcopy_done
+10:     stw,ma  t1,4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+
+        .exit
+ENDPROC_CFI(pa_memcpy)
+        .procend
+
         .end
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index f82ff10ed974..b3d47ec1d80a 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -2,7 +2,7 @@
  *    Optimized memory copy routines.
  *
  *    Copyright (C) 2004 Randolph Chung <tausq@debian.org>
- *    Copyright (C) 2013 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2013-2017 Helge Deller <deller@gmx.de>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -21,474 +21,21 @@
  *    Portions derived from the GNU C Library
  *    Copyright (C) 1991, 1997, 2003 Free Software Foundation, Inc.
  *
- * Several strategies are tried to try to get the best performance for various
- * conditions. In the optimal case, we copy 64-bytes in an unrolled loop using 
- * fp regs. This is followed by loops that copy 32- or 16-bytes at a time using
- * general registers.  Unaligned copies are handled either by aligning the 
- * destination and then using shift-and-write method, or in a few cases by 
- * falling back to a byte-at-a-time copy.
- *
- * I chose to implement this in C because it is easier to maintain and debug,
- * and in my experiments it appears that the C code generated by gcc (3.3/3.4
- * at the time of writing) is fairly optimal. Unfortunately some of the 
- * semantics of the copy routine (exception handling) is difficult to express
- * in C, so we have to play some tricks to get it to work.
- *
- * All the loads and stores are done via explicit asm() code in order to use
- * the right space registers. 
- * 
- * Testing with various alignments and buffer sizes shows that this code is 
- * often >10x faster than a simple byte-at-a-time copy, even for strangely
- * aligned operands. It is interesting to note that the glibc version
- * of memcpy (written in C) is actually quite fast already. This routine is 
- * able to beat it by 30-40% for aligned copies because of the loop unrolling, 
- * but in some cases the glibc version is still slightly faster. This lends 
- * more credibility that gcc can generate very good code as long as we are 
- * careful.
- *
- * TODO:
- * - cache prefetching needs more experimentation to get optimal settings
- * - try not to use the post-increment address modifiers; they create additional
- *   interlocks
- * - replace byte-copy loops with stybs sequences
  */
 
-#ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
 #include <linux/uaccess.h>
-#define s_space "%%sr1"
-#define d_space "%%sr2"
-#else
-#include "memcpy.h"
-#define s_space "%%sr0"
-#define d_space "%%sr0"
-#define pa_memcpy new2_copy
-#endif
 
 DECLARE_PER_CPU(struct exception_data, exception_data);
 
-#define preserve_branch(label)  do {                                    \
-        volatile int dummy = 0;                                         \
-        /* The following branch is never taken, it's just here to  */   \
-        /* prevent gcc from optimizing away our exception code. */      \
-        if (unlikely(dummy != dummy))                                   \
-                goto label;                                             \
-} while (0)
-
 #define get_user_space() (segment_eq(get_fs(), KERNEL_DS) ? 0 : mfsp(3))
 #define get_kernel_space() (0)
 
-#define MERGE(w0, sh_1, w1, sh_2)  ({                                   \
-        unsigned int _r;                                                \
-        asm volatile (                                                  \
-        "mtsar %3\n"                                                    \
-        "shrpw %1, %2, %%sar, %0\n"                                     \
-        : "=r"(_r)                                                      \
-        : "r"(w0), "r"(w1), "r"(sh_2)                                   \
-        );                                                              \
-        _r;                                                             \
-})
-#define THRESHOLD       16
-
-#ifdef DEBUG_MEMCPY
-#define DPRINTF(fmt, args...) do { printk(KERN_DEBUG "%s:%d:%s ", __FILE__, __LINE__, __func__ ); printk(KERN_DEBUG fmt, ##args ); } while (0)
-#else
-#define DPRINTF(fmt, args...)
-#endif
-
-#define def_load_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)     \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma " #_sz "(" _s ",%1), %0\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t), "+r"(_a)                             \
-        :                                               \
-        : "r8")
-
-#define def_store_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)    \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma %1, " #_sz "(" _s ",%0)\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : "+r"(_a)                                      \
-        : _tt(_t)                                       \
-        : "r8")
-
-#define ldbma(_s, _a, _t, _e) def_load_ai_insn(ldbs,1,"=r",_s,_a,_t,_e)
-#define stbma(_s, _t, _a, _e) def_store_ai_insn(stbs,1,"r",_s,_a,_t,_e)
-#define ldwma(_s, _a, _t, _e) def_load_ai_insn(ldw,4,"=r",_s,_a,_t,_e)
-#define stwma(_s, _t, _a, _e) def_store_ai_insn(stw,4,"r",_s,_a,_t,_e)
-#define flddma(_s, _a, _t, _e) def_load_ai_insn(fldd,8,"=f",_s,_a,_t,_e)
-#define fstdma(_s, _t, _a, _e) def_store_ai_insn(fstd,8,"f",_s,_a,_t,_e)
-
-#define def_load_insn(_insn,_tt,_s,_o,_a,_t,_e)         \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " " #_o "(" _s ",%1), %0\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t)                                       \
-        : "r"(_a)                                       \
-        : "r8")
-
-#define def_store_insn(_insn,_tt,_s,_t,_o,_a,_e)        \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " %0, " #_o "(" _s ",%1)\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        :                                               \
-        : _tt(_t), "r"(_a)                              \
-        : "r8")
-
-#define ldw(_s,_o,_a,_t,_e)     def_load_insn(ldw,"=r",_s,_o,_a,_t,_e)
-#define stw(_s,_t,_o,_a,_e)     def_store_insn(stw,"r",_s,_t,_o,_a,_e)
-
-#ifdef  CONFIG_PREFETCH
-static inline void prefetch_src(const void *addr)
-{
-        __asm__("ldw 0(" s_space ",%0), %%r0" : : "r" (addr));
-}
-
-static inline void prefetch_dst(const void *addr)
-{
-        __asm__("ldd 0(" d_space ",%0), %%r0" : : "r" (addr));
-}
-#else
-#define prefetch_src(addr) do { } while(0)
-#define prefetch_dst(addr) do { } while(0)
-#endif
-
-#define PA_MEMCPY_OK            0
-#define PA_MEMCPY_LOAD_ERROR    1
-#define PA_MEMCPY_STORE_ERROR   2
-
-/* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
- * per loop.  This code is derived from glibc. 
- */
-static noinline unsigned long copy_dstaligned(unsigned long dst,
-                                        unsigned long src, unsigned long len)
-{
-        /* gcc complains that a2 and a3 may be uninitialized, but actually
-         * they cannot be.  Initialize a2/a3 to shut gcc up.
-         */
-        register unsigned int a0, a1, a2 = 0, a3 = 0;
-        int sh_1, sh_2;
-
-        /* prefetch_src((const void *)src); */
-
-        /* Calculate how to shift a word read at the memory operation
-           aligned srcp to make it aligned for copy.  */
-        sh_1 = 8 * (src % sizeof(unsigned int));
-        sh_2 = 8 * sizeof(unsigned int) - sh_1;
-
-        /* Make src aligned by rounding it down.  */
-        src &= -sizeof(unsigned int);
-
-        switch (len % 4)
-        {
-                case 2:
-                        /* a1 = ((unsigned int *) src)[0];
-                           a2 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a1, cda_ldw_exc);
-                        ldw(s_space, 4, src, a2, cda_ldw_exc);
-                        src -= 1 * sizeof(unsigned int);
-                        dst -= 3 * sizeof(unsigned int);
-                        len += 2;
-                        goto do1;
-                case 3:
-                        /* a0 = ((unsigned int *) src)[0];
-                           a1 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a0, cda_ldw_exc);
-                        ldw(s_space, 4, src, a1, cda_ldw_exc);
-                        src -= 0 * sizeof(unsigned int);
-                        dst -= 2 * sizeof(unsigned int);
-                        len += 1;
-                        goto do2;
-                case 0:
-                        if (len == 0)
-                                return PA_MEMCPY_OK;
-                        /* a3 = ((unsigned int *) src)[0];
-                           a0 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a3, cda_ldw_exc);
-                        ldw(s_space, 4, src, a0, cda_ldw_exc);
-                        src -=-1 * sizeof(unsigned int);
-                        dst -= 1 * sizeof(unsigned int);
-                        len += 0;
-                        goto do3;
-                case 1:
-                        /* a2 = ((unsigned int *) src)[0];
-                           a3 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a2, cda_ldw_exc);
-                        ldw(s_space, 4, src, a3, cda_ldw_exc);
-                        src -=-2 * sizeof(unsigned int);
-                        dst -= 0 * sizeof(unsigned int);
-                        len -= 1;
-                        if (len == 0)
-                                goto do0;
-                        goto do4;                       /* No-op.  */
-        }
-
-        do
-        {
-                /* prefetch_src((const void *)(src + 4 * sizeof(unsigned int))); */
-do4:
-                /* a0 = ((unsigned int *) src)[0]; */
-                ldw(s_space, 0, src, a0, cda_ldw_exc);
-                /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-                stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-do3:
-                /* a1 = ((unsigned int *) src)[1]; */
-                ldw(s_space, 4, src, a1, cda_ldw_exc);
-                /* ((unsigned int *) dst)[1] = MERGE (a3, sh_1, a0, sh_2); */
-                stw(d_space, MERGE (a3, sh_1, a0, sh_2), 4, dst, cda_stw_exc);
-do2:
-                /* a2 = ((unsigned int *) src)[2]; */
-                ldw(s_space, 8, src, a2, cda_ldw_exc);
-                /* ((unsigned int *) dst)[2] = MERGE (a0, sh_1, a1, sh_2); */
-                stw(d_space, MERGE (a0, sh_1, a1, sh_2), 8, dst, cda_stw_exc);
-do1:
-                /* a3 = ((unsigned int *) src)[3]; */
-                ldw(s_space, 12, src, a3, cda_ldw_exc);
-                /* ((unsigned int *) dst)[3] = MERGE (a1, sh_1, a2, sh_2); */
-                stw(d_space, MERGE (a1, sh_1, a2, sh_2), 12, dst, cda_stw_exc);
-
-                src += 4 * sizeof(unsigned int);
-                dst += 4 * sizeof(unsigned int);
-                len -= 4;
-        }
-        while (len != 0);
-
-do0:
-        /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-        stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        return PA_MEMCPY_OK;
-
-handle_load_error:
-        __asm__ __volatile__ ("cda_ldw_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("cda_stw_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
-/* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
- * In case of an access fault the faulty address can be read from the per_cpu
- * exception data struct. */
-static noinline unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
-                                        unsigned long len)
-{
-        register unsigned long src, dst, t1, t2, t3;
-        register unsigned char *pcs, *pcd;
-        register unsigned int *pws, *pwd;
-        register double *pds, *pdd;
-        unsigned long ret;
-
-        src = (unsigned long)srcp;
-        dst = (unsigned long)dstp;
-        pcs = (unsigned char *)srcp;
-        pcd = (unsigned char *)dstp;
-
-        /* prefetch_src((const void *)srcp); */
-
-        if (len < THRESHOLD)
-                goto byte_copy;
-
-        /* Check alignment */
-        t1 = (src ^ dst);
-        if (unlikely(t1 & (sizeof(double)-1)))
-                goto unaligned_copy;
-
-        /* src and dst have same alignment. */
-
-        /* Copy bytes till we are double-aligned. */
-        t2 = src & (sizeof(double) - 1);
-        if (unlikely(t2 != 0)) {
-                t2 = sizeof(double) - t2;
-                while (t2 && len) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        len--;
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        t2--;
-                }
-        }
-
-        pds = (double *)pcs;
-        pdd = (double *)pcd;
-
-#if 0
-        /* Copy 8 doubles at a time */
-        while (len >= 8*sizeof(double)) {
-                register double r1, r2, r3, r4, r5, r6, r7, r8;
-                /* prefetch_src((char *)pds + L1_CACHE_BYTES); */
-                flddma(s_space, pds, r1, pmc_load_exc);
-                flddma(s_space, pds, r2, pmc_load_exc);
-                flddma(s_space, pds, r3, pmc_load_exc);
-                flddma(s_space, pds, r4, pmc_load_exc);
-                fstdma(d_space, r1, pdd, pmc_store_exc);
-                fstdma(d_space, r2, pdd, pmc_store_exc);
-                fstdma(d_space, r3, pdd, pmc_store_exc);
-                fstdma(d_space, r4, pdd, pmc_store_exc);
-
-#if 0
-                if (L1_CACHE_BYTES <= 32)
-                        prefetch_src((char *)pds + L1_CACHE_BYTES);
-#endif
-                flddma(s_space, pds, r5, pmc_load_exc);
-                flddma(s_space, pds, r6, pmc_load_exc);
-                flddma(s_space, pds, r7, pmc_load_exc);
-                flddma(s_space, pds, r8, pmc_load_exc);
-                fstdma(d_space, r5, pdd, pmc_store_exc);
-                fstdma(d_space, r6, pdd, pmc_store_exc);
-                fstdma(d_space, r7, pdd, pmc_store_exc);
-                fstdma(d_space, r8, pdd, pmc_store_exc);
-                len -= 8*sizeof(double);
-        }
-#endif
-
-        pws = (unsigned int *)pds;
-        pwd = (unsigned int *)pdd;
-
-word_copy:
-        while (len >= 8*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4,r5,r6,r7,r8;
-                /* prefetch_src((char *)pws + L1_CACHE_BYTES); */
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-
-                ldwma(s_space, pws, r5, pmc_load_exc);
-                ldwma(s_space, pws, r6, pmc_load_exc);
-                ldwma(s_space, pws, r7, pmc_load_exc);
-                ldwma(s_space, pws, r8, pmc_load_exc);
-                stwma(d_space, r5, pwd, pmc_store_exc);
-                stwma(d_space, r6, pwd, pmc_store_exc);
-                stwma(d_space, r7, pwd, pmc_store_exc);
-                stwma(d_space, r8, pwd, pmc_store_exc);
-                len -= 8*sizeof(unsigned int);
-        }
-
-        while (len >= 4*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4;
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-                len -= 4*sizeof(unsigned int);
-        }
-
-        pcs = (unsigned char *)pws;
-        pcd = (unsigned char *)pwd;
-
-byte_copy:
-        while (len) {
-                /* *pcd++ = *pcs++; */
-                ldbma(s_space, pcs, t3, pmc_load_exc);
-                stbma(d_space, t3, pcd, pmc_store_exc);
-                len--;
-        }
-
-        return PA_MEMCPY_OK;
-
-unaligned_copy:
-        /* possibly we are aligned on a word, but not on a double... */
-        if (likely((t1 & (sizeof(unsigned int)-1)) == 0)) {
-                t2 = src & (sizeof(unsigned int) - 1);
-
-                if (unlikely(t2 != 0)) {
-                        t2 = sizeof(unsigned int) - t2;
-                        while (t2) {
-                                /* *pcd++ = *pcs++; */
-                                ldbma(s_space, pcs, t3, pmc_load_exc);
-                                stbma(d_space, t3, pcd, pmc_store_exc);
-                                len--;
-                                t2--;
-                        }
-                }
-
-                pws = (unsigned int *)pcs;
-                pwd = (unsigned int *)pcd;
-                goto word_copy;
-        }
-
-        /* Align the destination.  */
-        if (unlikely((dst & (sizeof(unsigned int) - 1)) != 0)) {
-                t2 = sizeof(unsigned int) - (dst & (sizeof(unsigned int) - 1));
-                while (t2) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        len--;
-                        t2--;
-                }
-                dst = (unsigned long)pcd;
-                src = (unsigned long)pcs;
-        }
-
-        ret = copy_dstaligned(dst, src, len / sizeof(unsigned int));
-        if (ret)
-                return ret;
-
-        pcs += (len & -sizeof(unsigned int));
-        pcd += (len & -sizeof(unsigned int));
-        len %= sizeof(unsigned int);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        goto byte_copy;
-
-handle_load_error:
-        __asm__ __volatile__ ("pmc_load_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("pmc_store_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
 /* Returns 0 for success, otherwise, returns number of bytes not transferred. */
-static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
-{
-        unsigned long ret, fault_addr, reference;
-        struct exception_data *d;
-
-        ret = pa_memcpy_internal(dstp, srcp, len);
-        if (likely(ret == PA_MEMCPY_OK))
-                return 0;
-
-        /* if a load or store fault occured we can get the faulty addr */
-        d = this_cpu_ptr(&exception_data);
-        fault_addr = d->fault_addr;
-
-        /* error in load or store? */
-        if (ret == PA_MEMCPY_LOAD_ERROR)
-                reference = (unsigned long) srcp;
-        else
-                reference = (unsigned long) dstp;
+extern unsigned long pa_memcpy(void *dst, const void *src,
+                                unsigned long len);
 
-        DPRINTF("pa_memcpy: fault type = %lu, len=%lu fault_addr=%lu ref=%lu\n",
-                ret, len, fault_addr, reference);
-
-        if (fault_addr >= reference)
-                return len - (fault_addr - reference);
-        else
-                return len;
-}
-
-#ifdef __KERNEL__
 unsigned long __copy_to_user(void __user *dst, const void *src,
                              unsigned long len)
 {
@@ -537,5 +84,3 @@ long probe_kernel_read(void *dst, const void *src, size_t size)
 
         return __probe_kernel_read(dst, src, size);
 }
-
-#endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index deab89a8915a..32ec22146141 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -150,6 +150,23 @@ int fixup_exception(struct pt_regs *regs)
                 d->fault_space = regs->isr;
                 d->fault_addr = regs->ior;
 
+                /*
+                 * Fix up get_user() and put_user().
+                 * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() sets the least-significant
+                 * bit in the relative address of the fixup routine to indicate
+                 * that %r8 should be loaded with -EFAULT to report a userspace
+                 * access error.
+                 */
+                if (fix->fixup & 1) {
+                        regs->gr[8] = -EFAULT;
+
+                        /* zero target register for get_user() */
+                        if (parisc_acctyp(0, regs->iir) == VM_READ) {
+                                int treg = regs->iir & 0x1f;
+                                regs->gr[treg] = 0;
+                        }
+                }
+
                 regs->iaoq[0] = (unsigned long)&fix->fixup + fix->fixup;
                 regs->iaoq[0] &= ~3;
                 /*
diff --git a/arch/powerpc/crypto/crc32c-vpmsum_glue.c b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
index 411994551afc..f058e0c3e4d4 100644
--- a/arch/powerpc/crypto/crc32c-vpmsum_glue.c
+++ b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
@@ -33,10 +33,13 @@ static u32 crc32c_vpmsum(u32 crc, unsigned char const *p, size_t len)
         }
 
         if (len & ~VMX_ALIGN_MASK) {
+                preempt_disable();
                 pagefault_disable();
                 enable_kernel_altivec();
                 crc = __crc32c_vpmsum(crc, p, len & ~VMX_ALIGN_MASK);
+                disable_kernel_altivec();
                 pagefault_enable();
+                preempt_enable();
         }
 
         tail = len & VMX_ALIGN_MASK;
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 14752eee3d0c..ed3beadd2cc5 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -236,9 +236,9 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
         mtctr   reg;                                                    \
         bctr
 
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
-        __LOAD_FAR_HANDLER(reg, label);                                 \
-        mtctr   reg;                                                    \
+#define BRANCH_LINK_TO_FAR(label)                                       \
+        __LOAD_FAR_HANDLER(r12, label);                                 \
+        mtctr   r12;                                                    \
         bctrl
 
 /*
@@ -265,7 +265,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
 #define BRANCH_TO_COMMON(reg, label)                                    \
         b       label
 
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
+#define BRANCH_LINK_TO_FAR(label)                                       \
         bl      label
 
 #define BRANCH_TO_KVM(reg, label)                                       \
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index cbc7c42cdb74..ec7a8b099dd9 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -807,14 +807,25 @@ int fix_alignment(struct pt_regs *regs)
         nb = aligninfo[instr].len;
         flags = aligninfo[instr].flags;
 
-        /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
-        if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
-                nb = 8;
-                flags = LD+SW;
-        } else if (IS_XFORM(instruction) &&
-                   ((instruction >> 1) & 0x3ff) == 660) {
-                nb = 8;
-                flags = ST+SW;
+        /*
+         * Handle some cases which give overlaps in the DSISR values.
+         */
+        if (IS_XFORM(instruction)) {
+                switch (get_xop(instruction)) {
+                case 532:       /* ldbrx */
+                        nb = 8;
+                        flags = LD+SW;
+                        break;
+                case 660:       /* stdbrx */
+                        nb = 8;
+                        flags = ST+SW;
+                        break;
+                case 20:        /* lwarx */
+                case 84:        /* ldarx */
+                case 116:       /* lharx */
+                case 276:       /* lqarx */
+                        return 0;       /* not emulated ever */
+                }
         }
 
         /* Byteswap little endian loads and stores */
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6432d4bf08c8..767ef6d68c9e 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -689,7 +689,7 @@ resume_kernel:
 
         addi    r8,r1,INT_FRAME_SIZE    /* Get the kprobed function entry */
 
-        lwz     r3,GPR1(r1)
+        ld      r3,GPR1(r1)
         subi    r3,r3,INT_FRAME_SIZE    /* dst: Allocate a trampoline exception frame */
         mr      r4,r1                   /* src:  current exception frame */
         mr      r1,r3                   /* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel:
         addi    r6,r6,8
         bdnz    2b
 
-        /* Do real store operation to complete stwu */
-        lwz     r5,GPR1(r1)
+        /* Do real store operation to complete stdu */
+        ld      r5,GPR1(r1)
         std     r8,0(r5)
 
         /* Clear _TIF_EMULATE_STACK_STORE flag */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 857bf7c5b946..6353019966e6 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -982,7 +982,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
         EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
         EXCEPTION_PROLOG_COMMON_3(0xe60)
         addi    r3,r1,STACK_FRAME_OVERHEAD
-        BRANCH_LINK_TO_FAR(r4, hmi_exception_realmode)
+        BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
         /* Windup the stack. */
         /* Move original HSRR0 and HSRR1 into the respective regs */
         ld      r9,_MSR(r1)
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 995728736677..6fd08219248d 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -449,9 +449,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 _GLOBAL(pnv_wakeup_tb_loss)
         ld      r1,PACAR1(r13)
         /*
-         * Before entering any idle state, the NVGPRs are saved in the stack
-         * and they are restored before switching to the process context. Hence
-         * until they are restored, they are free to be used.
+         * Before entering any idle state, the NVGPRs are saved in the stack.
+         * If there was a state loss, or PACA_NAPSTATELOST was set, then the
+         * NVGPRs are restored. If we are here, it is likely that state is lost,
+         * but not guaranteed -- neither ISA207 nor ISA300 tests to reach
+         * here are the same as the test to restore NVGPRS:
+         * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300,
+         * and SRR1 test for restoring NVGPRs.
+         *
+         * We are about to clobber NVGPRs now, so set NAPSTATELOST to
+         * guarantee they will always be restored. This might be tightened
+         * with careful reading of specs (particularly for ISA300) but this
+         * is already a slow wakeup path and it's simpler to be safe.
+         */
+        li      r0,1
+        stb     r0,PACA_NAPSTATELOST(r13)
+
+        /*
          *
          * Save SRR1 and LR in NVGPRs as they might be clobbered in
          * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index ae179cb1bb3c..c119044cad0d 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -67,7 +67,7 @@ PPC64_CACHES:
  *   flush all bytes from start through stop-1 inclusive
  */
 
-_GLOBAL(flush_icache_range)
+_GLOBAL_TOC(flush_icache_range)
 BEGIN_FTR_SECTION
         PURGE_PREFETCHED_INS
         blr
@@ -120,7 +120,7 @@ EXPORT_SYMBOL(flush_icache_range)
  *
  *    flush all bytes from start to stop-1 inclusive
  */
-_GLOBAL(flush_dcache_range)
+_GLOBAL_TOC(flush_dcache_range)
 
 /*
  * Flush the data cache to memory 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 9cfaa8b69b5f..f997154dfc41 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -236,6 +236,15 @@ static void cpu_ready_for_interrupts(void)
                 mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3);
         }
 
+        /*
+         * Fixup HFSCR:TM based on CPU features. The bit is set by our
+         * early asm init because at that point we haven't updated our
+         * CPU features from firmware and device-tree. Here we have,
+         * so let's do it.
+         */
+        if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+                mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
+
         /* Set IR and DR in PACA MSR */
         get_paca()->kernel_msr = MSR_KERNEL;
 }
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 8c68145ba1bd..710e491206ed 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -1487,6 +1487,10 @@ long kvm_vm_ioctl_resize_hpt_prepare(struct kvm *kvm,
         /* start new resize */
 
         resize = kzalloc(sizeof(*resize), GFP_KERNEL);
+        if (!resize) {
+                ret = -ENOMEM;
+                goto out;
+        }
         resize->order = shift;
         resize->kvm = kvm;
         INIT_WORK(&resize->work, resize_hpt_prepare_work);
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index cc332608e656..65bb8f33b399 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -638,6 +638,10 @@ static void native_flush_hash_range(unsigned long number, int local)
         unsigned long psize = batch->psize;
         int ssize = batch->ssize;
         int i;
+        unsigned int use_local;
+
+        use_local = local && mmu_has_feature(MMU_FTR_TLBIEL) &&
+                mmu_psize_defs[psize].tlbiel && !cxl_ctx_in_use();
 
         local_irq_save(flags);
 
@@ -667,8 +671,7 @@ static void native_flush_hash_range(unsigned long number, int local)
                 } pte_iterate_hashed_end();
         }
 
-        if (mmu_has_feature(MMU_FTR_TLBIEL) &&
-            mmu_psize_defs[psize].tlbiel && local) {
+        if (use_local) {
                 asm volatile("ptesync":::"memory");
                 for (i = 0; i < number; i++) {
                         vpn = batch->vpn[i];
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 9be992083d2a..c22f207aa656 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -397,8 +397,7 @@ static void early_check_vec5(void)
 void __init mmu_early_init_devtree(void)
 {
         /* Disable radix mode based on kernel command line. */
-        /* We don't yet have the machinery to do radix as a guest. */
-        if (disable_radix || !(mfmsr() & MSR_HV))
+        if (disable_radix)
                 cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
 
         /*
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index fa95041fa9f6..33ca29333e18 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -141,31 +141,34 @@ static void check_ipl_parmblock(void *start, unsigned long size)
 
 unsigned long decompress_kernel(void)
 {
-        unsigned long output_addr;
-        unsigned char *output;
+        void *output, *kernel_end;
 
-        output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL;
-        check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start);
-        memset(&_bss, 0, &_ebss - &_bss);
-        free_mem_ptr = (unsigned long)&_end;
-        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
-        output = (unsigned char *) output_addr;
+        output = (void *) ALIGN((unsigned long) &_end + HEAP_SIZE, PAGE_SIZE);
+        kernel_end = output + SZ__bss_start;
+        check_ipl_parmblock((void *) 0, (unsigned long) kernel_end);
 
 #ifdef CONFIG_BLK_DEV_INITRD
         /*
          * Move the initrd right behind the end of the decompressed
-         * kernel image.
+         * kernel image. This also prevents initrd corruption caused by
+         * bss clearing since kernel_end will always be located behind the
+         * current bss section..
          */
-        if (INITRD_START && INITRD_SIZE &&
-            INITRD_START < (unsigned long) output + SZ__bss_start) {
-                check_ipl_parmblock(output + SZ__bss_start,
-                                    INITRD_START + INITRD_SIZE);
-                memmove(output + SZ__bss_start,
-                        (void *) INITRD_START, INITRD_SIZE);
-                INITRD_START = (unsigned long) output + SZ__bss_start;
+        if (INITRD_START && INITRD_SIZE && kernel_end > (void *) INITRD_START) {
+                check_ipl_parmblock(kernel_end, INITRD_SIZE);
+                memmove(kernel_end, (void *) INITRD_START, INITRD_SIZE);
+                INITRD_START = (unsigned long) kernel_end;
         }
 #endif
 
+        /*
+         * Clear bss section. free_mem_ptr and free_mem_end_ptr need to be
+         * initialized afterwards since they reside in bss.
+         */
+        memset(&_bss, 0, &_ebss - &_bss);
+        free_mem_ptr = (unsigned long) &_end;
+        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
+
         puts("Uncompressing Linux... ");
         __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
         puts("Ok, booting the kernel.\n");
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 93e37b12e882..ecec682bb516 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1051,6 +1051,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 {
         if (!MACHINE_HAS_NX)
                 pte_val(entry) &= ~_PAGE_NOEXEC;
+        if (pte_present(entry))
+                pte_val(entry) &= ~_PAGE_UNUSED;
         if (mm_has_pgste(mm))
                 ptep_set_pte_at(mm, addr, ptep, entry);
         else
diff --git a/arch/s390/include/asm/sections.h b/arch/s390/include/asm/sections.h
index 5ce29fe100ba..fbd9116eb17b 100644
--- a/arch/s390/include/asm/sections.h
+++ b/arch/s390/include/asm/sections.h
@@ -4,6 +4,5 @@
 #include <asm-generic/sections.h>
 
 extern char _eshared[], _ehead[];
-extern char __start_ro_after_init[], __end_ro_after_init[];
 
 #endif
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 136932ff4250..3ea1554d04b3 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -147,7 +147,7 @@ unsigned long __must_check __copy_to_user(void __user *to, const void *from,
                 "       jg      2b\n"                           \
                 ".popsection\n"                                 \
                 EX_TABLE(0b,3b) EX_TABLE(1b,3b)                 \
-                : "=d" (__rc), "=Q" (*(to))                     \
+                : "=d" (__rc), "+Q" (*(to))                     \
                 : "d" (size), "Q" (*(from)),                    \
                   "d" (__reg0), "K" (-EFAULT)                   \
                 : "cc");                                        \
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 47a973b5b4f1..5dab859b0d54 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -909,13 +909,11 @@ void __init smp_prepare_boot_cpu(void)
 {
         struct pcpu *pcpu = pcpu_devices;
 
+        WARN_ON(!cpu_present(0) || !cpu_online(0));
         pcpu->state = CPU_STATE_CONFIGURED;
-        pcpu->address = stap();
         pcpu->lowcore = (struct lowcore *)(unsigned long) store_prefix();
         S390_lowcore.percpu_offset = __per_cpu_offset[0];
         smp_cpu_set_polarization(0, POLARIZATION_UNKNOWN);
-        set_cpu_present(0, true);
-        set_cpu_online(0, true);
 }
 
 void __init smp_cpus_done(unsigned int max_cpus)
@@ -924,6 +922,7 @@ void __init smp_cpus_done(unsigned int max_cpus)
 
 void __init smp_setup_processor_id(void)
 {
+        pcpu_devices[0].address = stap();
         S390_lowcore.cpu_nr = 0;
         S390_lowcore.spinlock_lockval = arch_spin_lockval(0);
 }
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 5ccf95396251..72307f108c40 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -63,11 +63,9 @@ SECTIONS
 
         . = ALIGN(PAGE_SIZE);
         __start_ro_after_init = .;
-        __start_data_ro_after_init = .;
         .data..ro_after_init : {
                  *(.data..ro_after_init)
         }
-        __end_data_ro_after_init = .;
         EXCEPTION_TABLE(16)
         . = ALIGN(PAGE_SIZE);
         __end_ro_after_init = .;
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index d55c829a5944..ddbffb715b40 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -168,8 +168,7 @@ union page_table_entry {
                 unsigned long z  : 1; /* Zero Bit */
                 unsigned long i  : 1; /* Page-Invalid Bit */
                 unsigned long p  : 1; /* DAT-Protection Bit */
-                unsigned long co : 1; /* Change-Recording Override */
-                unsigned long    : 8;
+                unsigned long    : 9;
         };
 };
 
@@ -745,8 +744,6 @@ static unsigned long guest_translate(struct kvm_vcpu *vcpu, unsigned long gva,
                 return PGM_PAGE_TRANSLATION;
         if (pte.z)
                 return PGM_TRANSLATION_SPEC;
-        if (pte.co && !edat1)
-                return PGM_TRANSLATION_SPEC;
         dat_protection |= pte.p;
         raddr.pfra = pte.pfra;
 real_address:
@@ -1182,7 +1179,7 @@ int kvm_s390_shadow_fault(struct kvm_vcpu *vcpu, struct gmap *sg,
                 rc = gmap_read_table(sg->parent, pgt + vaddr.px * 8, &pte.val);
         if (!rc && pte.i)
                 rc = PGM_PAGE_TRANSLATION;
-        if (!rc && (pte.z || (pte.co && sg->edat_level < 1)))
+        if (!rc && pte.z)
                 rc = PGM_TRANSLATION_SPEC;
 shadow_page:
         pte.p |= dat_protection;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 68ac5c7cd982..a59deaef21e5 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -43,7 +43,7 @@ config SPARC
         select ARCH_HAS_SG_CHAIN
         select CPU_NO_EFFICIENT_FFS
         select HAVE_ARCH_HARDENED_USERCOPY
-        select PROVE_LOCKING_SMALL if PROVE_LOCKING
+        select LOCKDEP_SMALL if LOCKDEP
         select ARCH_WANT_RELAX_ORDER
 
 config SPARC32
diff --git a/arch/sparc/include/asm/page_64.h b/arch/sparc/include/asm/page_64.h
index f294dd42fc7d..5961b2d8398a 100644
--- a/arch/sparc/include/asm/page_64.h
+++ b/arch/sparc/include/asm/page_64.h
@@ -17,6 +17,7 @@
 
 #define HPAGE_SHIFT             23
 #define REAL_HPAGE_SHIFT        22
+#define HPAGE_2GB_SHIFT         31
 #define HPAGE_256MB_SHIFT       28
 #define HPAGE_64K_SHIFT         16
 #define REAL_HPAGE_SIZE         (_AC(1,UL) << REAL_HPAGE_SHIFT)
@@ -27,7 +28,7 @@
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #define REAL_HPAGE_PER_HPAGE    (_AC(1,UL) << (HPAGE_SHIFT - REAL_HPAGE_SHIFT))
-#define HUGE_MAX_HSTATE         3
+#define HUGE_MAX_HSTATE         4
 #endif
 
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 8a598528ec1f..6fbd931f0570 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -679,26 +679,27 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
         return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_dirty(pte);
+        return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_young(pte);
+        return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_write(pte);
+        return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)
diff --git a/arch/sparc/include/asm/processor_32.h b/arch/sparc/include/asm/processor_32.h
index 365d4cb267b4..dd27159819eb 100644
--- a/arch/sparc/include/asm/processor_32.h
+++ b/arch/sparc/include/asm/processor_32.h
@@ -18,12 +18,6 @@
 #include <asm/signal.h>
 #include <asm/page.h>
 
-/*
- * The sparc has no problems with write protection
- */
-#define wp_works_ok 1
-#define wp_works_ok__is_a_macro /* for versions in ksyms.c */
-
 /* Whee, this is STACK_TOP + PAGE_SIZE and the lowest kernel address too...
  * That one page is used to protect kernel from intruders, so that
  * we can make our access_ok test faster
diff --git a/arch/sparc/include/asm/processor_64.h b/arch/sparc/include/asm/processor_64.h
index 6448cfc8292f..b58ee9018433 100644
--- a/arch/sparc/include/asm/processor_64.h
+++ b/arch/sparc/include/asm/processor_64.h
@@ -18,10 +18,6 @@
 #include <asm/ptrace.h>
 #include <asm/page.h>
 
-/* The sparc has no problems with write protection */
-#define wp_works_ok 1
-#define wp_works_ok__is_a_macro /* for versions in ksyms.c */
-
 /*
  * User lives in his very own context, and cannot reference us. Note
  * that TASK_SIZE is a misnomer, it really gives maximum user virtual
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 6aa3da152c20..44101196d02b 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -96,6 +96,7 @@ sparc64_boot:
         andn    %g1, PSTATE_AM, %g1
         wrpr    %g1, 0x0, %pstate
         ba,a,pt %xcc, 1f
+         nop
 
         .globl  prom_finddev_name, prom_chosen_path, prom_root_node
         .globl  prom_getprop_name, prom_mmu_name, prom_peer_name
@@ -613,6 +614,7 @@ niagara_tlb_fixup:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 niagara4_patch:
         call    niagara4_patch_copyops
          nop
@@ -622,6 +624,7 @@ niagara4_patch:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 
 niagara2_patch:
         call    niagara2_patch_copyops
@@ -632,6 +635,7 @@ niagara2_patch:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 
 niagara_patch:
         call    niagara_patch_copyops
diff --git a/arch/sparc/kernel/misctrap.S b/arch/sparc/kernel/misctrap.S
index 34b4933900bf..9276d2f0dd86 100644
--- a/arch/sparc/kernel/misctrap.S
+++ b/arch/sparc/kernel/misctrap.S
@@ -82,6 +82,7 @@ do_stdfmna:
         call            handle_stdfmna
          add            %sp, PTREGS_OFF, %o0
         ba,a,pt         %xcc, rtrap
+         nop
         .size           do_stdfmna,.-do_stdfmna
 
         .type           breakpoint_trap,#function
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index df9e731a76f5..fc5124ccdb53 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -351,7 +351,7 @@ static int genregs64_set(struct task_struct *target,
         }
 
         if (!ret) {
-                unsigned long y;
+                unsigned long y = regs->y;
 
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &y,
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index 216948ca4382..709a82ebd294 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -237,6 +237,7 @@ rt_continue:	ldx			[%sp + PTREGS_OFF + PT_V9_G1], %g1
                 bne,pt                  %xcc, user_rtt_fill_32bit
                  wrpr                   %g1, %cwp
                 ba,a,pt                 %xcc, user_rtt_fill_64bit
+                 nop
 
 user_rtt_fill_fixup_dax:
                 ba,pt   %xcc, user_rtt_fill_fixup_common
diff --git a/arch/sparc/kernel/spiterrs.S b/arch/sparc/kernel/spiterrs.S
index 4a73009f66a5..d7e540842809 100644
--- a/arch/sparc/kernel/spiterrs.S
+++ b/arch/sparc/kernel/spiterrs.S
@@ -86,6 +86,7 @@ __spitfire_cee_trap_continue:
          rd             %pc, %g7
 
         ba,a,pt         %xcc, 2f
+         nop
 
 1:      ba,pt           %xcc, etrap_irq
          rd             %pc, %g7
diff --git a/arch/sparc/kernel/sun4v_tlb_miss.S b/arch/sparc/kernel/sun4v_tlb_miss.S
index 6179e19bc9b9..c19f352f46c7 100644
--- a/arch/sparc/kernel/sun4v_tlb_miss.S
+++ b/arch/sparc/kernel/sun4v_tlb_miss.S
@@ -352,6 +352,7 @@ sun4v_mna:
         call    sun4v_do_mna
          add    %sp, PTREGS_OFF, %o0
         ba,a,pt %xcc, rtrap
+         nop
 
         /* Privileged Action.  */
 sun4v_privact:
diff --git a/arch/sparc/kernel/urtt_fill.S b/arch/sparc/kernel/urtt_fill.S
index 5604a2b051d4..364af3250646 100644
--- a/arch/sparc/kernel/urtt_fill.S
+++ b/arch/sparc/kernel/urtt_fill.S
@@ -92,6 +92,7 @@ user_rtt_fill_fixup_common:
                 call    sun4v_data_access_exception
                  nop
                 ba,a,pt %xcc, rtrap
+                 nop
 
 1:              call    spitfire_data_access_exception
                  nop
diff --git a/arch/sparc/kernel/winfixup.S b/arch/sparc/kernel/winfixup.S
index 855019a8590e..1ee173cc3c39 100644
--- a/arch/sparc/kernel/winfixup.S
+++ b/arch/sparc/kernel/winfixup.S
@@ -152,6 +152,8 @@ fill_fixup_dax:
         call    sun4v_data_access_exception
          nop
         ba,a,pt %xcc, rtrap
+         nop
 1:      call    spitfire_data_access_exception
          nop
         ba,a,pt %xcc, rtrap
+         nop
diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
index c629dbd121b6..64dcd6cdb606 100644
--- a/arch/sparc/lib/NG2memcpy.S
+++ b/arch/sparc/lib/NG2memcpy.S
@@ -326,11 +326,13 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         blu             170f
          nop
         ba,a,pt         %xcc, 180f
+         nop
 
 4:      /* 32 <= low bits < 48 */
         blu             150f
          nop
         ba,a,pt         %xcc, 160f
+         nop
 5:      /* 0 < low bits < 32 */
         blu,a           6f
          cmp            %g2, 8
@@ -338,6 +340,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         blu             130f
          nop
         ba,a,pt         %xcc, 140f
+         nop
 6:      /* 0 < low bits < 16 */
         bgeu            120f
          nop
@@ -475,6 +478,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         brz,pt          %o2, 85f
          sub            %o0, %o1, GLOBAL_SPARE
         ba,a,pt         %XCC, 90f
+         nop
 
         .align          64
 75: /* 16 < len <= 64 */
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 75bb93b1437f..78ea962edcbe 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -530,4 +530,5 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         bne,pt          %icc, 1b
          EX_ST(STORE(stb, %g1, %o0 - 0x01), NG4_retl_o2_plus_1)
         ba,a,pt         %icc, .Lexit
+         nop
         .size           FUNC_NAME, .-FUNC_NAME
diff --git a/arch/sparc/lib/NG4memset.S b/arch/sparc/lib/NG4memset.S
index 41da4bdd95cb..7c0c81f18837 100644
--- a/arch/sparc/lib/NG4memset.S
+++ b/arch/sparc/lib/NG4memset.S
@@ -102,4 +102,5 @@ NG4bzero:
         bne,pt          %icc, 1b
          add            %o0, 0x30, %o0
         ba,a,pt         %icc, .Lpostloop
+         nop
         .size           NG4bzero,.-NG4bzero
diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index d88c4ed50a00..cd654a719b27 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -394,6 +394,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         brz,pt          %i2, 85f
          sub            %o0, %i1, %i3
         ba,a,pt         %XCC, 90f
+         nop
 
         .align          64
 70: /* 16 < len <= 64 */
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 323bc6b6e3ad..7c29d38e6b99 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -143,6 +143,10 @@ static pte_t sun4v_hugepage_shift_to_tte(pte_t entry, unsigned int shift)
         pte_val(entry) = pte_val(entry) & ~_PAGE_SZALL_4V;
 
         switch (shift) {
+        case HPAGE_2GB_SHIFT:
+                hugepage_size = _PAGE_SZ2GB_4V;
+                pte_val(entry) |= _PAGE_PMD_HUGE;
+                break;
         case HPAGE_256MB_SHIFT:
                 hugepage_size = _PAGE_SZ256MB_4V;
                 pte_val(entry) |= _PAGE_PMD_HUGE;
@@ -183,6 +187,9 @@ static unsigned int sun4v_huge_tte_to_shift(pte_t entry)
         unsigned int shift;
 
         switch (tte_szbits) {
+        case _PAGE_SZ2GB_4V:
+                shift = HPAGE_2GB_SHIFT;
+                break;
         case _PAGE_SZ256MB_4V:
                 shift = HPAGE_256MB_SHIFT;
                 break;
@@ -261,7 +268,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                 if (!pmd)
                         return NULL;
 
-                if (sz == PMD_SHIFT)
+                if (sz >= PMD_SIZE)
                         pte = (pte_t *)pmd;
                 else
                         pte = pte_alloc_map(mm, pmd, addr);
@@ -454,6 +461,22 @@ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
         pgd_t *pgd;
         unsigned long next;
 
+        addr &= PMD_MASK;
+        if (addr < floor) {
+                addr += PMD_SIZE;
+                if (!addr)
+                        return;
+        }
+        if (ceiling) {
+                ceiling &= PMD_MASK;
+                if (!ceiling)
+                        return;
+        }
+        if (end - 1 > ceiling - 1)
+                end -= PMD_SIZE;
+        if (addr > end - 1)
+                return;
+
         pgd = pgd_offset(tlb->mm, addr);
         do {
                 next = pgd_addr_end(addr, end);
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index ccd455328989..0cda653ae007 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -337,6 +337,10 @@ static int __init setup_hugepagesz(char *string)
         hugepage_shift = ilog2(hugepage_size);
 
         switch (hugepage_shift) {
+        case HPAGE_2GB_SHIFT:
+                hv_pgsz_mask = HV_PGSZ_MASK_2GB;
+                hv_pgsz_idx = HV_PGSZ_IDX_2GB;
+                break;
         case HPAGE_256MB_SHIFT:
                 hv_pgsz_mask = HV_PGSZ_MASK_256MB;
                 hv_pgsz_idx = HV_PGSZ_IDX_256MB;
@@ -1563,7 +1567,7 @@ bool kern_addr_valid(unsigned long addr)
         if ((long)addr < 0L) {
                 unsigned long pa = __pa(addr);
 
-                if ((addr >> max_phys_bits) != 0UL)
+                if ((pa >> max_phys_bits) != 0UL)
                         return false;
 
                 return pfn_valid(pa >> PAGE_SHIFT);
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index def82f6d626f..8e76ebba2986 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -54,6 +54,7 @@
 enum mbus_module srmmu_modtype;
 static unsigned int hwbug_bitmask;
 int vac_cache_size;
+EXPORT_SYMBOL(vac_cache_size);
 int vac_line_size;
 
 extern struct resource sparc_iomap;
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index afda3bbf7854..ee8066c3d96c 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -154,7 +154,7 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
                 if (pte_val(*pte) & _PAGE_VALID) {
                         bool exec = pte_exec(*pte);
 
-                        tlb_batch_add_one(mm, vaddr, exec, false);
+                        tlb_batch_add_one(mm, vaddr, exec, PAGE_SHIFT);
                 }
                 pte++;
                 vaddr += PAGE_SIZE;
@@ -209,9 +209,9 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                         pte_t orig_pte = __pte(pmd_val(orig));
                         bool exec = pte_exec(orig_pte);
 
-                        tlb_batch_add_one(mm, addr, exec, true);
+                        tlb_batch_add_one(mm, addr, exec, REAL_HPAGE_SHIFT);
                         tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec,
-                                        true);
+                                          REAL_HPAGE_SHIFT);
                 } else {
                         tlb_batch_pmd_scan(mm, addr, orig);
                 }
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 0a04811f06b7..bedf08b22a47 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -122,7 +122,7 @@ void flush_tsb_user(struct tlb_batch *tb)
 
         spin_lock_irqsave(&mm->context.lock, flags);
 
-        if (tb->hugepage_shift < HPAGE_SHIFT) {
+        if (tb->hugepage_shift < REAL_HPAGE_SHIFT) {
                 base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
                 nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
                 if (tlb_type == cheetah_plus || tlb_type == hypervisor)
@@ -155,7 +155,7 @@ void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr,
 
         spin_lock_irqsave(&mm->context.lock, flags);
 
-        if (hugepage_shift < HPAGE_SHIFT) {
+        if (hugepage_shift < REAL_HPAGE_SHIFT) {
                 base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
                 nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
                 if (tlb_type == cheetah_plus || tlb_type == hypervisor)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 2d449337a360..a94a4d10f2df 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -120,10 +120,6 @@ else
         # -funit-at-a-time shrinks the kernel .text considerably
         # unfortunately it makes reading oopses harder.
         KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
-
-        # this works around some issues with generating unwind tables in older gccs
-        # newer gccs do it by default
-        KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args)
 endif
 
 ifdef CONFIG_X86_X32
@@ -147,6 +143,37 @@ ifeq ($(CONFIG_KMEMCHECK),y)
         KBUILD_CFLAGS += $(call cc-option,-fno-builtin-memcpy)
 endif
 
+#
+# If the function graph tracer is used with mcount instead of fentry,
+# '-maccumulate-outgoing-args' is needed to prevent a GCC bug
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109)
+#
+ifdef CONFIG_FUNCTION_GRAPH_TRACER
+  ifndef CONFIG_HAVE_FENTRY
+        ACCUMULATE_OUTGOING_ARGS := 1
+  else
+    ifeq ($(call cc-option-yn, -mfentry), n)
+        ACCUMULATE_OUTGOING_ARGS := 1
+    endif
+  endif
+endif
+
+#
+# Jump labels need '-maccumulate-outgoing-args' for gcc < 4.5.2 to prevent a
+# GCC bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=46226).  There's no way
+# to test for this bug at compile-time because the test case needs to execute,
+# which is a no-go for cross compilers.  So check the GCC version instead.
+#
+ifdef CONFIG_JUMP_LABEL
+  ifneq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        ACCUMULATE_OUTGOING_ARGS = $(call cc-if-fullversion, -lt, 040502, 1)
+  endif
+endif
+
+ifeq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        KBUILD_CFLAGS += -maccumulate-outgoing-args
+endif
+
 # Stackpointer is addressed different for 32 bit and 64 bit x86
 sp-$(CONFIG_X86_32) := esp
 sp-$(CONFIG_X86_64) := rsp
diff --git a/arch/x86/Makefile_32.cpu b/arch/x86/Makefile_32.cpu
index 6647ed49c66c..a45eb15b7cf2 100644
--- a/arch/x86/Makefile_32.cpu
+++ b/arch/x86/Makefile_32.cpu
@@ -45,24 +45,6 @@ cflags-$(CONFIG_MGEODE_LX)	+= $(call cc-option,-march=geode,-march=pentium-mmx)
 # cpu entries
 cflags-$(CONFIG_X86_GENERIC)    += $(call tune,generic,$(call tune,i686))
 
-# Work around the pentium-mmx code generator madness of gcc4.4.x which
-# does stack alignment by generating horrible code _before_ the mcount
-# prologue (push %ebp, mov %esp, %ebp) which breaks the function graph
-# tracer assumptions. For i686, generic, core2 this is set by the
-# compiler anyway
-ifeq ($(CONFIG_FUNCTION_GRAPH_TRACER), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-# Work around to a bug with asm goto with first implementations of it
-# in gcc causing gcc to mess up the push and pop of the stack in some
-# uses of asm goto.
-ifeq ($(CONFIG_JUMP_LABEL), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-cflags-$(ADD_ACCUMULATE_OUTGOING_ARGS) += $(call cc-option,-maccumulate-outgoing-args)
-
 # Bug fix for binutils: this option is required in order to keep
 # binutils from generating NOPL instructions against our will.
 ifneq ($(CONFIG_X86_P6_NOP),y)
diff --git a/arch/x86/boot/compressed/error.c b/arch/x86/boot/compressed/error.c
index 6248740b68b5..31922023de49 100644
--- a/arch/x86/boot/compressed/error.c
+++ b/arch/x86/boot/compressed/error.c
@@ -4,6 +4,7 @@
  * memcpy() and memmove() are defined for the compressed boot environment.
  */
 #include "misc.h"
+#include "error.h"
 
 void warn(char *m)
 {
diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
index 7853b53959cd..3f9d1a83891a 100644
--- a/arch/x86/entry/vdso/vdso32-setup.c
+++ b/arch/x86/entry/vdso/vdso32-setup.c
@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s)
 {
         vdso32_enabled = simple_strtoul(s, NULL, 0);
 
-        if (vdso32_enabled > 1)
+        if (vdso32_enabled > 1) {
                 pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
+                vdso32_enabled = 0;
+        }
 
         return 1;
 }
@@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup);
 /* Register vsyscall32 into the ABI table */
 #include <linux/sysctl.h>
 
+static const int zero;
+static const int one = 1;
+
 static struct ctl_table abi_table2[] = {
         {
                 .procname       = "vsyscall32",
                 .data           = &vdso32_enabled,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (int *)&zero,
+                .extra2         = (int *)&one,
         },
         {}
 };
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 2aa1ad194db2..580b60f5ac83 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2256,6 +2256,7 @@ void arch_perf_update_userpage(struct perf_event *event,
                                struct perf_event_mmap_page *userpg, u64 now)
 {
         struct cyc2ns_data *data;
+        u64 offset;
 
         userpg->cap_user_time = 0;
         userpg->cap_user_time_zero = 0;
@@ -2263,11 +2264,13 @@ void arch_perf_update_userpage(struct perf_event *event,
                 !!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED);
         userpg->pmc_width = x86_pmu.cntval_bits;
 
-        if (!sched_clock_stable())
+        if (!using_native_sched_clock() || !sched_clock_stable())
                 return;
 
         data = cyc2ns_read_begin();
 
+        offset = data->cyc2ns_offset + __sched_clock_offset;
+
         /*
          * Internal timekeeping for enabled/running/stopped times
          * is always in the local_clock domain.
@@ -2275,7 +2278,7 @@ void arch_perf_update_userpage(struct perf_event *event,
         userpg->cap_user_time = 1;
         userpg->time_mult = data->cyc2ns_mul;
         userpg->time_shift = data->cyc2ns_shift;
-        userpg->time_offset = data->cyc2ns_offset - now;
+        userpg->time_offset = offset - now;
 
         /*
          * cap_user_time_zero doesn't make sense when we're using a different
@@ -2283,7 +2286,7 @@ void arch_perf_update_userpage(struct perf_event *event,
          */
         if (!event->attr.use_clockid) {
                 userpg->cap_user_time_zero = 1;
-                userpg->time_zero = data->cyc2ns_offset;
+                userpg->time_zero = offset;
         }
 
         cyc2ns_read_end(data);
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index 81b321ace8e0..f924629836a8 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -507,6 +507,9 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
                 cpuc->lbr_entries[i].to         = msr_lastbranch.to;
                 cpuc->lbr_entries[i].mispred    = 0;
                 cpuc->lbr_entries[i].predicted  = 0;
+                cpuc->lbr_entries[i].in_tx      = 0;
+                cpuc->lbr_entries[i].abort      = 0;
+                cpuc->lbr_entries[i].cycles     = 0;
                 cpuc->lbr_entries[i].reserved   = 0;
         }
         cpuc->lbr_stack.nr = i;
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 9d49c18b5ea9..3762536619f8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -287,7 +287,7 @@ struct task_struct;
 
 #define ARCH_DLINFO_IA32                                                \
 do {                                                                    \
-        if (vdso32_enabled) {                                           \
+        if (VDSO_CURRENT_BASE) {                                        \
                 NEW_AUX_ENT(AT_SYSINFO, VDSO_ENTRY);                    \
                 NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);        \
         }                                                               \
diff --git a/arch/x86/include/asm/kvm_page_track.h b/arch/x86/include/asm/kvm_page_track.h
index d74747b031ec..c4eda791f877 100644
--- a/arch/x86/include/asm/kvm_page_track.h
+++ b/arch/x86/include/asm/kvm_page_track.h
@@ -46,6 +46,7 @@ struct kvm_page_track_notifier_node {
 };
 
 void kvm_page_track_init(struct kvm *kvm);
+void kvm_page_track_cleanup(struct kvm *kvm);
 
 void kvm_page_track_free_memslot(struct kvm_memory_slot *free,
                                  struct kvm_memory_slot *dont);
diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
index 2c1ebeb4d737..529bb4a6487a 100644
--- a/arch/x86/include/asm/pmem.h
+++ b/arch/x86/include/asm/pmem.h
@@ -55,7 +55,8 @@ static inline int arch_memcpy_from_pmem(void *dst, const void *src, size_t n)
  * @size:       number of bytes to write back
  *
  * Write back a cache range using the CLWB (cache line write back)
- * instruction.
+ * instruction. Note that @size is internally rounded up to be cache
+ * line size aligned.
  */
 static inline void arch_wb_cache_pmem(void *addr, size_t size)
 {
@@ -69,15 +70,6 @@ static inline void arch_wb_cache_pmem(void *addr, size_t size)
                 clwb(p);
 }
 
-/*
- * copy_from_iter_nocache() on x86 only uses non-temporal stores for iovec
- * iterators, so for other types (bvec & kvec) we must do a cache write-back.
- */
-static inline bool __iter_needs_pmem_wb(struct iov_iter *i)
-{
-        return iter_is_iovec(i) == false;
-}
-
 /**
  * arch_copy_from_iter_pmem - copy data from an iterator to PMEM
  * @addr:       PMEM destination address
@@ -94,7 +86,35 @@ static inline size_t arch_copy_from_iter_pmem(void *addr, size_t bytes,
         /* TODO: skip the write-back by always using non-temporal stores */
         len = copy_from_iter_nocache(addr, bytes, i);
 
-        if (__iter_needs_pmem_wb(i))
+        /*
+         * In the iovec case on x86_64 copy_from_iter_nocache() uses
+         * non-temporal stores for the bulk of the transfer, but we need
+         * to manually flush if the transfer is unaligned. A cached
+         * memory copy is used when destination or size is not naturally
+         * aligned. That is:
+         *   - Require 8-byte alignment when size is 8 bytes or larger.
+         *   - Require 4-byte alignment when size is 4 bytes.
+         *
+         * In the non-iovec case the entire destination needs to be
+         * flushed.
+         */
+        if (iter_is_iovec(i)) {
+                unsigned long flushed, dest = (unsigned long) addr;
+
+                if (bytes < 8) {
+                        if (!IS_ALIGNED(dest, 4) || (bytes != 4))
+                                arch_wb_cache_pmem(addr, 1);
+                } else {
+                        if (!IS_ALIGNED(dest, 8)) {
+                                dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
+                                arch_wb_cache_pmem(addr, 1);
+                        }
+
+                        flushed = dest - (unsigned long) addr;
+                        if (bytes > flushed && !IS_ALIGNED(bytes - flushed, 8))
+                                arch_wb_cache_pmem(addr + bytes - 1, 1);
+                }
+        } else
                 arch_wb_cache_pmem(addr, bytes);
 
         return len;
diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
index a04eabd43d06..27e9f9d769b8 100644
--- a/arch/x86/include/asm/timer.h
+++ b/arch/x86/include/asm/timer.h
@@ -12,6 +12,8 @@ extern int recalibrate_cpu_khz(void);
 
 extern int no_timer_check;
 
+extern bool using_native_sched_clock(void);
+
 /*
  * We use the full linear equation: f(x) = a + b*x, in order to allow
  * a continuous function in the face of dynamic freq changes.
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 72e8300b1e8a..9cffb44a3cf5 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -485,15 +485,17 @@ static inline unsigned long uv_soc_phys_ram_to_gpa(unsigned long paddr)
 
         if (paddr < uv_hub_info->lowmem_remap_top)
                 paddr |= uv_hub_info->lowmem_remap_base;
-        paddr |= uv_hub_info->gnode_upper;
-        if (m_val)
+
+        if (m_val) {
+                paddr |= uv_hub_info->gnode_upper;
                 paddr = ((paddr << uv_hub_info->m_shift)
                                                 >> uv_hub_info->m_shift) |
                         ((paddr >> uv_hub_info->m_val)
                                                 << uv_hub_info->n_lshift);
-        else
+        } else {
                 paddr |= uv_soc_phys_ram_to_nasid(paddr)
                                                 << uv_hub_info->gpa_shift;
+        }
         return paddr;
 }
 
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index e9f8f8cdd570..86f20cc0a65e 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1105,7 +1105,8 @@ void __init uv_init_hub_info(struct uv_hub_info_s *hi)
         node_id.v               = uv_read_local_mmr(UVH_NODE_ID);
         uv_cpuid.gnode_shift    = max_t(unsigned int, uv_cpuid.gnode_shift, mn.n_val);
         hi->gnode_extra         = (node_id.s.node_id & ~((1 << uv_cpuid.gnode_shift) - 1)) >> 1;
-        hi->gnode_upper         = (unsigned long)hi->gnode_extra << mn.m_val;
+        if (mn.m_val)
+                hi->gnode_upper = (u64)hi->gnode_extra << mn.m_val;
 
         if (uv_gp_table) {
                 hi->global_mmr_base     = uv_gp_table->mmr_base;
diff --git a/arch/x86/kernel/cpu/intel_rdt_schemata.c b/arch/x86/kernel/cpu/intel_rdt_schemata.c
index f369cb8db0d5..badd2b31a560 100644
--- a/arch/x86/kernel/cpu/intel_rdt_schemata.c
+++ b/arch/x86/kernel/cpu/intel_rdt_schemata.c
@@ -200,11 +200,11 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
         }
 
 out:
-        rdtgroup_kn_unlock(of->kn);
         for_each_enabled_rdt_resource(r) {
                 kfree(r->tmp_cbms);
                 r->tmp_cbms = NULL;
         }
+        rdtgroup_kn_unlock(of->kn);
         return ret ?: nbytes;
 }
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
index 1e5a50c11d3c..217cd4449bc9 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
@@ -85,7 +85,7 @@ void mce_gen_pool_process(struct work_struct *__unused)
         head = llist_reverse_order(head);
         llist_for_each_entry_safe(node, tmp, head, llnode) {
                 mce = &node->mce;
-                atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
+                blocking_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
                 gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node));
         }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index 903043e6a62b..19592ba1a320 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -13,7 +13,7 @@ enum severity_level {
         MCE_PANIC_SEVERITY,
 };
 
-extern struct atomic_notifier_head x86_mce_decoder_chain;
+extern struct blocking_notifier_head x86_mce_decoder_chain;
 
 #define ATTR_LEN                16
 #define INITIAL_CHECK_INTERVAL  5 * 60 /* 5 minutes */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8e9725c607ea..af44ebeb593f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -54,6 +54,8 @@
 
 static DEFINE_MUTEX(mce_chrdev_read_mutex);
 
+static int mce_chrdev_open_count;       /* #times opened */
+
 #define mce_log_get_idx_check(p) \
 ({ \
         RCU_LOCKDEP_WARN(!rcu_read_lock_sched_held() && \
@@ -121,7 +123,7 @@ static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
  * CPU/chipset specific EDAC code can register a notifier call here to print
  * MCE errors in a human-readable form.
  */
-ATOMIC_NOTIFIER_HEAD(x86_mce_decoder_chain);
+BLOCKING_NOTIFIER_HEAD(x86_mce_decoder_chain);
 
 /* Do initial initialization of a struct mce */
 void mce_setup(struct mce *m)
@@ -218,7 +220,7 @@ void mce_register_decode_chain(struct notifier_block *nb)
 
         WARN_ON(nb->priority > MCE_PRIO_LOWEST && nb->priority < MCE_PRIO_EDAC);
 
-        atomic_notifier_chain_register(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_register(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_register_decode_chain);
 
@@ -226,7 +228,7 @@ void mce_unregister_decode_chain(struct notifier_block *nb)
 {
         atomic_dec(&num_notifiers);
 
-        atomic_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_unregister_decode_chain);
 
@@ -319,18 +321,7 @@ static void __print_mce(struct mce *m)
 
 static void print_mce(struct mce *m)
 {
-        int ret = 0;
-
         __print_mce(m);
-
-        /*
-         * Print out human-readable details about the MCE error,
-         * (if the CPU has an implementation for that)
-         */
-        ret = atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, m);
-        if (ret == NOTIFY_STOP)
-                return;
-
         pr_emerg_ratelimited(HW_ERR "Run the above through 'mcelog --ascii'\n");
 }
 
@@ -598,6 +589,10 @@ static int mce_default_notifier(struct notifier_block *nb, unsigned long val,
         if (atomic_read(&num_notifiers) > 2)
                 return NOTIFY_DONE;
 
+        /* Don't print when mcelog is running */
+        if (mce_chrdev_open_count > 0)
+                return NOTIFY_DONE;
+
         __print_mce(m);
 
         return NOTIFY_DONE;
@@ -1828,7 +1823,6 @@ void mcheck_cpu_clear(struct cpuinfo_x86 *c)
  */
 
 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
-static int mce_chrdev_open_count;       /* #times opened */
 static int mce_chrdev_open_exclu;       /* already open exclusive? */
 
 static int mce_chrdev_open(struct inode *inode, struct file *file)
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 524cc5780a77..6e4a047e4b68 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -60,7 +60,7 @@ static const char * const th_names[] = {
         "load_store",
         "insn_fetch",
         "combined_unit",
-        "",
+        "decode_unit",
         "northbridge",
         "execution_unit",
 };
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 8f3d9cf26ff9..cbd73eb42170 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -29,6 +29,12 @@
 #include <asm/ftrace.h>
 #include <asm/nops.h>
 
+#if defined(CONFIG_FUNCTION_GRAPH_TRACER) && \
+        !defined(CC_USING_FENTRY) && \
+        !defined(CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE)
+# error The following combination is not supported: ((compiler missing -mfentry) || (CONFIG_X86_32 and !CONFIG_DYNAMIC_FTRACE)) && CONFIG_FUNCTION_GRAPH_TRACER && CONFIG_CC_OPTIMIZE_FOR_SIZE
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 int ftrace_arch_code_modify_prepare(void)
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 396c042e9d0e..cc30a74e4adb 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -846,7 +846,7 @@ void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
                        task_pid_nr(current) > 1 ? KERN_INFO : KERN_EMERG,
                        me->comm, me->pid, where, frame,
                        regs->ip, regs->sp, regs->orig_ax);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index ec1f756f9dc9..71beb28600d4 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -151,8 +151,8 @@ int __copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from,
 
                                 if (from->si_signo == SIGSEGV) {
                                         if (from->si_code == SEGV_BNDERR) {
-                                                compat_uptr_t lower = (unsigned long)&to->si_lower;
-                                                compat_uptr_t upper = (unsigned long)&to->si_upper;
+                                                compat_uptr_t lower = (unsigned long)from->si_lower;
+                                                compat_uptr_t upper = (unsigned long)from->si_upper;
                                                 put_user_ex(lower, &to->si_lower);
                                                 put_user_ex(upper, &to->si_upper);
                                         }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 948443e115c1..4e496379a871 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -255,7 +255,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
                 pr_info("%s[%d] trap %s ip:%lx sp:%lx error:%lx",
                         tsk->comm, tsk->pid, str,
                         regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
@@ -519,7 +519,7 @@ do_general_protection(struct pt_regs *regs, long error_code)
                 pr_info("%s[%d] general protection ip:%lx sp:%lx error:%lx",
                         tsk->comm, task_pid_nr(tsk),
                         regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index c73a7f9e881a..714dfba6a1e7 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -328,7 +328,7 @@ unsigned long long sched_clock(void)
         return paravirt_sched_clock();
 }
 
-static inline bool using_native_sched_clock(void)
+bool using_native_sched_clock(void)
 {
         return pv_time_ops.sched_clock == native_sched_clock;
 }
@@ -336,7 +336,7 @@ static inline bool using_native_sched_clock(void)
 unsigned long long
 sched_clock(void) __attribute__((alias("native_sched_clock")));
 
-static inline bool using_native_sched_clock(void) { return true; }
+bool using_native_sched_clock(void) { return true; }
 #endif
 
 int check_tsc_unstable(void)
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 73ea24d4f119..047b17a26269 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -657,6 +657,9 @@ void kvm_pic_destroy(struct kvm *kvm)
 {
         struct kvm_pic *vpic = kvm->arch.vpic;
 
+        if (!vpic)
+                return;
+
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_master);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_slave);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_eclr);
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 6e219e5c07d2..289270a6aecb 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -635,6 +635,9 @@ void kvm_ioapic_destroy(struct kvm *kvm)
 {
         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
 
+        if (!ioapic)
+                return;
+
         cancel_delayed_work_sync(&ioapic->eoi_inject);
         kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
         kvm->arch.vioapic = NULL;
diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c
index 37942e419c32..60168cdd0546 100644
--- a/arch/x86/kvm/page_track.c
+++ b/arch/x86/kvm/page_track.c
@@ -160,6 +160,14 @@ bool kvm_page_track_is_active(struct kvm_vcpu *vcpu, gfn_t gfn,
         return !!ACCESS_ONCE(slot->arch.gfn_track[mode][index]);
 }
 
+void kvm_page_track_cleanup(struct kvm *kvm)
+{
+        struct kvm_page_track_notifier_head *head;
+
+        head = &kvm->arch.track_notifier_head;
+        cleanup_srcu_struct(&head->track_srcu);
+}
+
 void kvm_page_track_init(struct kvm *kvm)
 {
         struct kvm_page_track_notifier_head *head;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d1efe2c62b3f..5fba70646c32 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1379,6 +1379,9 @@ static void avic_vm_destroy(struct kvm *kvm)
         unsigned long flags;
         struct kvm_arch *vm_data = &kvm->arch;
 
+        if (!avic)
+                return;
+
         avic_free_vm_id(vm_data->avic_vm_id);
 
         if (vm_data->avic_logical_id_table_page)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 98e82ee1e699..259e9b28ccf8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1239,6 +1239,11 @@ static inline bool cpu_has_vmx_invvpid_global(void)
         return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
 }
 
+static inline bool cpu_has_vmx_invvpid(void)
+{
+        return vmx_capability.vpid & VMX_VPID_INVVPID_BIT;
+}
+
 static inline bool cpu_has_vmx_ept(void)
 {
         return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -2753,7 +2758,6 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
                 SECONDARY_EXEC_RDTSCP |
                 SECONDARY_EXEC_DESC |
                 SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
-                SECONDARY_EXEC_ENABLE_VPID |
                 SECONDARY_EXEC_APIC_REGISTER_VIRT |
                 SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
                 SECONDARY_EXEC_WBINVD_EXITING |
@@ -2781,10 +2785,12 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
          * though it is treated as global context.  The alternative is
          * not failing the single-context invvpid, and it is worse.
          */
-        if (enable_vpid)
+        if (enable_vpid) {
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_ENABLE_VPID;
                 vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT |
                         VMX_VPID_EXTENT_SUPPORTED_MASK;
-        else
+        } else
                 vmx->nested.nested_vmx_vpid_caps = 0;
 
         if (enable_unrestricted_guest)
@@ -4024,6 +4030,12 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
         __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid);
 }
 
+static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu)
+{
+        if (enable_ept)
+                vmx_flush_tlb(vcpu);
+}
+
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
         ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -6517,8 +6529,10 @@ static __init int hardware_setup(void)
         if (boot_cpu_has(X86_FEATURE_NX))
                 kvm_enable_efer_bits(EFER_NX);
 
-        if (!cpu_has_vmx_vpid())
+        if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
+                !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
                 enable_vpid = 0;
+
         if (!cpu_has_vmx_shadow_vmcs())
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs)
@@ -8184,6 +8198,9 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
         case EXIT_REASON_PREEMPTION_TIMER:
                 return false;
+        case EXIT_REASON_PML_FULL:
+                /* We don't expose PML support to L1. */
+                return false;
         default:
                 return true;
         }
@@ -8501,7 +8518,8 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
             && kvm_vmx_exit_handlers[exit_reason])
                 return kvm_vmx_exit_handlers[exit_reason](vcpu);
         else {
-                WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason);
+                vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
+                                exit_reason);
                 kvm_queue_exception(vcpu, UD_VECTOR);
                 return 1;
         }
@@ -8547,6 +8565,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
         } else {
                 sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
                 sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+                vmx_flush_tlb_ept_only(vcpu);
         }
         vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
 
@@ -8572,8 +8591,10 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
          */
         if (!is_guest_mode(vcpu) ||
             !nested_cpu_has2(get_vmcs12(&vmx->vcpu),
-                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
                 vmcs_write64(APIC_ACCESS_ADDR, hpa);
+                vmx_flush_tlb_ept_only(vcpu);
+        }
 }
 
 static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
@@ -9974,7 +9995,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control;
-        bool nested_ept_enabled = false;
 
         vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
         vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
@@ -10121,8 +10141,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                                 vmcs12->guest_intr_status);
                 }
 
-                nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
-
                 /*
                  * Write an illegal value to APIC_ACCESS_ADDR. Later,
                  * nested_get_vmcs12_pages will either fix it up or
@@ -10252,9 +10270,24 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 
         }
 
+        if (enable_pml) {
+                /*
+                 * Conceptually we want to copy the PML address and index from
+                 * vmcs01 here, and then back to vmcs01 on nested vmexit. But,
+                 * since we always flush the log on each vmexit, this happens
+                 * to be equivalent to simply resetting the fields in vmcs02.
+                 */
+                ASSERT(vmx->pml_pg);
+                vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+                vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+        }
+
         if (nested_cpu_has_ept(vmcs12)) {
                 kvm_mmu_unload(vcpu);
                 nested_ept_init_mmu_context(vcpu);
+        } else if (nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /*
@@ -10282,12 +10315,10 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         vmx_set_efer(vcpu, vcpu->arch.efer);
 
         /* Shadow page tables on either EPT or shadow page tables. */
-        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_ept_enabled,
+        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
                                 entry_failure_code))
                 return 1;
 
-        kvm_mmu_reset_context(vcpu);
-
         if (!enable_ept)
                 vcpu->arch.walk_mmu->inject_page_fault = vmx_inject_page_fault_nested;
 
@@ -11056,6 +11087,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
                 vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
                 vmx_set_virtual_x2apic_mode(vcpu,
                                 vcpu->arch.apic_base & X2APIC_ENABLE);
+        } else if (!nested_cpu_has_ept(vmcs12) &&
+                   nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1faf620a6fdc..ccbd45ecd41a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8153,11 +8153,12 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
         if (kvm_x86_ops->vm_destroy)
                 kvm_x86_ops->vm_destroy(kvm);
         kvm_iommu_unmap_guest(kvm);
-        kfree(kvm->arch.vpic);
-        kfree(kvm->arch.vioapic);
+        kvm_pic_destroy(kvm);
+        kvm_ioapic_destroy(kvm);
         kvm_free_vcpus(kvm);
         kvfree(rcu_dereference_check(kvm->arch.apic_map, 1));
         kvm_mmu_uninit_vm(kvm);
+        kvm_page_track_cleanup(kvm);
 }
 
 void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
@@ -8566,11 +8567,11 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
 {
         struct x86_exception fault;
 
-        trace_kvm_async_pf_ready(work->arch.token, work->gva);
         if (work->wakeup_all)
                 work->arch.token = ~0; /* broadcast wakeup */
         else
                 kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
+        trace_kvm_async_pf_ready(work->arch.token, work->gva);
 
         if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) &&
             !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 779782f58324..9a53a06e5a3e 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -290,7 +290,7 @@ EXPORT_SYMBOL_GPL(memcpy_mcsafe_unrolled)
         _ASM_EXTABLE_FAULT(.L_copy_leading_bytes, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w0, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w1, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
+        _ASM_EXTABLE_FAULT(.L_cache_w2, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w4, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w5, .L_memcpy_mcsafe_fail)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 22af912d66d2..889e7619a091 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -643,21 +643,40 @@ void __init init_mem_mapping(void)
  * devmem_is_allowed() checks to see if /dev/mem access to a certain address
  * is valid. The argument is a physical page number.
  *
- *
- * On x86, access has to be given to the first megabyte of ram because that area
- * contains BIOS code and data regions used by X and dosemu and similar apps.
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
+ * On x86, access has to be given to the first megabyte of RAM because that
+ * area traditionally contains BIOS code and data regions used by X, dosemu,
+ * and similar apps. Since they map the entire memory range, the whole range
+ * must be allowed (for mapping), but any areas that would otherwise be
+ * disallowed are flagged as being "zero filled" instead of rejected.
+ * Access has to be given to non-kernel-ram areas as well, these contain the
+ * PCI mmio resources as well as potential bios/acpi data regions.
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-        if (pagenr < 256)
-                return 1;
-        if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+        if (page_is_ram(pagenr)) {
+                /*
+                 * For disallowed memory regions in the low 1MB range,
+                 * request that the page be shown as all zeros.
+                 */
+                if (pagenr < 256)
+                        return 2;
+
+                return 0;
+        }
+
+        /*
+         * This must follow RAM test, since System RAM is considered a
+         * restricted resource under CONFIG_STRICT_IOMEM.
+         */
+        if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
+                /* Low 1MB bypasses iomem restrictions. */
+                if (pagenr < 256)
+                        return 1;
+
                 return 0;
-        if (!page_is_ram(pagenr))
-                return 1;
-        return 0;
+        }
+
+        return 1;
 }
 
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 887e57182716..aed206475aa7 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -48,7 +48,7 @@ static const unsigned long vaddr_start = __PAGE_OFFSET_BASE;
 #if defined(CONFIG_X86_ESPFIX64)
 static const unsigned long vaddr_end = ESPFIX_BASE_ADDR;
 #elif defined(CONFIG_EFI)
-static const unsigned long vaddr_end = EFI_VA_START;
+static const unsigned long vaddr_end = EFI_VA_END;
 #else
 static const unsigned long vaddr_end = __START_KERNEL_map;
 #endif
@@ -105,7 +105,7 @@ void __init kernel_randomize_memory(void)
          */
         BUILD_BUG_ON(vaddr_start >= vaddr_end);
         BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) &&
-                     vaddr_end >= EFI_VA_START);
+                     vaddr_end >= EFI_VA_END);
         BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) ||
                       IS_ENABLED(CONFIG_EFI)) &&
                      vaddr_end >= __START_KERNEL_map);
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 30031d5293c4..cdfe8c628959 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -201,6 +201,10 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
                 return;
         }
 
+        /* No need to reserve regions that will never be freed. */
+        if (md.attribute & EFI_MEMORY_RUNTIME)
+                return;
+
         size += addr % EFI_PAGE_SIZE;
         size = round_up(size, EFI_PAGE_SIZE);
         addr = round_down(addr, EFI_PAGE_SIZE);
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 555b9fa0ad43..7dbdb780264d 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -8,6 +8,7 @@ PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
 LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib
 targets += purgatory.ro
 
+KASAN_SANITIZE  := n
 KCOV_INSTRUMENT := n
 
 # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
diff --git a/arch/xtensa/include/asm/page.h b/arch/xtensa/include/asm/page.h
index 976b1d70edbc..4ddbfd57a7c8 100644
--- a/arch/xtensa/include/asm/page.h
+++ b/arch/xtensa/include/asm/page.h
@@ -164,8 +164,21 @@ void copy_user_highpage(struct page *to, struct page *from,
 
 #define ARCH_PFN_OFFSET         (PHYS_OFFSET >> PAGE_SHIFT)
 
+#ifdef CONFIG_MMU
+static inline unsigned long ___pa(unsigned long va)
+{
+        unsigned long off = va - PAGE_OFFSET;
+
+        if (off >= XCHAL_KSEG_SIZE)
+                off -= XCHAL_KSEG_SIZE;
+
+        return off + PHYS_OFFSET;
+}
+#define __pa(x) ___pa((unsigned long)(x))
+#else
 #define __pa(x) \
         ((unsigned long) (x) - PAGE_OFFSET + PHYS_OFFSET)
+#endif
 #define __va(x) \
         ((void *)((unsigned long) (x) - PHYS_OFFSET + PAGE_OFFSET))
 #define pfn_valid(pfn) \
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index cd400af4a6b2..6be7eb27fd29 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -774,7 +774,10 @@ __SYSCALL(349, sys_pkey_alloc, 2)
 #define __NR_pkey_free                          350
 __SYSCALL(350, sys_pkey_free, 1)
 
-#define __NR_syscall_count                      351
+#define __NR_statx                              351
+__SYSCALL(351, sys_statx, 5)
+
+#define __NR_syscall_count                      352
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index c82c43bff296..bae697a06a98 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -483,10 +483,8 @@ void show_regs(struct pt_regs * regs)
 
 static int show_trace_cb(struct stackframe *frame, void *data)
 {
-        if (kernel_text_address(frame->pc)) {
-                pr_cont(" [<%08lx>]", frame->pc);
-                print_symbol(" %s\n", frame->pc);
-        }
+        if (kernel_text_address(frame->pc))
+                pr_cont(" [<%08lx>] %pB\n", frame->pc, (void *)frame->pc);
         return 0;
 }
 
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 09af8ff18719..c974a1bbf4cb 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -171,7 +171,8 @@ void blk_mq_sched_put_request(struct request *rq)
 
 void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
 {
-        struct elevator_queue *e = hctx->queue->elevator;
+        struct request_queue *q = hctx->queue;
+        struct elevator_queue *e = q->elevator;
         const bool has_sched_dispatch = e && e->type->ops.mq.dispatch_request;
         bool did_work = false;
         LIST_HEAD(rq_list);
@@ -203,10 +204,10 @@ void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
          */
         if (!list_empty(&rq_list)) {
                 blk_mq_sched_mark_restart_hctx(hctx);
-                did_work = blk_mq_dispatch_rq_list(hctx, &rq_list);
+                did_work = blk_mq_dispatch_rq_list(q, &rq_list);
         } else if (!has_sched_dispatch) {
                 blk_mq_flush_busy_ctxs(hctx, &rq_list);
-                blk_mq_dispatch_rq_list(hctx, &rq_list);
+                blk_mq_dispatch_rq_list(q, &rq_list);
         }
 
         /*
@@ -222,7 +223,7 @@ void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
                         if (!rq)
                                 break;
                         list_add(&rq->queuelist, &rq_list);
-                } while (blk_mq_dispatch_rq_list(hctx, &rq_list));
+                } while (blk_mq_dispatch_rq_list(q, &rq_list));
         }
 }
 
@@ -317,25 +318,68 @@ static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx,
         return true;
 }
 
-static void blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
+static bool blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
 {
         if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state)) {
                 clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-                if (blk_mq_hctx_has_pending(hctx))
+                if (blk_mq_hctx_has_pending(hctx)) {
                         blk_mq_run_hw_queue(hctx, true);
+                        return true;
+                }
         }
+        return false;
 }
 
-void blk_mq_sched_restart_queues(struct blk_mq_hw_ctx *hctx)
-{
-        struct request_queue *q = hctx->queue;
-        unsigned int i;
+/**
+ * list_for_each_entry_rcu_rr - iterate in a round-robin fashion over rcu list
+ * @pos:    loop cursor.
+ * @skip:   the list element that will not be examined. Iteration starts at
+ *          @skip->next.
+ * @head:   head of the list to examine. This list must have at least one
+ *          element, namely @skip.
+ * @member: name of the list_head structure within typeof(*pos).
+ */
+#define list_for_each_entry_rcu_rr(pos, skip, head, member)             \
+        for ((pos) = (skip);                                            \
+             (pos = (pos)->member.next != (head) ? list_entry_rcu(      \
+                        (pos)->member.next, typeof(*pos), member) :     \
+              list_entry_rcu((pos)->member.next->next, typeof(*pos), member)), \
+             (pos) != (skip); )
 
-        if (test_bit(QUEUE_FLAG_RESTART, &q->queue_flags)) {
-                if (test_and_clear_bit(QUEUE_FLAG_RESTART, &q->queue_flags)) {
-                        queue_for_each_hw_ctx(q, hctx, i)
-                                blk_mq_sched_restart_hctx(hctx);
+/*
+ * Called after a driver tag has been freed to check whether a hctx needs to
+ * be restarted. Restarts @hctx if its tag set is not shared. Restarts hardware
+ * queues in a round-robin fashion if the tag set of @hctx is shared with other
+ * hardware queues.
+ */
+void blk_mq_sched_restart(struct blk_mq_hw_ctx *const hctx)
+{
+        struct blk_mq_tags *const tags = hctx->tags;
+        struct blk_mq_tag_set *const set = hctx->queue->tag_set;
+        struct request_queue *const queue = hctx->queue, *q;
+        struct blk_mq_hw_ctx *hctx2;
+        unsigned int i, j;
+
+        if (set->flags & BLK_MQ_F_TAG_SHARED) {
+                rcu_read_lock();
+                list_for_each_entry_rcu_rr(q, queue, &set->tag_list,
+                                           tag_set_list) {
+                        queue_for_each_hw_ctx(q, hctx2, i)
+                                if (hctx2->tags == tags &&
+                                    blk_mq_sched_restart_hctx(hctx2))
+                                        goto done;
+                }
+                j = hctx->queue_num + 1;
+                for (i = 0; i < queue->nr_hw_queues; i++, j++) {
+                        if (j == queue->nr_hw_queues)
+                                j = 0;
+                        hctx2 = queue->queue_hw_ctx[j];
+                        if (hctx2->tags == tags &&
+                            blk_mq_sched_restart_hctx(hctx2))
+                                break;
                 }
+done:
+                rcu_read_unlock();
         } else {
                 blk_mq_sched_restart_hctx(hctx);
         }
@@ -431,11 +475,67 @@ static void blk_mq_sched_free_tags(struct blk_mq_tag_set *set,
         }
 }
 
-int blk_mq_sched_setup(struct request_queue *q)
+static int blk_mq_sched_alloc_tags(struct request_queue *q,
+                                   struct blk_mq_hw_ctx *hctx,
+                                   unsigned int hctx_idx)
+{
+        struct blk_mq_tag_set *set = q->tag_set;
+        int ret;
+
+        hctx->sched_tags = blk_mq_alloc_rq_map(set, hctx_idx, q->nr_requests,
+                                               set->reserved_tags);
+        if (!hctx->sched_tags)
+                return -ENOMEM;
+
+        ret = blk_mq_alloc_rqs(set, hctx->sched_tags, hctx_idx, q->nr_requests);
+        if (ret)
+                blk_mq_sched_free_tags(set, hctx, hctx_idx);
+
+        return ret;
+}
+
+static void blk_mq_sched_tags_teardown(struct request_queue *q)
 {
         struct blk_mq_tag_set *set = q->tag_set;
         struct blk_mq_hw_ctx *hctx;
-        int ret, i;
+        int i;
+
+        queue_for_each_hw_ctx(q, hctx, i)
+                blk_mq_sched_free_tags(set, hctx, i);
+}
+
+int blk_mq_sched_init_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                           unsigned int hctx_idx)
+{
+        struct elevator_queue *e = q->elevator;
+
+        if (!e)
+                return 0;
+
+        return blk_mq_sched_alloc_tags(q, hctx, hctx_idx);
+}
+
+void blk_mq_sched_exit_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                            unsigned int hctx_idx)
+{
+        struct elevator_queue *e = q->elevator;
+
+        if (!e)
+                return;
+
+        blk_mq_sched_free_tags(q->tag_set, hctx, hctx_idx);
+}
+
+int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e)
+{
+        struct blk_mq_hw_ctx *hctx;
+        unsigned int i;
+        int ret;
+
+        if (!e) {
+                q->elevator = NULL;
+                return 0;
+        }
 
         /*
          * Default to 256, since we don't split into sync/async like the
@@ -443,49 +543,30 @@ int blk_mq_sched_setup(struct request_queue *q)
          */
         q->nr_requests = 2 * BLKDEV_MAX_RQ;
 
-        /*
-         * We're switching to using an IO scheduler, so setup the hctx
-         * scheduler tags and switch the request map from the regular
-         * tags to scheduler tags. First allocate what we need, so we
-         * can safely fail and fallback, if needed.
-         */
-        ret = 0;
         queue_for_each_hw_ctx(q, hctx, i) {
-                hctx->sched_tags = blk_mq_alloc_rq_map(set, i,
-                                q->nr_requests, set->reserved_tags);
-                if (!hctx->sched_tags) {
-                        ret = -ENOMEM;
-                        break;
-                }
-                ret = blk_mq_alloc_rqs(set, hctx->sched_tags, i, q->nr_requests);
+                ret = blk_mq_sched_alloc_tags(q, hctx, i);
                 if (ret)
-                        break;
+                        goto err;
         }
 
-        /*
-         * If we failed, free what we did allocate
-         */
-        if (ret) {
-                queue_for_each_hw_ctx(q, hctx, i) {
-                        if (!hctx->sched_tags)
-                                continue;
-                        blk_mq_sched_free_tags(set, hctx, i);
-                }
-
-                return ret;
-        }
+        ret = e->ops.mq.init_sched(q, e);
+        if (ret)
+                goto err;
 
         return 0;
+
+err:
+        blk_mq_sched_tags_teardown(q);
+        q->elevator = NULL;
+        return ret;
 }
 
-void blk_mq_sched_teardown(struct request_queue *q)
+void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e)
 {
-        struct blk_mq_tag_set *set = q->tag_set;
-        struct blk_mq_hw_ctx *hctx;
-        int i;
-
-        queue_for_each_hw_ctx(q, hctx, i)
-                blk_mq_sched_free_tags(set, hctx, i);
+        if (e->type->ops.mq.exit_sched)
+                e->type->ops.mq.exit_sched(e);
+        blk_mq_sched_tags_teardown(q);
+        q->elevator = NULL;
 }
 
 int blk_mq_sched_init(struct request_queue *q)
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index a75b16b123f7..3a9e6e40558b 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -19,7 +19,7 @@ bool blk_mq_sched_try_merge(struct request_queue *q, struct bio *bio,
                                 struct request **merged_request);
 bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio);
 bool blk_mq_sched_try_insert_merge(struct request_queue *q, struct request *rq);
-void blk_mq_sched_restart_queues(struct blk_mq_hw_ctx *hctx);
+void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx);
 
 void blk_mq_sched_insert_request(struct request *rq, bool at_head,
                                  bool run_queue, bool async, bool can_block);
@@ -32,8 +32,13 @@ void blk_mq_sched_move_to_dispatch(struct blk_mq_hw_ctx *hctx,
                         struct list_head *rq_list,
                         struct request *(*get_rq)(struct blk_mq_hw_ctx *));
 
-int blk_mq_sched_setup(struct request_queue *q);
-void blk_mq_sched_teardown(struct request_queue *q);
+int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e);
+void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e);
+
+int blk_mq_sched_init_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                           unsigned int hctx_idx);
+void blk_mq_sched_exit_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                            unsigned int hctx_idx);
 
 int blk_mq_sched_init(struct request_queue *q);
 
@@ -131,20 +136,6 @@ static inline void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
                 set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
 }
 
-/*
- * Mark a hardware queue and the request queue it belongs to as needing a
- * restart.
- */
-static inline void blk_mq_sched_mark_restart_queue(struct blk_mq_hw_ctx *hctx)
-{
-        struct request_queue *q = hctx->queue;
-
-        if (!test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
-                set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-        if (!test_bit(QUEUE_FLAG_RESTART, &q->queue_flags))
-                set_bit(QUEUE_FLAG_RESTART, &q->queue_flags);
-}
-
 static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
 {
         return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a4546f060e80..c7836a1ded97 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -321,7 +321,6 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, int rw,
 
         rq = blk_mq_sched_get_request(q, NULL, rw, &alloc_data);
 
-        blk_mq_put_ctx(alloc_data.ctx);
         blk_queue_exit(q);
 
         if (!rq)
@@ -349,7 +348,7 @@ void __blk_mq_finish_request(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
                 blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag);
         if (sched_tag != -1)
                 blk_mq_sched_completed_request(hctx, rq);
-        blk_mq_sched_restart_queues(hctx);
+        blk_mq_sched_restart(hctx);
         blk_queue_exit(q);
 }
 
@@ -697,17 +696,8 @@ static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_timeout_data *data = priv;
 
-        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) {
-                /*
-                 * If a request wasn't started before the queue was
-                 * marked dying, kill it here or it'll go unnoticed.
-                 */
-                if (unlikely(blk_queue_dying(rq->q))) {
-                        rq->errors = -EIO;
-                        blk_mq_end_request(rq, rq->errors);
-                }
+        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags))
                 return;
-        }
 
         if (time_after_eq(jiffies, rq->deadline)) {
                 if (!blk_mark_rq_complete(rq))
@@ -855,12 +845,8 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
                 .flags = wait ? 0 : BLK_MQ_REQ_NOWAIT,
         };
 
-        if (rq->tag != -1) {
-done:
-                if (hctx)
-                        *hctx = data.hctx;
-                return true;
-        }
+        if (rq->tag != -1)
+                goto done;
 
         if (blk_mq_tag_is_reserved(data.hctx->sched_tags, rq->internal_tag))
                 data.flags |= BLK_MQ_REQ_RESERVED;
@@ -872,10 +858,12 @@ done:
                         atomic_inc(&data.hctx->nr_active);
                 }
                 data.hctx->tags->rqs[rq->tag] = rq;
-                goto done;
         }
 
-        return false;
+done:
+        if (hctx)
+                *hctx = data.hctx;
+        return rq->tag != -1;
 }
 
 static void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx,
@@ -972,13 +960,16 @@ static bool blk_mq_dispatch_wait_add(struct blk_mq_hw_ctx *hctx)
         return true;
 }
 
-bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
+bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list)
 {
-        struct request_queue *q = hctx->queue;
+        struct blk_mq_hw_ctx *hctx;
         struct request *rq;
         LIST_HEAD(driver_list);
         struct list_head *dptr;
-        int queued, ret = BLK_MQ_RQ_QUEUE_OK;
+        int errors, queued, ret = BLK_MQ_RQ_QUEUE_OK;
+
+        if (list_empty(list))
+                return false;
 
         /*
          * Start off with dptr being NULL, so we start the first request
@@ -989,8 +980,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
         /*
          * Now process all the entries, sending them to the driver.
          */
-        queued = 0;
-        while (!list_empty(list)) {
+        errors = queued = 0;
+        do {
                 struct blk_mq_queue_data bd;
 
                 rq = list_first_entry(list, struct request, queuelist);
@@ -1046,6 +1037,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                 default:
                         pr_err("blk-mq: bad return on queue: %d\n", ret);
                 case BLK_MQ_RQ_QUEUE_ERROR:
+                        errors++;
                         rq->errors = -EIO;
                         blk_mq_end_request(rq, rq->errors);
                         break;
@@ -1060,7 +1052,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                  */
                 if (!dptr && list->next != list->prev)
                         dptr = &driver_list;
-        }
+        } while (!list_empty(list));
 
         hctx->dispatched[queued_to_index(queued)]++;
 
@@ -1097,7 +1089,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                         blk_mq_run_hw_queue(hctx, true);
         }
 
-        return queued != 0;
+        return (queued + errors) != 0;
 }
 
 static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
@@ -1143,7 +1135,8 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)
         return hctx->next_cpu;
 }
 
-void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
+static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async,
+                                        unsigned long msecs)
 {
         if (unlikely(blk_mq_hctx_stopped(hctx) ||
                      !blk_mq_hw_queue_mapped(hctx)))
@@ -1160,7 +1153,24 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
                 put_cpu();
         }
 
-        kblockd_schedule_work_on(blk_mq_hctx_next_cpu(hctx), &hctx->run_work);
+        if (msecs == 0)
+                kblockd_schedule_work_on(blk_mq_hctx_next_cpu(hctx),
+                                         &hctx->run_work);
+        else
+                kblockd_schedule_delayed_work_on(blk_mq_hctx_next_cpu(hctx),
+                                                 &hctx->delayed_run_work,
+                                                 msecs_to_jiffies(msecs));
+}
+
+void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs)
+{
+        __blk_mq_delay_run_hw_queue(hctx, true, msecs);
+}
+EXPORT_SYMBOL(blk_mq_delay_run_hw_queue);
+
+void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
+{
+        __blk_mq_delay_run_hw_queue(hctx, async, 0);
 }
 
 void blk_mq_run_hw_queues(struct request_queue *q, bool async)
@@ -1263,6 +1273,15 @@ static void blk_mq_run_work_fn(struct work_struct *work)
         __blk_mq_run_hw_queue(hctx);
 }
 
+static void blk_mq_delayed_run_work_fn(struct work_struct *work)
+{
+        struct blk_mq_hw_ctx *hctx;
+
+        hctx = container_of(work, struct blk_mq_hw_ctx, delayed_run_work.work);
+
+        __blk_mq_run_hw_queue(hctx);
+}
+
 static void blk_mq_delay_work_fn(struct work_struct *work)
 {
         struct blk_mq_hw_ctx *hctx;
@@ -1932,6 +1951,8 @@ static void blk_mq_exit_hctx(struct request_queue *q,
                                        hctx->fq->flush_rq, hctx_idx,
                                        flush_start_tag + hctx_idx);
 
+        blk_mq_sched_exit_hctx(q, hctx, hctx_idx);
+
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
 
@@ -1968,6 +1989,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
                 node = hctx->numa_node = set->numa_node;
 
         INIT_WORK(&hctx->run_work, blk_mq_run_work_fn);
+        INIT_DELAYED_WORK(&hctx->delayed_run_work, blk_mq_delayed_run_work_fn);
         INIT_DELAYED_WORK(&hctx->delay_work, blk_mq_delay_work_fn);
         spin_lock_init(&hctx->lock);
         INIT_LIST_HEAD(&hctx->dispatch);
@@ -1998,9 +2020,12 @@ static int blk_mq_init_hctx(struct request_queue *q,
             set->ops->init_hctx(hctx, set->driver_data, hctx_idx))
                 goto free_bitmap;
 
+        if (blk_mq_sched_init_hctx(q, hctx, hctx_idx))
+                goto exit_hctx;
+
         hctx->fq = blk_alloc_flush_queue(q, hctx->numa_node, set->cmd_size);
         if (!hctx->fq)
-                goto exit_hctx;
+                goto sched_exit_hctx;
 
         if (set->ops->init_request &&
             set->ops->init_request(set->driver_data,
@@ -2015,6 +2040,8 @@ static int blk_mq_init_hctx(struct request_queue *q,
 
  free_fq:
         kfree(hctx->fq);
+ sched_exit_hctx:
+        blk_mq_sched_exit_hctx(q, hctx, hctx_idx);
  exit_hctx:
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
@@ -2241,8 +2268,6 @@ void blk_mq_release(struct request_queue *q)
         struct blk_mq_hw_ctx *hctx;
         unsigned int i;
 
-        blk_mq_sched_teardown(q);
-
         /* hctx kobj stays in hctx */
         queue_for_each_hw_ctx(q, hctx, i) {
                 if (!hctx)
@@ -2573,6 +2598,14 @@ static int blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set)
         return 0;
 }
 
+static int blk_mq_update_queue_map(struct blk_mq_tag_set *set)
+{
+        if (set->ops->map_queues)
+                return set->ops->map_queues(set);
+        else
+                return blk_mq_map_queues(set);
+}
+
 /*
  * Alloc a tag set to be associated with one or more request queues.
  * May fail with EINVAL for various error conditions. May adjust the
@@ -2627,10 +2660,7 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
         if (!set->mq_map)
                 goto out_free_tags;
 
-        if (set->ops->map_queues)
-                ret = set->ops->map_queues(set);
-        else
-                ret = blk_mq_map_queues(set);
+        ret = blk_mq_update_queue_map(set);
         if (ret)
                 goto out_free_mq_map;
 
@@ -2722,6 +2752,7 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
                 blk_mq_freeze_queue(q);
 
         set->nr_hw_queues = nr_hw_queues;
+        blk_mq_update_queue_map(set);
         list_for_each_entry(q, &set->tag_list, tag_set_list) {
                 blk_mq_realloc_hw_ctxs(set, q);
 
@@ -2897,8 +2928,17 @@ bool blk_mq_poll(struct request_queue *q, blk_qc_t cookie)
         hctx = q->queue_hw_ctx[blk_qc_t_to_queue_num(cookie)];
         if (!blk_qc_t_is_internal(cookie))
                 rq = blk_mq_tag_to_rq(hctx->tags, blk_qc_t_to_tag(cookie));
-        else
+        else {
                 rq = blk_mq_tag_to_rq(hctx->sched_tags, blk_qc_t_to_tag(cookie));
+                /*
+                 * With scheduling, if the request has completed, we'll
+                 * get a NULL return here, as we clear the sched tag when
+                 * that happens. The request still remains valid, like always,
+                 * so we should be safe with just the NULL check.
+                 */
+                if (!rq)
+                        return false;
+        }
 
         return __blk_mq_poll(hctx, rq);
 }
diff --git a/block/blk-mq.h b/block/blk-mq.h
index b79f9a7d8cf6..660a17e1d033 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -31,7 +31,7 @@ void blk_mq_freeze_queue(struct request_queue *q);
 void blk_mq_free_queue(struct request_queue *q);
 int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
 void blk_mq_wake_waiters(struct request_queue *q);
-bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *, struct list_head *);
+bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *);
 void blk_mq_flush_busy_ctxs(struct blk_mq_hw_ctx *hctx, struct list_head *list);
 bool blk_mq_hctx_has_pending(struct blk_mq_hw_ctx *hctx);
 bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
diff --git a/block/blk-stat.c b/block/blk-stat.c
index 9b43efb8933f..186fcb981e9b 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -30,11 +30,11 @@ static void blk_stat_flush_batch(struct blk_rq_stat *stat)
 
 static void blk_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src)
 {
+        blk_stat_flush_batch(src);
+
         if (!src->nr_samples)
                 return;
 
-        blk_stat_flush_batch(src);
-
         dst->min = min(dst->min, src->min);
         dst->max = max(dst->max, src->max);
 
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index c44b321335f3..37f0b3ad635e 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -816,7 +816,7 @@ static void blk_release_queue(struct kobject *kobj)
 
         if (q->elevator) {
                 ioc_clear_queue(q);
-                elevator_exit(q->elevator);
+                elevator_exit(q, q->elevator);
         }
 
         blk_exit_rl(&q->root_rl);
diff --git a/block/elevator.c b/block/elevator.c
index 01139f549b5b..4d9084a14c10 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -242,26 +242,21 @@ int elevator_init(struct request_queue *q, char *name)
                 }
         }
 
-        if (e->uses_mq) {
-                err = blk_mq_sched_setup(q);
-                if (!err)
-                        err = e->ops.mq.init_sched(q, e);
-        } else
+        if (e->uses_mq)
+                err = blk_mq_init_sched(q, e);
+        else
                 err = e->ops.sq.elevator_init_fn(q, e);
-        if (err) {
-                if (e->uses_mq)
-                        blk_mq_sched_teardown(q);
+        if (err)
                 elevator_put(e);
-        }
         return err;
 }
 EXPORT_SYMBOL(elevator_init);
 
-void elevator_exit(struct elevator_queue *e)
+void elevator_exit(struct request_queue *q, struct elevator_queue *e)
 {
         mutex_lock(&e->sysfs_lock);
         if (e->uses_mq && e->type->ops.mq.exit_sched)
-                e->type->ops.mq.exit_sched(e);
+                blk_mq_exit_sched(q, e);
         else if (!e->uses_mq && e->type->ops.sq.elevator_exit_fn)
                 e->type->ops.sq.elevator_exit_fn(e);
         mutex_unlock(&e->sysfs_lock);
@@ -946,6 +941,45 @@ void elv_unregister(struct elevator_type *e)
 }
 EXPORT_SYMBOL_GPL(elv_unregister);
 
+static int elevator_switch_mq(struct request_queue *q,
+                              struct elevator_type *new_e)
+{
+        int ret;
+
+        blk_mq_freeze_queue(q);
+        blk_mq_quiesce_queue(q);
+
+        if (q->elevator) {
+                if (q->elevator->registered)
+                        elv_unregister_queue(q);
+                ioc_clear_queue(q);
+                elevator_exit(q, q->elevator);
+        }
+
+        ret = blk_mq_init_sched(q, new_e);
+        if (ret)
+                goto out;
+
+        if (new_e) {
+                ret = elv_register_queue(q);
+                if (ret) {
+                        elevator_exit(q, q->elevator);
+                        goto out;
+                }
+        }
+
+        if (new_e)
+                blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
+        else
+                blk_add_trace_msg(q, "elv switch: none");
+
+out:
+        blk_mq_unfreeze_queue(q);
+        blk_mq_start_stopped_hw_queues(q, true);
+        return ret;
+
+}
+
 /*
  * switch to new_e io scheduler. be careful not to introduce deadlocks -
  * we don't free the old io scheduler, before we have allocated what we
@@ -958,10 +992,8 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         bool old_registered = false;
         int err;
 
-        if (q->mq_ops) {
-                blk_mq_freeze_queue(q);
-                blk_mq_quiesce_queue(q);
-        }
+        if (q->mq_ops)
+                return elevator_switch_mq(q, new_e);
 
         /*
          * Turn on BYPASS and drain all requests w/ elevator private data.
@@ -973,11 +1005,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         if (old) {
                 old_registered = old->registered;
 
-                if (old->uses_mq)
-                        blk_mq_sched_teardown(q);
-
-                if (!q->mq_ops)
-                        blk_queue_bypass_start(q);
+                blk_queue_bypass_start(q);
 
                 /* unregister and clear all auxiliary data of the old elevator */
                 if (old_registered)
@@ -987,56 +1015,32 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         }
 
         /* allocate, init and register new elevator */
-        if (new_e) {
-                if (new_e->uses_mq) {
-                        err = blk_mq_sched_setup(q);
-                        if (!err)
-                                err = new_e->ops.mq.init_sched(q, new_e);
-                } else
-                        err = new_e->ops.sq.elevator_init_fn(q, new_e);
-                if (err)
-                        goto fail_init;
+        err = new_e->ops.sq.elevator_init_fn(q, new_e);
+        if (err)
+                goto fail_init;
 
-                err = elv_register_queue(q);
-                if (err)
-                        goto fail_register;
-        } else
-                q->elevator = NULL;
+        err = elv_register_queue(q);
+        if (err)
+                goto fail_register;
 
         /* done, kill the old one and finish */
         if (old) {
-                elevator_exit(old);
-                if (!q->mq_ops)
-                        blk_queue_bypass_end(q);
+                elevator_exit(q, old);
+                blk_queue_bypass_end(q);
         }
 
-        if (q->mq_ops) {
-                blk_mq_unfreeze_queue(q);
-                blk_mq_start_stopped_hw_queues(q, true);
-        }
-
-        if (new_e)
-                blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
-        else
-                blk_add_trace_msg(q, "elv switch: none");
+        blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
 
         return 0;
 
 fail_register:
-        if (q->mq_ops)
-                blk_mq_sched_teardown(q);
-        elevator_exit(q->elevator);
+        elevator_exit(q, q->elevator);
 fail_init:
         /* switch failed, restore and re-register old elevator */
         if (old) {
                 q->elevator = old;
                 elv_register_queue(q);
-                if (!q->mq_ops)
-                        blk_queue_bypass_end(q);
-        }
-        if (q->mq_ops) {
-                blk_mq_unfreeze_queue(q);
-                blk_mq_start_stopped_hw_queues(q, true);
+                blk_queue_bypass_end(q);
         }
 
         return err;
@@ -1094,12 +1098,20 @@ int elevator_change(struct request_queue *q, const char *name)
 }
 EXPORT_SYMBOL(elevator_change);
 
+static inline bool elv_support_iosched(struct request_queue *q)
+{
+        if (q->mq_ops && q->tag_set && (q->tag_set->flags &
+                                BLK_MQ_F_NO_SCHED))
+                return false;
+        return true;
+}
+
 ssize_t elv_iosched_store(struct request_queue *q, const char *name,
                           size_t count)
 {
         int ret;
 
-        if (!(q->mq_ops || q->request_fn))
+        if (!(q->mq_ops || q->request_fn) || !elv_support_iosched(q))
                 return count;
 
         ret = __elevator_change(q, name);
@@ -1131,7 +1143,7 @@ ssize_t elv_iosched_show(struct request_queue *q, char *name)
                         len += sprintf(name+len, "[%s] ", elv->elevator_name);
                         continue;
                 }
-                if (__e->uses_mq && q->mq_ops)
+                if (__e->uses_mq && q->mq_ops && elv_support_iosched(q))
                         len += sprintf(name+len, "%s ", __e->elevator_name);
                 else if (!__e->uses_mq && !q->mq_ops)
                         len += sprintf(name+len, "%s ", __e->elevator_name);
diff --git a/crypto/ahash.c b/crypto/ahash.c
index e58c4970c22b..826cd7ab4d4a 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -32,6 +32,7 @@ struct ahash_request_priv {
         crypto_completion_t complete;
         void *data;
         u8 *result;
+        u32 flags;
         void *ubuf[] CRYPTO_MINALIGN_ATTR;
 };
 
@@ -253,6 +254,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
         priv->result = req->result;
         priv->complete = req->base.complete;
         priv->data = req->base.data;
+        priv->flags = req->base.flags;
+
         /*
          * WARNING: We do not backup req->priv here! The req->priv
          *          is for internal use of the Crypto API and the
@@ -267,38 +270,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
         return 0;
 }
 
-static void ahash_restore_req(struct ahash_request *req)
+static void ahash_restore_req(struct ahash_request *req, int err)
 {
         struct ahash_request_priv *priv = req->priv;
 
+        if (!err)
+                memcpy(priv->result, req->result,
+                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+
         /* Restore the original crypto request. */
         req->result = priv->result;
-        req->base.complete = priv->complete;
-        req->base.data = priv->data;
+
+        ahash_request_set_callback(req, priv->flags,
+                                   priv->complete, priv->data);
         req->priv = NULL;
 
         /* Free the req->priv.priv from the ADJUSTED request. */
         kzfree(priv);
 }
 
-static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
+static void ahash_notify_einprogress(struct ahash_request *req)
 {
         struct ahash_request_priv *priv = req->priv;
+        struct crypto_async_request oreq;
 
-        if (err == -EINPROGRESS)
-                return;
-
-        if (!err)
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+        oreq.data = priv->data;
 
-        ahash_restore_req(req);
+        priv->complete(&oreq, -EINPROGRESS);
 }
 
 static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
 {
         struct ahash_request *areq = req->data;
 
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
+
         /*
          * Restore the original request, see ahash_op_unaligned() for what
          * goes where.
@@ -309,7 +318,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
          */
 
         /* First copy req->result into req->priv.result */
-        ahash_op_unaligned_finish(areq, err);
+        ahash_restore_req(areq, err);
 
         /* Complete the ORIGINAL request. */
         areq->base.complete(&areq->base, err);
@@ -325,7 +334,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
                 return err;
 
         err = op(req);
-        ahash_op_unaligned_finish(req, err);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
+
+        ahash_restore_req(req, err);
 
         return err;
 }
@@ -360,25 +374,14 @@ int crypto_ahash_digest(struct ahash_request *req)
 }
 EXPORT_SYMBOL_GPL(crypto_ahash_digest);
 
-static void ahash_def_finup_finish2(struct ahash_request *req, int err)
+static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
 {
-        struct ahash_request_priv *priv = req->priv;
+        struct ahash_request *areq = req->data;
 
         if (err == -EINPROGRESS)
                 return;
 
-        if (!err)
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-
-        ahash_restore_req(req);
-}
-
-static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
-{
-        struct ahash_request *areq = req->data;
-
-        ahash_def_finup_finish2(areq, err);
+        ahash_restore_req(areq, err);
 
         areq->base.complete(&areq->base, err);
 }
@@ -389,11 +392,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
                 goto out;
 
         req->base.complete = ahash_def_finup_done2;
-        req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
         err = crypto_ahash_reqtfm(req)->final(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
 
 out:
-        ahash_def_finup_finish2(req, err);
+        ahash_restore_req(req, err);
         return err;
 }
 
@@ -401,7 +408,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
 {
         struct ahash_request *areq = req->data;
 
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
+
+        areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
         err = ahash_def_finup_finish1(areq, err);
+        if (areq->priv)
+                return;
 
         areq->base.complete(&areq->base, err);
 }
@@ -416,6 +432,11 @@ static int ahash_def_finup(struct ahash_request *req)
                 return err;
 
         err = tfm->update(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
+
         return ahash_def_finup_finish1(req, err);
 }
 
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 5a8053758657..ef59d9926ee9 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -40,6 +40,7 @@ struct aead_async_req {
         struct aead_async_rsgl first_rsgl;
         struct list_head list;
         struct kiocb *iocb;
+        struct sock *sk;
         unsigned int tsgls;
         char iv[];
 };
@@ -379,12 +380,10 @@ unlock:
 
 static void aead_async_cb(struct crypto_async_request *_req, int err)
 {
-        struct sock *sk = _req->data;
-        struct alg_sock *ask = alg_sk(sk);
-        struct aead_ctx *ctx = ask->private;
-        struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
-        struct aead_request *req = aead_request_cast(_req);
+        struct aead_request *req = _req->data;
+        struct crypto_aead *tfm = crypto_aead_reqtfm(req);
         struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
+        struct sock *sk = areq->sk;
         struct scatterlist *sg = areq->tsgl;
         struct aead_async_rsgl *rsgl;
         struct kiocb *iocb = areq->iocb;
@@ -447,11 +446,12 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
         memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
         INIT_LIST_HEAD(&areq->list);
         areq->iocb = msg->msg_iocb;
+        areq->sk = sk;
         memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
         aead_request_set_tfm(req, tfm);
         aead_request_set_ad(req, ctx->aead_assoclen);
         aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                  aead_async_cb, sk);
+                                  aead_async_cb, req);
         used -= ctx->aead_assoclen;
 
         /* take over all tx sgls from ctx */
diff --git a/crypto/lrw.c b/crypto/lrw.c
index ecd8474018e3..a8bfae4451bf 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -286,8 +286,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = LRW_BUFFER_SIZE;
         if (req->cryptlen > LRW_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
@@ -342,6 +345,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -349,6 +359,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
@@ -386,6 +397,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -393,6 +411,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
diff --git a/crypto/xts.c b/crypto/xts.c
index baeb34dd8582..89ace5ebc2da 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -230,8 +230,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = XTS_BUFFER_SIZE;
         if (req->cryptlen > XTS_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
@@ -283,6 +286,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -290,6 +300,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
@@ -327,6 +338,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -334,6 +352,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index a391bbc48105..d94f92f88ca1 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -2,7 +2,6 @@
 # Makefile for the Linux ACPI interpreter
 #
 
-ccflags-y                       := -Os
 ccflags-$(CONFIG_ACPI_DEBUG)    += -DACPI_DEBUG_OUTPUT
 
 #
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index b4c1a6a51da4..03250e1f1103 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -25,9 +25,11 @@
 ACPI_MODULE_NAME("platform");
 
 static const struct acpi_device_id forbidden_id_list[] = {
-        {"PNP0000", 0}, /* PIC */
-        {"PNP0100", 0}, /* Timer */
-        {"PNP0200", 0}, /* AT DMA Controller */
+        {"PNP0000",  0},        /* PIC */
+        {"PNP0100",  0},        /* Timer */
+        {"PNP0200",  0},        /* AT DMA Controller */
+        {"ACPI0009", 0},        /* IOxAPIC */
+        {"ACPI000A", 0},        /* IOAPIC */
         {"", 0},
 };
 
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index c86bae7b1d0f..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -421,10 +421,8 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
 
         ACPI_FUNCTION_TRACE(ut_walk_aml_resources);
 
-        /*
-         * The absolute minimum resource template is one end_tag descriptor.
-         * However, we will treat a lone end_tag as just a simple buffer.
-         */
+        /* The absolute minimum resource template is one end_tag descriptor */
+
         if (aml_length < sizeof(struct aml_resource_end_tag)) {
                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
         }
@@ -456,8 +454,9 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                 /* Invoke the user function */
 
                 if (user_function) {
-                        status = user_function(aml, length, offset,
-                                               resource_index, context);
+                        status =
+                            user_function(aml, length, offset, resource_index,
+                                          context);
                         if (ACPI_FAILURE(status)) {
                                 return_ACPI_STATUS(status);
                         }
@@ -481,12 +480,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 *context = aml;
                         }
 
-                        /* Check if buffer is defined to be longer than the resource length */
-
-                        if (aml_length > (offset + length)) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Normal exit */
 
                         return_ACPI_STATUS(AE_OK);
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index b192b42a8351..79b3c9c5a3bc 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1073,6 +1073,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
                 if (list_empty(&ghes_sci))
                         unregister_acpi_hed_notifier(&ghes_notifier_sci);
                 mutex_unlock(&ghes_list_mutex);
+                synchronize_rcu();
                 break;
         case ACPI_HEST_NOTIFY_NMI:
                 ghes_nmi_remove(ghes);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index fb19e1cdb641..edc8663b5db3 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -99,13 +99,13 @@ static int find_child_checks(struct acpi_device *adev, bool check_children)
                 return -ENODEV;
 
         /*
-         * If the device has a _HID (or _CID) returning a valid ACPI/PNP
-         * device ID, it is better to make it look less attractive here, so that
-         * the other device with the same _ADR value (that may not have a valid
-         * device ID) can be matched going forward.  [This means a second spec
-         * violation in a row, so whatever we do here is best effort anyway.]
+         * If the device has a _HID returning a valid ACPI/PNP device ID, it is
+         * better to make it look less attractive here, so that the other device
+         * with the same _ADR value (that may not have a valid device ID) can be
+         * matched going forward.  [This means a second spec violation in a row,
+         * so whatever we do here is best effort anyway.]
          */
-        return sta_present && list_empty(&adev->pnp.ids) ?
+        return sta_present && !adev->pnp.type.platform_id ?
                         FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
 }
 
diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c
index 1120dfd625b8..7e4fbf9a53a3 100644
--- a/drivers/acpi/ioapic.c
+++ b/drivers/acpi/ioapic.c
@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data)
         struct resource *res = data;
         struct resource_win win;
 
+        /*
+         * We might assign this to 'res' later, make sure all pointers are
+         * cleared before the resource is added to the global list
+         */
+        memset(&win, 0, sizeof(win));
+
         res->flags = 0;
         if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM))
                 return AE_OK;
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 662036bdc65e..c8ea9d698cd0 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1617,7 +1617,11 @@ static int cmp_map(const void *m0, const void *m1)
         const struct nfit_set_info_map *map0 = m0;
         const struct nfit_set_info_map *map1 = m1;
 
-        return map0->region_offset - map1->region_offset;
+        if (map0->region_offset < map1->region_offset)
+                return -1;
+        else if (map0->region_offset > map1->region_offset)
+                return 1;
+        return 0;
 }
 
 /* Retrieve the nth entry referencing this spa */
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fcd4ce6f78d5..1c2b846c5776 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -200,6 +200,7 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
                 return -EINVAL;
 
         /* The state of the list is 'on' IFF all resources are 'on'. */
+        cur_state = 0;
         list_for_each_entry(entry, list, node) {
                 struct acpi_power_resource *resource = entry->resource;
                 acpi_handle handle = resource->device.handle;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 192691880d55..2433569b02ef 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1857,15 +1857,20 @@ static void acpi_bus_attach(struct acpi_device *device)
                 return;
 
         device->flags.match_driver = true;
-        if (!ret) {
-                ret = device_attach(&device->dev);
-                if (ret < 0)
-                        return;
-
-                if (!ret && device->pnp.type.platform_id)
-                        acpi_default_enumeration(device);
+        if (ret > 0) {
+                acpi_device_set_enumerated(device);
+                goto ok;
         }
 
+        ret = device_attach(&device->dev);
+        if (ret < 0)
+                return;
+
+        if (ret > 0 || !device->pnp.type.platform_id)
+                acpi_device_set_enumerated(device);
+        else
+                acpi_default_enumeration(device);
+
  ok:
         list_for_each_entry(child, &device->children, node)
                 acpi_bus_attach(child);
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 01c94669a2b0..3afa8c1fa127 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -30,7 +30,7 @@ static bool qdf2400_erratum_44_present(struct acpi_table_header *h)
                 return true;
 
         if (!memcmp(h->oem_table_id, "QDF2400 ", ACPI_OEM_TABLE_ID_SIZE) &&
-                        h->oem_revision == 0)
+                        h->oem_revision == 1)
                 return true;
 
         return false;
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index 6c9aa95a9a05..49d705c9f0f7 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -278,11 +278,6 @@ static int atiixp_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         const struct ata_port_info *ppi[] = { &info, &info };
 
-        /* SB600/700 don't have secondary port wired */
-        if ((pdev->device == PCI_DEVICE_ID_ATI_IXP600_IDE) ||
-                (pdev->device == PCI_DEVICE_ID_ATI_IXP700_IDE))
-                ppi[1] = &ata_dummy_port_info;
-
         return ata_pci_bmdma_init_one(pdev, ppi, &atiixp_sht, NULL,
                                       ATA_HOST_PARALLEL_SCAN);
 }
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0636d84fbefe..f3f538eec7b3 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -644,14 +644,16 @@ static void svia_configure(struct pci_dev *pdev, int board_id,
                 pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8);
         }
 
-        /* enable IRQ on hotplug */
-        pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
-        if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
-                dev_dbg(&pdev->dev,
-                        "enabling SATA hotplug (0x%x)\n",
-                        (int) tmp8);
-                tmp8 |= SATA_HOTPLUG;
-                pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+        if (board_id == vt6421) {
+                /* enable IRQ on hotplug */
+                pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
+                if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
+                        dev_dbg(&pdev->dev,
+                                "enabling SATA hotplug (0x%x)\n",
+                                (int) tmp8);
+                        tmp8 |= SATA_HOTPLUG;
+                        pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+                }
         }
 
         /*
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index bf43b5d2aafc..83f1439e57fd 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -218,6 +218,7 @@ static const struct of_device_id img_ascii_lcd_matches[] = {
         { .compatible = "img,boston-lcd", .data = &boston_config },
         { .compatible = "mti,malta-lcd", .data = &malta_config },
         { .compatible = "mti,sead3-lcd", .data = &sead3_config },
+        { /* sentinel */ }
 };
 
 /**
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index f96ab717534c..1d1dc11aa5fa 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3969,7 +3969,7 @@ static int mtip_block_initialize(struct driver_data *dd)
         dd->tags.reserved_tags = 1;
         dd->tags.cmd_size = sizeof(struct mtip_cmd);
         dd->tags.numa_node = dd->numa_node;
-        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE;
+        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_NO_SCHED;
         dd->tags.driver_data = dd;
         dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS;
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 7e4287bc19e5..d8a23561b4cb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -47,6 +47,8 @@ static DEFINE_MUTEX(nbd_index_mutex);
 struct nbd_sock {
         struct socket *sock;
         struct mutex tx_lock;
+        struct request *pending;
+        int sent;
 };
 
 #define NBD_TIMEDOUT                    0
@@ -124,7 +126,8 @@ static const char *nbdcmd_to_ascii(int cmd)
 
 static int nbd_size_clear(struct nbd_device *nbd, struct block_device *bdev)
 {
-        bd_set_size(bdev, 0);
+        if (bdev->bd_openers <= 1)
+                bd_set_size(bdev, 0);
         set_capacity(nbd->disk, 0);
         kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE);
 
@@ -190,7 +193,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
 
         dev_err(nbd_to_dev(nbd), "Connection timed out, shutting down connection\n");
         set_bit(NBD_TIMEDOUT, &nbd->runtime_flags);
-        req->errors++;
+        req->errors = -EIO;
 
         mutex_lock(&nbd->config_lock);
         sock_shutdown(nbd);
@@ -202,7 +205,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
  *  Send or receive packet.
  */
 static int sock_xmit(struct nbd_device *nbd, int index, int send,
-                     struct iov_iter *iter, int msg_flags)
+                     struct iov_iter *iter, int msg_flags, int *sent)
 {
         struct socket *sock = nbd->socks[index]->sock;
         int result;
@@ -237,6 +240,8 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
                                 result = -EPIPE; /* short read */
                         break;
                 }
+                if (sent)
+                        *sent += result;
         } while (msg_data_left(&msg));
 
         tsk_restore_flags(current, pflags, PF_MEMALLOC);
@@ -248,6 +253,7 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
+        struct nbd_sock *nsock = nbd->socks[index];
         int result;
         struct nbd_request request = {.magic = htonl(NBD_REQUEST_MAGIC)};
         struct kvec iov = {.iov_base = &request, .iov_len = sizeof(request)};
@@ -256,6 +262,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct bio *bio;
         u32 type;
         u32 tag = blk_mq_unique_tag(req);
+        int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
 
@@ -283,6 +290,17 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 return -EIO;
         }
 
+        /* We did a partial send previously, and we at least sent the whole
+         * request struct, so just go and send the rest of the pages in the
+         * request.
+         */
+        if (sent) {
+                if (sent >= sizeof(request)) {
+                        skip = sent - sizeof(request);
+                        goto send_pages;
+                }
+                iov_iter_advance(&from, sent);
+        }
         request.type = htonl(type);
         if (type != NBD_CMD_FLUSH) {
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
@@ -294,15 +312,27 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 cmd, nbdcmd_to_ascii(type),
                 (unsigned long long)blk_rq_pos(req) << 9, blk_rq_bytes(req));
         result = sock_xmit(nbd, index, 1, &from,
-                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0);
+                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
         if (result <= 0) {
+                if (result == -ERESTARTSYS) {
+                        /* If we havne't sent anything we can just return BUSY,
+                         * however if we have sent something we need to make
+                         * sure we only allow this req to be sent until we are
+                         * completely done.
+                         */
+                        if (sent) {
+                                nsock->pending = req;
+                                nsock->sent = sent;
+                        }
+                        return BLK_MQ_RQ_QUEUE_BUSY;
+                }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                         "Send control failed (result %d)\n", result);
                 return -EIO;
         }
-
+send_pages:
         if (type != NBD_CMD_WRITE)
-                return 0;
+                goto out;
 
         bio = req->bio;
         while (bio) {
@@ -318,8 +348,25 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 cmd, bvec.bv_len);
                         iov_iter_bvec(&from, ITER_BVEC | WRITE,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 1, &from, flags);
+                        if (skip) {
+                                if (skip >= iov_iter_count(&from)) {
+                                        skip -= iov_iter_count(&from);
+                                        continue;
+                                }
+                                iov_iter_advance(&from, skip);
+                                skip = 0;
+                        }
+                        result = sock_xmit(nbd, index, 1, &from, flags, &sent);
                         if (result <= 0) {
+                                if (result == -ERESTARTSYS) {
+                                        /* We've already sent the header, we
+                                         * have no choice but to set pending and
+                                         * return BUSY.
+                                         */
+                                        nsock->pending = req;
+                                        nsock->sent = sent;
+                                        return BLK_MQ_RQ_QUEUE_BUSY;
+                                }
                                 dev_err(disk_to_dev(nbd->disk),
                                         "Send data failed (result %d)\n",
                                         result);
@@ -336,6 +383,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 }
                 bio = next;
         }
+out:
+        nsock->pending = NULL;
+        nsock->sent = 0;
         return 0;
 }
 
@@ -353,7 +403,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
-        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
         if (result <= 0) {
                 if (!test_bit(NBD_DISCONNECTED, &nbd->runtime_flags) &&
                     !test_bit(NBD_DISCONNECT_REQUESTED, &nbd->runtime_flags))
@@ -383,7 +433,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
-                req->errors++;
+                req->errors = -EIO;
                 return cmd;
         }
 
@@ -395,11 +445,11 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 rq_for_each_segment(bvec, req, iter) {
                         iov_iter_bvec(&to, ITER_BVEC | READ,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
                         if (result <= 0) {
                                 dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n",
                                         result);
-                                req->errors++;
+                                req->errors = -EIO;
                                 return cmd;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
@@ -469,7 +519,7 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved)
         if (!blk_mq_request_started(req))
                 return;
         cmd = blk_mq_rq_to_pdu(req);
-        req->errors++;
+        req->errors = -EIO;
         nbd_end_request(cmd);
 }
 
@@ -482,22 +532,23 @@ static void nbd_clear_que(struct nbd_device *nbd)
 }
 
 
-static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
         struct nbd_device *nbd = cmd->nbd;
         struct nbd_sock *nsock;
+        int ret;
 
         if (index >= nbd->num_connections) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on invalid socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         if (test_bit(NBD_DISCONNECTED, &nbd->runtime_flags)) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         req->errors = 0;
@@ -508,29 +559,30 @@ static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
                 mutex_unlock(&nsock->tx_lock);
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
-        if (nbd_send_cmd(nbd, cmd, index) != 0) {
-                dev_err_ratelimited(disk_to_dev(nbd->disk),
-                                    "Request send failed\n");
-                req->errors++;
-                nbd_end_request(cmd);
+        /* Handle the case that we have a pending request that was partially
+         * transmitted that _has_ to be serviced first.  We need to call requeue
+         * here so that it gets put _after_ the request that is already on the
+         * dispatch list.
+         */
+        if (unlikely(nsock->pending && nsock->pending != req)) {
+                blk_mq_requeue_request(req, true);
+                ret = 0;
+                goto out;
         }
-
+        ret = nbd_send_cmd(nbd, cmd, index);
+out:
         mutex_unlock(&nsock->tx_lock);
-
-        return;
-
-error_out:
-        req->errors++;
-        nbd_end_request(cmd);
+        return ret;
 }
 
 static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                         const struct blk_mq_queue_data *bd)
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
+        int ret;
 
         /*
          * Since we look at the bio's to send the request over the network we
@@ -543,10 +595,20 @@ static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          */
         init_completion(&cmd->send_complete);
         blk_mq_start_request(bd->rq);
-        nbd_handle_cmd(cmd, hctx->queue_num);
+
+        /* We can be called directly from the user space process, which means we
+         * could possibly have signals pending so our sendmsg will fail.  In
+         * this case we need to return that we are busy, otherwise error out as
+         * appropriate.
+         */
+        ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_MQ_RQ_QUEUE_ERROR;
+        if (!ret)
+                ret = BLK_MQ_RQ_QUEUE_OK;
         complete(&cmd->send_complete);
 
-        return BLK_MQ_RQ_QUEUE_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
@@ -581,6 +643,8 @@ static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
 
         mutex_init(&nsock->tx_lock);
         nsock->sock = sock;
+        nsock->pending = NULL;
+        nsock->sent = 0;
         socks[nbd->num_connections++] = nsock;
 
         if (max_part)
@@ -602,6 +666,8 @@ static void nbd_reset(struct nbd_device *nbd)
 
 static void nbd_bdev_reset(struct block_device *bdev)
 {
+        if (bdev->bd_openers > 1)
+                return;
         set_device_ro(bdev, false);
         bdev->bd_inode->i_size = 0;
         if (max_part > 0) {
@@ -634,7 +700,7 @@ static void send_disconnects(struct nbd_device *nbd)
 
         for (i = 0; i < nbd->num_connections; i++) {
                 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
-                ret = sock_xmit(nbd, i, 1, &from, 0);
+                ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
                 if (ret <= 0)
                         dev_err(disk_to_dev(nbd->disk),
                                 "Send disconnect failed %d\n", ret);
@@ -665,7 +731,8 @@ static int nbd_clear_sock(struct nbd_device *nbd, struct block_device *bdev)
 {
         sock_shutdown(nbd);
         nbd_clear_que(nbd);
-        kill_bdev(bdev);
+
+        __invalidate_device(bdev, true);
         nbd_bdev_reset(bdev);
         /*
          * We want to give the run thread a chance to wait for everybody
@@ -781,7 +848,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd_size_set(nbd, bdev, nbd->blksize, arg);
                 return 0;
         case NBD_SET_TIMEOUT:
-                nbd->tag_set.timeout = arg * HZ;
+                if (arg) {
+                        nbd->tag_set.timeout = arg * HZ;
+                        blk_queue_rq_timeout(nbd->disk->queue, arg * HZ);
+                }
                 return 0;
 
         case NBD_SET_FLAGS:
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index dceb5edd1e54..0c09d4256108 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -523,7 +523,7 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index)
 
         cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
         if (size == PAGE_SIZE) {
-                copy_page(mem, cmem);
+                memcpy(mem, cmem, PAGE_SIZE);
         } else {
                 struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp);
 
@@ -717,7 +717,7 @@ compress_again:
 
         if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
                 src = kmap_atomic(page);
-                copy_page(cmem, src);
+                memcpy(cmem, src, PAGE_SIZE);
                 kunmap_atomic(src);
         } else {
                 memcpy(cmem, src, clen);
@@ -928,7 +928,7 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector,
         }
 
         index = sector >> SECTORS_PER_PAGE_SHIFT;
-        offset = sector & (SECTORS_PER_PAGE - 1) << SECTOR_SHIFT;
+        offset = (sector & (SECTORS_PER_PAGE - 1)) << SECTOR_SHIFT;
 
         bv.bv_page = page;
         bv.bv_len = PAGE_SIZE;
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index c2c14a12713b..08e054507d0b 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -344,7 +344,8 @@ config BT_WILINK
 
 config BT_QCOMSMD
         tristate "Qualcomm SMD based HCI support"
-        depends on (QCOM_SMD && QCOM_WCNSS_CTRL) || COMPILE_TEST
+        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on QCOM_WCNSS_CTRL || (COMPILE_TEST && QCOM_WCNSS_CTRL=n)
         select BT_QCA
         help
           Qualcomm SMD based HCI driver.
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 4a99ac756f08..9959c762da2f 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -55,6 +55,7 @@ MODULE_DEVICE_TABLE(pci, pci_tbl);
 struct amd768_priv {
         void __iomem *iobase;
         struct pci_dev *pcidev;
+        u32 pmbase;
 };
 
 static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
@@ -148,33 +149,58 @@ found:
         if (pmbase == 0)
                 return -EIO;
 
-        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        if (!devm_request_region(&pdev->dev, pmbase + PMBASE_OFFSET,
-                                PMBASE_SIZE, DRV_NAME)) {
+        if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) {
                 dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n",
                         pmbase + 0xF0);
-                return -EBUSY;
+                err = -EBUSY;
+                goto out;
         }
 
-        priv->iobase = devm_ioport_map(&pdev->dev, pmbase + PMBASE_OFFSET,
-                        PMBASE_SIZE);
+        priv->iobase = ioport_map(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
         if (!priv->iobase) {
                 pr_err(DRV_NAME "Cannot map ioport\n");
-                return -ENOMEM;
+                err = -EINVAL;
+                goto err_iomap;
         }
 
         amd_rng.priv = (unsigned long)priv;
+        priv->pmbase = pmbase;
         priv->pcidev = pdev;
 
         pr_info(DRV_NAME " detected\n");
-        return devm_hwrng_register(&pdev->dev, &amd_rng);
+        err = hwrng_register(&amd_rng);
+        if (err) {
+                pr_err(DRV_NAME " registering failed (%d)\n", err);
+                goto err_hwrng;
+        }
+        return 0;
+
+err_hwrng:
+        ioport_unmap(priv->iobase);
+err_iomap:
+        release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+out:
+        kfree(priv);
+        return err;
 }
 
 static void __exit mod_exit(void)
 {
+        struct amd768_priv *priv;
+
+        priv = (struct amd768_priv *)amd_rng.priv;
+
+        hwrng_unregister(&amd_rng);
+
+        ioport_unmap(priv->iobase);
+
+        release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+
+        kfree(priv);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index e7a245942029..e1d421a36a13 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -31,6 +31,9 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 
+
+#define PFX     KBUILD_MODNAME ": "
+
 #define GEODE_RNG_DATA_REG   0x50
 #define GEODE_RNG_STATUS_REG 0x54
 
@@ -82,6 +85,7 @@ static struct hwrng geode_rng = {
 
 static int __init mod_init(void)
 {
+        int err = -ENODEV;
         struct pci_dev *pdev = NULL;
         const struct pci_device_id *ent;
         void __iomem *mem;
@@ -89,27 +93,43 @@ static int __init mod_init(void)
 
         for_each_pci_dev(pdev) {
                 ent = pci_match_id(pci_tbl, pdev);
-                if (ent) {
-                        rng_base = pci_resource_start(pdev, 0);
-                        if (rng_base == 0)
-                                return -ENODEV;
-
-                        mem = devm_ioremap(&pdev->dev, rng_base, 0x58);
-                        if (!mem)
-                                return -ENOMEM;
-                        geode_rng.priv = (unsigned long)mem;
-
-                        pr_info("AMD Geode RNG detected\n");
-                        return devm_hwrng_register(&pdev->dev, &geode_rng);
-                }
+                if (ent)
+                        goto found;
         }
-
         /* Device not found. */
-        return -ENODEV;
+        goto out;
+
+found:
+        rng_base = pci_resource_start(pdev, 0);
+        if (rng_base == 0)
+                goto out;
+        err = -ENOMEM;
+        mem = ioremap(rng_base, 0x58);
+        if (!mem)
+                goto out;
+        geode_rng.priv = (unsigned long)mem;
+
+        pr_info("AMD Geode RNG detected\n");
+        err = hwrng_register(&geode_rng);
+        if (err) {
+                pr_err(PFX "RNG registering failed (%d)\n",
+                       err);
+                goto err_unmap;
+        }
+out:
+        return err;
+
+err_unmap:
+        iounmap(mem);
+        goto out;
 }
 
 static void __exit mod_exit(void)
 {
+        void __iomem *mem = (void __iomem *)geode_rng.priv;
+
+        hwrng_unregister(&geode_rng);
+        iounmap(mem);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6d9cc2d39d22..7e4a9d1296bb 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -60,6 +60,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
 #endif
 
 #ifdef CONFIG_STRICT_DEVMEM
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return devmem_is_allowed(pfn);
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         u64 from = ((u64)pfn) << PAGE_SHIFT;
@@ -75,6 +79,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
         return 1;
 }
 #else
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return 1;
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         return 1;
@@ -122,23 +130,31 @@ static ssize_t read_mem(struct file *file, char __user *buf,
 
         while (count > 0) {
                 unsigned long remaining;
+                int allowed;
 
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, count))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
+                if (allowed == 2) {
+                        /* Show zeros for restricted memory. */
+                        remaining = clear_user(buf, sz);
+                } else {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr)
+                                return -EFAULT;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr)
-                        return -EFAULT;
+                        remaining = copy_to_user(buf, ptr, sz);
+
+                        unxlate_dev_mem_ptr(p, ptr);
+                }
 
-                remaining = copy_to_user(buf, ptr, sz);
-                unxlate_dev_mem_ptr(p, ptr);
                 if (remaining)
                         return -EFAULT;
 
@@ -181,30 +197,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
 #endif
 
         while (count > 0) {
+                int allowed;
+
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr) {
-                        if (written)
-                                break;
-                        return -EFAULT;
-                }
+                /* Skip actual writing when a page is marked as restricted. */
+                if (allowed == 1) {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr) {
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
 
-                copied = copy_from_user(ptr, buf, sz);
-                unxlate_dev_mem_ptr(p, ptr);
-                if (copied) {
-                        written += sz - copied;
-                        if (written)
-                                break;
-                        return -EFAULT;
+                        copied = copy_from_user(ptr, buf, sz);
+                        unxlate_dev_mem_ptr(p, ptr);
+                        if (copied) {
+                                written += sz - copied;
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
                 }
 
                 buf += sz;
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 2a558c706581..3e73bcdf9e65 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -84,11 +84,14 @@ struct pp_struct {
         struct ieee1284_info state;
         struct ieee1284_info saved_state;
         long default_inactivity;
+        int index;
 };
 
 /* should we use PARDEVICE_MAX here? */
 static struct device *devices[PARPORT_MAX];
 
+static DEFINE_IDA(ida_index);
+
 /* pp_struct.flags bitfields */
 #define PP_CLAIMED    (1<<0)
 #define PP_EXCL       (1<<1)
@@ -290,7 +293,7 @@ static int register_device(int minor, struct pp_struct *pp)
         struct pardevice *pdev = NULL;
         char *name;
         struct pardev_cb ppdev_cb;
-        int rc = 0;
+        int rc = 0, index;
 
         name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
         if (name == NULL)
@@ -303,20 +306,23 @@ static int register_device(int minor, struct pp_struct *pp)
                 goto err;
         }
 
+        index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
         memset(&ppdev_cb, 0, sizeof(ppdev_cb));
         ppdev_cb.irq_func = pp_irq;
         ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
         ppdev_cb.private = pp;
-        pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);
+        pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
         parport_put_port(port);
 
         if (!pdev) {
                 pr_warn("%s: failed to register device!\n", name);
                 rc = -ENXIO;
+                ida_simple_remove(&ida_index, index);
                 goto err;
         }
 
         pp->pdev = pdev;
+        pp->index = index;
         dev_dbg(&pdev->dev, "registered pardevice\n");
 err:
         kfree(name);
@@ -755,6 +761,7 @@ static int pp_release(struct inode *inode, struct file *file)
 
         if (pp->pdev) {
                 parport_unregister_device(pp->pdev);
+                ida_simple_remove(&ida_index, pp->index);
                 pp->pdev = NULL;
                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index e9b7e0b3cabe..87fe111d0be6 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2202,14 +2202,16 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         vdev->config->reset(vdev);
 
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
         cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
          */
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         remove_controlq_data(portdev);
 
         list_for_each_entry(port, &portdev->ports, list) {
diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index ab609a76706f..cf9449b3dbd9 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -429,6 +429,13 @@ static const struct clk_div_table pll_divp_table[] = {
         { 0, 2 }, { 1, 4 }, { 2, 6 }, { 3, 8 }, { 0 }
 };
 
+static const struct clk_div_table pll_divq_table[] = {
+        { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 },
+        { 8, 8 }, { 9, 9 }, { 10, 10 }, { 11, 11 }, { 12, 12 }, { 13, 13 },
+        { 14, 14 }, { 15, 15 },
+        { 0 }
+};
+
 static const struct clk_div_table pll_divr_table[] = {
         { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 }, { 0 }
 };
@@ -496,9 +503,9 @@ struct stm32f4_div_data {
 
 #define MAX_PLL_DIV 3
 static const struct stm32f4_div_data  div_data[MAX_PLL_DIV] = {
-        { 16, 2, 0,                     pll_divp_table  },
-        { 24, 4, CLK_DIVIDER_ONE_BASED, NULL            },
-        { 28, 3, 0,                     pll_divr_table  },
+        { 16, 2, 0, pll_divp_table },
+        { 24, 4, 0, pll_divq_table },
+        { 28, 3, 0, pll_divr_table },
 };
 
 struct stm32f4_pll_data {
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 0fb39fe217d1..67201f67a14a 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2502,7 +2502,7 @@ struct clk *__clk_create_clk(struct clk_hw *hw, const char *dev_id,
 
         clk->core = hw->core;
         clk->dev_id = dev_id;
-        clk->con_id = con_id;
+        clk->con_id = kstrdup_const(con_id, GFP_KERNEL);
         clk->max_rate = ULONG_MAX;
 
         clk_prepare_lock();
@@ -2518,6 +2518,7 @@ void __clk_free_clk(struct clk *clk)
         hlist_del(&clk->clks_node);
         clk_prepare_unlock();
 
+        kfree_const(clk->con_id);
         kfree(clk);
 }
 
diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
index 924f560dcf80..00d4150e33c3 100644
--- a/drivers/clk/rockchip/clk-rk3036.c
+++ b/drivers/clk/rockchip/clk-rk3036.c
@@ -127,7 +127,7 @@ PNAME(mux_ddrphy_p)		= { "dpll_ddr", "gpll_ddr" };
 PNAME(mux_pll_src_3plls_p)      = { "apll", "dpll", "gpll" };
 PNAME(mux_timer_p)              = { "xin24m", "pclk_peri_src" };
 
-PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll" "usb480m" };
+PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll", "usb480m" };
 
 PNAME(mux_mmc_src_p)    = { "apll", "dpll", "gpll", "xin24m" };
 PNAME(mux_i2s_pre_p)    = { "i2s_src", "i2s_frac", "ext_i2s", "xin12m" };
@@ -450,6 +450,13 @@ static void __init rk3036_clk_init(struct device_node *np)
                 return;
         }
 
+        /*
+         * Make uart_pll_clk a child of the gpll, as all other sources are
+         * not that usable / stable.
+         */
+        writel_relaxed(HIWORD_UPDATE(0x2, 0x3, 10),
+                       reg_base + RK2928_CLKSEL_CON(13));
+
         ctx = rockchip_clk_init(np, reg_base, CLK_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip clk init failed\n", __func__);
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index 695bbf9ef428..1c2357301017 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -1,6 +1,7 @@
 config SUNXI_CCU
         bool "Clock support for Allwinner SoCs"
         depends on ARCH_SUNXI || COMPILE_TEST
+        select RESET_CONTROLLER
         default ARCH_SUNXI
 
 if SUNXI_CCU
@@ -80,6 +81,7 @@ config SUN6I_A31_CCU
         select SUNXI_CCU_DIV
         select SUNXI_CCU_NK
         select SUNXI_CCU_NKM
+        select SUNXI_CCU_NKMP
         select SUNXI_CCU_NM
         select SUNXI_CCU_MP
         select SUNXI_CCU_PHASE
@@ -134,6 +136,7 @@ config SUN8I_V3S_CCU
 config SUN9I_A80_CCU
         bool "Support for the Allwinner A80 CCU"
         select SUNXI_CCU_DIV
+        select SUNXI_CCU_MULT
         select SUNXI_CCU_GATE
         select SUNXI_CCU_NKMP
         select SUNXI_CCU_NM
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index e3c084cc6da5..f54114c607df 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -566,7 +566,7 @@ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
                              0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
 
 /* Fixed Factor clocks */
-static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 1, 2, 0);
+static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 2, 1, 0);
 
 /* We hardcode the divider to 4 for now */
 static CLK_FIXED_FACTOR(pll_audio_clk, "pll-audio",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 4c9a920ff4ab..89e68d29bf45 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -608,7 +608,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(hdmi_clk, "hdmi", lcd_ch1_parents,
                                  0x150, 0, 4, 24, 2, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
-static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(31), 0);
+static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(30), 0);
 
 static SUNXI_CCU_GATE(ps_clk, "ps", "lcd1-ch1", 0x140, BIT(31), 0);
 
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index a7b3c08ed0e2..2c69b631967a 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -752,6 +752,13 @@ static const struct sunxi_ccu_desc sun8i_a33_ccu_desc = {
         .num_resets     = ARRAY_SIZE(sun8i_a33_ccu_resets),
 };
 
+static struct ccu_pll_nb sun8i_a33_pll_cpu_nb = {
+        .common = &pll_cpux_clk.common,
+        /* copy from pll_cpux_clk */
+        .enable = BIT(31),
+        .lock   = BIT(28),
+};
+
 static struct ccu_mux_nb sun8i_a33_cpu_nb = {
         .common         = &cpux_clk.common,
         .cm             = &cpux_clk.mux,
@@ -783,6 +790,10 @@ static void __init sun8i_a33_ccu_setup(struct device_node *node)
 
         sunxi_ccu_probe(node, reg, &sun8i_a33_ccu_desc);
 
+        /* Gate then ungate PLL CPU after any rate changes */
+        ccu_pll_notifier_register(&sun8i_a33_pll_cpu_nb);
+
+        /* Reparent CPU during PLL CPU rate changes */
         ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
                                   &sun8i_a33_cpu_nb);
 }
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index 8a47bafd7890..9d8724715a43 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -14,11 +14,13 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/iopoll.h>
 #include <linux/slab.h>
 
 #include "ccu_common.h"
+#include "ccu_gate.h"
 #include "ccu_reset.h"
 
 static DEFINE_SPINLOCK(ccu_lock);
@@ -39,6 +41,53 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
         WARN_ON(readl_relaxed_poll_timeout(addr, reg, reg & lock, 100, 70000));
 }
 
+/*
+ * This clock notifier is called when the frequency of a PLL clock is
+ * changed. In common PLL designs, changes to the dividers take effect
+ * almost immediately, while changes to the multipliers (implemented
+ * as dividers in the feedback loop) take a few cycles to work into
+ * the feedback loop for the PLL to stablize.
+ *
+ * Sometimes when the PLL clock rate is changed, the decrease in the
+ * divider is too much for the decrease in the multiplier to catch up.
+ * The PLL clock rate will spike, and in some cases, might lock up
+ * completely.
+ *
+ * This notifier callback will gate and then ungate the clock,
+ * effectively resetting it, so it proceeds to work. Care must be
+ * taken to reparent consumers to other temporary clocks during the
+ * rate change, and that this notifier callback must be the first
+ * to be registered.
+ */
+static int ccu_pll_notifier_cb(struct notifier_block *nb,
+                               unsigned long event, void *data)
+{
+        struct ccu_pll_nb *pll = to_ccu_pll_nb(nb);
+        int ret = 0;
+
+        if (event != POST_RATE_CHANGE)
+                goto out;
+
+        ccu_gate_helper_disable(pll->common, pll->enable);
+
+        ret = ccu_gate_helper_enable(pll->common, pll->enable);
+        if (ret)
+                goto out;
+
+        ccu_helper_wait_for_lock(pll->common, pll->lock);
+
+out:
+        return notifier_from_errno(ret);
+}
+
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb)
+{
+        pll_nb->clk_nb.notifier_call = ccu_pll_notifier_cb;
+
+        return clk_notifier_register(pll_nb->common->hw.clk,
+                                     &pll_nb->clk_nb);
+}
+
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                     const struct sunxi_ccu_desc *desc)
 {
diff --git a/drivers/clk/sunxi-ng/ccu_common.h b/drivers/clk/sunxi-ng/ccu_common.h
index 73d81dc58fc5..d6fdd7a789aa 100644
--- a/drivers/clk/sunxi-ng/ccu_common.h
+++ b/drivers/clk/sunxi-ng/ccu_common.h
@@ -83,6 +83,18 @@ struct sunxi_ccu_desc {
 
 void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock);
 
+struct ccu_pll_nb {
+        struct notifier_block   clk_nb;
+        struct ccu_common       *common;
+
+        u32     enable;
+        u32     lock;
+};
+
+#define to_ccu_pll_nb(_nb) container_of(_nb, struct ccu_pll_nb, clk_nb)
+
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb);
+
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                     const struct sunxi_ccu_desc *desc);
 
diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c
index 22c2ca7a2a22..b583f186a804 100644
--- a/drivers/clk/sunxi-ng/ccu_mp.c
+++ b/drivers/clk/sunxi-ng/ccu_mp.c
@@ -85,6 +85,10 @@ static unsigned long ccu_mp_recalc_rate(struct clk_hw *hw,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         reg = readl(cmp->common.base + cmp->common.reg);
 
         m = reg >> cmp->m.shift;
@@ -117,6 +121,10 @@ static int ccu_mp_set_rate(struct clk_hw *hw, unsigned long rate,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         max_m = cmp->m.max ?: 1 << cmp->m.width;
         max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1);
 
diff --git a/drivers/clk/sunxi-ng/ccu_nkmp.c b/drivers/clk/sunxi-ng/ccu_nkmp.c
index a2b40a000157..488055ed944f 100644
--- a/drivers/clk/sunxi-ng/ccu_nkmp.c
+++ b/drivers/clk/sunxi-ng/ccu_nkmp.c
@@ -107,7 +107,7 @@ static unsigned long ccu_nkmp_recalc_rate(struct clk_hw *hw,
         p = reg >> nkmp->p.shift;
         p &= (1 << nkmp->p.width) - 1;
 
-        return parent_rate * n * k >> p / m;
+        return (parent_rate * n * k >> p) / m;
 }
 
 static long ccu_nkmp_round_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/drivers/clocksource/clkevt-probe.c b/drivers/clocksource/clkevt-probe.c
index 8c30fec86094..eb89b502acbd 100644
--- a/drivers/clocksource/clkevt-probe.c
+++ b/drivers/clocksource/clkevt-probe.c
@@ -17,7 +17,7 @@
 
 #include <linux/init.h>
 #include <linux/of.h>
-#include <linux/clockchip.h>
+#include <linux/clockchips.h>
 
 extern struct of_device_id __clkevt_of_table[];
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b8ff617d449d..0e3f6496524d 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -918,11 +918,19 @@ static struct kobj_type ktype_cpufreq = {
         .release        = cpufreq_sysfs_release,
 };
 
-static int add_cpu_dev_symlink(struct cpufreq_policy *policy,
-                               struct device *dev)
+static void add_cpu_dev_symlink(struct cpufreq_policy *policy, unsigned int cpu)
 {
+        struct device *dev = get_cpu_device(cpu);
+
+        if (!dev)
+                return;
+
+        if (cpumask_test_and_set_cpu(cpu, policy->real_cpus))
+                return;
+
         dev_dbg(dev, "%s: Adding symlink\n", __func__);
-        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
+        if (sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq"))
+                dev_err(dev, "cpufreq symlink creation failed\n");
 }
 
 static void remove_cpu_dev_symlink(struct cpufreq_policy *policy,
@@ -1180,10 +1188,13 @@ static int cpufreq_online(unsigned int cpu)
                 policy->user_policy.min = policy->min;
                 policy->user_policy.max = policy->max;
 
-                write_lock_irqsave(&cpufreq_driver_lock, flags);
-                for_each_cpu(j, policy->related_cpus)
+                for_each_cpu(j, policy->related_cpus) {
                         per_cpu(cpufreq_cpu_data, j) = policy;
-                write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+                        add_cpu_dev_symlink(policy, j);
+                }
+        } else {
+                policy->min = policy->user_policy.min;
+                policy->max = policy->user_policy.max;
         }
 
         if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
@@ -1272,13 +1283,15 @@ out_exit_policy:
 
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
+
+        for_each_cpu(j, policy->real_cpus)
+                remove_cpu_dev_symlink(policy, get_cpu_device(j));
+
 out_free_policy:
         cpufreq_policy_free(policy);
         return ret;
 }
 
-static int cpufreq_offline(unsigned int cpu);
-
 /**
  * cpufreq_add_dev - the cpufreq interface for a CPU device.
  * @dev: CPU device.
@@ -1300,16 +1313,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 
         /* Create sysfs link on CPU registration */
         policy = per_cpu(cpufreq_cpu_data, cpu);
-        if (!policy || cpumask_test_and_set_cpu(cpu, policy->real_cpus))
-                return 0;
+        if (policy)
+                add_cpu_dev_symlink(policy, cpu);
 
-        ret = add_cpu_dev_symlink(policy, dev);
-        if (ret) {
-                cpumask_clear_cpu(cpu, policy->real_cpus);
-                cpufreq_offline(cpu);
-        }
-
-        return ret;
+        return 0;
 }
 
 static int cpufreq_offline(unsigned int cpu)
@@ -2391,6 +2398,20 @@ EXPORT_SYMBOL_GPL(cpufreq_boost_enabled);
  *********************************************************************/
 static enum cpuhp_state hp_online;
 
+static int cpuhp_cpufreq_online(unsigned int cpu)
+{
+        cpufreq_online(cpu);
+
+        return 0;
+}
+
+static int cpuhp_cpufreq_offline(unsigned int cpu)
+{
+        cpufreq_offline(cpu);
+
+        return 0;
+}
+
 /**
  * cpufreq_register_driver - register a CPU Frequency driver
  * @driver_data: A struct cpufreq_driver containing the values#
@@ -2453,8 +2474,8 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         }
 
         ret = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "cpufreq:online",
-                                        cpufreq_online,
-                                        cpufreq_offline);
+                                        cpuhp_cpufreq_online,
+                                        cpuhp_cpufreq_offline);
         if (ret < 0)
                 goto err_if_unreg;
         hp_online = ret;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 08e134ffba68..283491f742d3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -364,9 +364,7 @@ static bool driver_registered __read_mostly;
 static bool acpi_ppc;
 #endif
 
-static struct perf_limits performance_limits;
-static struct perf_limits powersave_limits;
-static struct perf_limits *limits;
+static struct perf_limits global;
 
 static void intel_pstate_init_limits(struct perf_limits *limits)
 {
@@ -377,14 +375,6 @@ static void intel_pstate_init_limits(struct perf_limits *limits)
         limits->max_sysfs_pct = 100;
 }
 
-static void intel_pstate_set_performance_limits(struct perf_limits *limits)
-{
-        intel_pstate_init_limits(limits);
-        limits->min_perf_pct = 100;
-        limits->min_perf = int_ext_tofp(1);
-        limits->min_sysfs_pct = 100;
-}
-
 static DEFINE_MUTEX(intel_pstate_driver_lock);
 static DEFINE_MUTEX(intel_pstate_limits_lock);
 
@@ -507,7 +497,7 @@ static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy)
          * correct max turbo frequency based on the turbo state.
          * Also need to convert to MHz as _PSS freq is in MHz.
          */
-        if (!limits->turbo_disabled)
+        if (!global.turbo_disabled)
                 cpu->acpi_perf_data.states[0].core_frequency =
                                         policy->cpuinfo.max_freq / 1000;
         cpu->valid_pss_table = true;
@@ -626,7 +616,7 @@ static inline void update_turbo_state(void)
 
         cpu = all_cpu_data[0];
         rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
-        limits->turbo_disabled =
+        global.turbo_disabled =
                 (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
                  cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
 }
@@ -851,7 +841,7 @@ static struct freq_attr *hwp_cpufreq_attrs[] = {
 static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 {
         int min, hw_min, max, hw_max, cpu;
-        struct perf_limits *perf_limits = limits;
+        struct perf_limits *perf_limits = &global;
         u64 value, cap;
 
         for_each_cpu(cpu, policy->cpus) {
@@ -863,19 +853,22 @@ static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
                 hw_min = HWP_LOWEST_PERF(cap);
-                if (limits->no_turbo)
+                if (global.no_turbo)
                         hw_max = HWP_GUARANTEED_PERF(cap);
                 else
                         hw_max = HWP_HIGHEST_PERF(cap);
 
-                min = fp_ext_toint(hw_max * perf_limits->min_perf);
+                max = fp_ext_toint(hw_max * perf_limits->max_perf);
+                if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE)
+                        min = max;
+                else
+                        min = fp_ext_toint(hw_max * perf_limits->min_perf);
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
 
                 value &= ~HWP_MIN_PERF(~0L);
                 value |= HWP_MIN_PERF(min);
 
-                max = fp_ext_toint(hw_max * perf_limits->max_perf);
                 value &= ~HWP_MAX_PERF(~0L);
                 value |= HWP_MAX_PERF(max);
 
@@ -968,20 +961,11 @@ static int intel_pstate_resume(struct cpufreq_policy *policy)
 }
 
 static void intel_pstate_update_policies(void)
-        __releases(&intel_pstate_limits_lock)
-        __acquires(&intel_pstate_limits_lock)
 {
-        struct perf_limits *saved_limits = limits;
         int cpu;
 
-        mutex_unlock(&intel_pstate_limits_lock);
-
         for_each_possible_cpu(cpu)
                 cpufreq_update_policy(cpu);
-
-        mutex_lock(&intel_pstate_limits_lock);
-
-        limits = saved_limits;
 }
 
 /************************** debugfs begin ************************/
@@ -1060,7 +1044,7 @@ static void intel_pstate_debug_hide_params(void)
         static ssize_t show_##file_name                                 \
         (struct kobject *kobj, struct attribute *attr, char *buf)       \
         {                                                               \
-                return sprintf(buf, "%u\n", limits->object);            \
+                return sprintf(buf, "%u\n", global.object);             \
         }
 
 static ssize_t intel_pstate_show_status(char *buf);
@@ -1151,10 +1135,10 @@ static ssize_t show_no_turbo(struct kobject *kobj,
         }
 
         update_turbo_state();
-        if (limits->turbo_disabled)
-                ret = sprintf(buf, "%u\n", limits->turbo_disabled);
+        if (global.turbo_disabled)
+                ret = sprintf(buf, "%u\n", global.turbo_disabled);
         else
-                ret = sprintf(buf, "%u\n", limits->no_turbo);
+                ret = sprintf(buf, "%u\n", global.no_turbo);
 
         mutex_unlock(&intel_pstate_driver_lock);
 
@@ -1181,19 +1165,19 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
         mutex_lock(&intel_pstate_limits_lock);
 
         update_turbo_state();
-        if (limits->turbo_disabled) {
+        if (global.turbo_disabled) {
                 pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
                 mutex_unlock(&intel_pstate_limits_lock);
                 mutex_unlock(&intel_pstate_driver_lock);
                 return -EPERM;
         }
 
-        limits->no_turbo = clamp_t(int, input, 0, 1);
-
-        intel_pstate_update_policies();
+        global.no_turbo = clamp_t(int, input, 0, 1);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
+        intel_pstate_update_policies();
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1218,19 +1202,16 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->max_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->max_perf_pct = min(limits->max_policy_pct,
-                                   limits->max_sysfs_pct);
-        limits->max_perf_pct = max(limits->min_policy_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf_pct = max(limits->min_perf_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf = percent_ext_fp(limits->max_perf_pct);
-
-        intel_pstate_update_policies();
+        global.max_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.max_perf_pct = min(global.max_policy_pct, global.max_sysfs_pct);
+        global.max_perf_pct = max(global.min_policy_pct, global.max_perf_pct);
+        global.max_perf_pct = max(global.min_perf_pct, global.max_perf_pct);
+        global.max_perf = percent_ext_fp(global.max_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
+        intel_pstate_update_policies();
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1255,19 +1236,16 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->min_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->min_perf_pct = max(limits->min_policy_pct,
-                                   limits->min_sysfs_pct);
-        limits->min_perf_pct = min(limits->max_policy_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf_pct = min(limits->max_perf_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf = percent_ext_fp(limits->min_perf_pct);
-
-        intel_pstate_update_policies();
+        global.min_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.min_perf_pct = max(global.min_policy_pct, global.min_sysfs_pct);
+        global.min_perf_pct = min(global.max_policy_pct, global.min_perf_pct);
+        global.min_perf_pct = min(global.max_perf_pct, global.min_perf_pct);
+        global.min_perf = percent_ext_fp(global.min_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
+        intel_pstate_update_policies();
+
         mutex_unlock(&intel_pstate_driver_lock);
 
         return count;
@@ -1387,7 +1365,7 @@ static u64 atom_get_val(struct cpudata *cpudata, int pstate)
         u32 vid;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         vid_fp = cpudata->vid.min + mul_fp(
@@ -1557,7 +1535,7 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate)
         u64 val;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         return val;
@@ -1683,9 +1661,9 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
         int max_perf = cpu->pstate.turbo_pstate;
         int max_perf_adj;
         int min_perf;
-        struct perf_limits *perf_limits = limits;
+        struct perf_limits *perf_limits = &global;
 
-        if (limits->no_turbo || limits->turbo_disabled)
+        if (global.no_turbo || global.turbo_disabled)
                 max_perf = cpu->pstate.max_pstate;
 
         if (per_cpu_limits)
@@ -1820,7 +1798,7 @@ static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu)
 
         sample->busy_scaled = busy_frac * 100;
 
-        target = limits->no_turbo || limits->turbo_disabled ?
+        target = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         target += target >> 2;
         target = mul_fp(target, busy_frac);
@@ -2116,7 +2094,7 @@ static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu;
-        struct perf_limits *perf_limits = NULL;
+        struct perf_limits *perf_limits = &global;
 
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
@@ -2139,21 +2117,6 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
-                pr_debug("set performance\n");
-                if (!perf_limits) {
-                        limits = &performance_limits;
-                        perf_limits = limits;
-                }
-        } else {
-                pr_debug("set powersave\n");
-                if (!perf_limits) {
-                        limits = &powersave_limits;
-                        perf_limits = limits;
-                }
-
-        }
-
         intel_pstate_update_perf_limits(policy, perf_limits);
 
         if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
@@ -2177,16 +2140,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits;
-
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE)
-                perf_limits = &performance_limits;
-        else
-                perf_limits = &powersave_limits;
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = perf_limits->turbo_disabled ||
-                                        perf_limits->no_turbo ?
+        policy->cpuinfo.max_freq = global.turbo_disabled || global.no_turbo ?
                                         cpu->pstate.max_freq :
                                         cpu->pstate.turbo_freq;
 
@@ -2201,9 +2157,9 @@ static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
                 unsigned int max_freq, min_freq;
 
                 max_freq = policy->cpuinfo.max_freq *
-                                        perf_limits->max_sysfs_pct / 100;
+                                        global.max_sysfs_pct / 100;
                 min_freq = policy->cpuinfo.max_freq *
-                                        perf_limits->min_sysfs_pct / 100;
+                                        global.min_sysfs_pct / 100;
                 cpufreq_verify_within_limits(policy, min_freq, max_freq);
         }
 
@@ -2255,7 +2211,7 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         policy->cpuinfo.max_freq *= cpu->pstate.scaling;
 
@@ -2275,7 +2231,7 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
                 return ret;
 
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        if (limits->min_perf_pct == 100 && limits->max_perf_pct == 100)
+        if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE))
                 policy->policy = CPUFREQ_POLICY_PERFORMANCE;
         else
                 policy->policy = CPUFREQ_POLICY_POWERSAVE;
@@ -2301,7 +2257,7 @@ static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
         struct cpudata *cpu = all_cpu_data[policy->cpu];
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_freq : cpu->pstate.turbo_freq;
 
         cpufreq_verify_within_cpu_limits(policy);
@@ -2309,26 +2265,6 @@ static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
         return 0;
 }
 
-static unsigned int intel_cpufreq_turbo_update(struct cpudata *cpu,
-                                               struct cpufreq_policy *policy,
-                                               unsigned int target_freq)
-{
-        unsigned int max_freq;
-
-        update_turbo_state();
-
-        max_freq = limits->no_turbo || limits->turbo_disabled ?
-                        cpu->pstate.max_freq : cpu->pstate.turbo_freq;
-        policy->cpuinfo.max_freq = max_freq;
-        if (policy->max > max_freq)
-                policy->max = max_freq;
-
-        if (target_freq > max_freq)
-                target_freq = max_freq;
-
-        return target_freq;
-}
-
 static int intel_cpufreq_target(struct cpufreq_policy *policy,
                                 unsigned int target_freq,
                                 unsigned int relation)
@@ -2337,8 +2273,10 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
         struct cpufreq_freqs freqs;
         int target_pstate;
 
+        update_turbo_state();
+
         freqs.old = policy->cur;
-        freqs.new = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        freqs.new = target_freq;
 
         cpufreq_freq_transition_begin(policy, &freqs);
         switch (relation) {
@@ -2370,7 +2308,8 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy,
         struct cpudata *cpu = all_cpu_data[policy->cpu];
         int target_pstate;
 
-        target_freq = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        update_turbo_state();
+
         target_pstate = DIV_ROUND_UP(target_freq, cpu->pstate.scaling);
         target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
         intel_pstate_update_pstate(cpu, target_pstate);
@@ -2425,13 +2364,7 @@ static int intel_pstate_register_driver(void)
 {
         int ret;
 
-        intel_pstate_init_limits(&powersave_limits);
-        intel_pstate_set_performance_limits(&performance_limits);
-        if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE) &&
-            intel_pstate_driver == &intel_pstate)
-                limits = &performance_limits;
-        else
-                limits = &powersave_limits;
+        intel_pstate_init_limits(&global);
 
         ret = cpufreq_register_driver(intel_pstate_driver);
         if (ret) {
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 370593006f5f..cda8f62d555b 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -175,6 +175,24 @@ static int powernv_cpuidle_driver_init(void)
                 drv->state_count += 1;
         }
 
+        /*
+         * On the PowerNV platform cpu_present may be less than cpu_possible in
+         * cases when firmware detects the CPU, but it is not available to the
+         * OS.  If CONFIG_HOTPLUG_CPU=n, then such CPUs are not hotplugable at
+         * run time and hence cpu_devices are not created for those CPUs by the
+         * generic topology_init().
+         *
+         * drv->cpumask defaults to cpu_possible_mask in
+         * __cpuidle_driver_init().  This breaks cpuidle on PowerNV where
+         * cpu_devices are not created for CPUs in cpu_possible_mask that
+         * cannot be hot-added later at run time.
+         *
+         * Trying cpuidle_register_device() on a CPU without a cpu_device is
+         * incorrect, so pass a correct CPU mask to the generic cpuidle driver.
+         */
+
+        drv->cpumask = (struct cpumask *)cpu_present_mask;
+
         return 0;
 }
 
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index c5adc8c9ac43..ae948b1da93a 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -615,6 +615,18 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
         struct device *cpu_dev = get_cpu_device((unsigned long)dev->cpu);
         int error;
 
+        /*
+         * Return if cpu_device is not setup for this CPU.
+         *
+         * This could happen if the arch did not set up cpu_device
+         * since this CPU is not in cpu_present mask and the
+         * driver did not send a correct CPU mask during registration.
+         * Without this check we would end up passing bogus
+         * value for &cpu_dev->kobj in kobject_init_and_add()
+         */
+        if (!cpu_dev)
+                return -ENODEV;
+
         kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
         if (!kdev)
                 return -ENOMEM;
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 32100c4851dd..49cbdcba7883 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -506,7 +506,7 @@ static int caam_rsa_init_tfm(struct crypto_akcipher *tfm)
         ctx->dev = caam_jr_alloc();
 
         if (IS_ERR(ctx->dev)) {
-                dev_err(ctx->dev, "Job Ring Device allocation for transform failed\n");
+                pr_err("Job Ring Device allocation for transform failed\n");
                 return PTR_ERR(ctx->dev);
         }
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index fef39f9f41ee..5d7f73d60515 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -281,7 +281,8 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
                         /* Try to run it through DECO0 */
                         ret = run_descriptor_deco0(ctrldev, desc, &status);
 
-                        if (ret || status) {
+                        if (ret ||
+                            (status && status != JRSTA_SSRC_JUMP_HALT_CC)) {
                                 dev_err(ctrldev,
                                         "Failed to deinstantiate RNG4 SH%d\n",
                                         sh_idx);
@@ -301,15 +302,13 @@ static int caam_remove(struct platform_device *pdev)
         struct device *ctrldev;
         struct caam_drv_private *ctrlpriv;
         struct caam_ctrl __iomem *ctrl;
-        int ring;
 
         ctrldev = &pdev->dev;
         ctrlpriv = dev_get_drvdata(ctrldev);
         ctrl = (struct caam_ctrl __iomem *)ctrlpriv->ctrl;
 
-        /* Remove platform devices for JobRs */
-        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++)
-                of_device_unregister(ctrlpriv->jrpdev[ring]);
+        /* Remove platform devices under the crypto node */
+        of_platform_depopulate(ctrldev);
 
         /* De-initialize RNG state handles initialized by this driver. */
         if (ctrlpriv->rng4_sh_init)
@@ -418,10 +417,21 @@ DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u32_ro, caam_debugfs_u32_get, NULL, "%llu\n");
 DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u64_ro, caam_debugfs_u64_get, NULL, "%llu\n");
 #endif
 
+static const struct of_device_id caam_match[] = {
+        {
+                .compatible = "fsl,sec-v4.0",
+        },
+        {
+                .compatible = "fsl,sec4.0",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, caam_match);
+
 /* Probe routine for CAAM top (controller) level */
 static int caam_probe(struct platform_device *pdev)
 {
-        int ret, ring, ridx, rspec, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
+        int ret, ring, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
         struct device *dev;
         struct device_node *nprop, *np;
@@ -597,47 +607,24 @@ static int caam_probe(struct platform_device *pdev)
                 goto iounmap_ctrl;
         }
 
-        /*
-         * Detect and enable JobRs
-         * First, find out how many ring spec'ed, allocate references
-         * for all, then go probe each one.
-         */
-        rspec = 0;
-        for_each_available_child_of_node(nprop, np)
-                if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
-                    of_device_is_compatible(np, "fsl,sec4.0-job-ring"))
-                        rspec++;
-
-        ctrlpriv->jrpdev = devm_kcalloc(&pdev->dev, rspec,
-                                        sizeof(*ctrlpriv->jrpdev), GFP_KERNEL);
-        if (ctrlpriv->jrpdev == NULL) {
-                ret = -ENOMEM;
+        ret = of_platform_populate(nprop, caam_match, NULL, dev);
+        if (ret) {
+                dev_err(dev, "JR platform devices creation error\n");
                 goto iounmap_ctrl;
         }
 
         ring = 0;
-        ridx = 0;
-        ctrlpriv->total_jobrs = 0;
         for_each_available_child_of_node(nprop, np)
                 if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
                     of_device_is_compatible(np, "fsl,sec4.0-job-ring")) {
-                        ctrlpriv->jrpdev[ring] =
-                                of_platform_device_create(np, NULL, dev);
-                        if (!ctrlpriv->jrpdev[ring]) {
-                                pr_warn("JR physical index %d: Platform device creation error\n",
-                                        ridx);
-                                ridx++;
-                                continue;
-                        }
                         ctrlpriv->jr[ring] = (struct caam_job_ring __iomem __force *)
                                              ((__force uint8_t *)ctrl +
-                                             (ridx + JR_BLOCK_NUMBER) *
+                                             (ring + JR_BLOCK_NUMBER) *
                                               BLOCK_OFFSET
                                              );
                         ctrlpriv->total_jobrs++;
                         ring++;
-                        ridx++;
-        }
+                }
 
         /* Check to see if QI present. If so, enable */
         ctrlpriv->qi_present =
@@ -847,17 +834,6 @@ disable_caam_ipg:
         return ret;
 }
 
-static struct of_device_id caam_match[] = {
-        {
-                .compatible = "fsl,sec-v4.0",
-        },
-        {
-                .compatible = "fsl,sec4.0",
-        },
-        {},
-};
-MODULE_DEVICE_TABLE(of, caam_match);
-
 static struct platform_driver caam_driver = {
         .driver = {
                 .name = "caam",
diff --git a/drivers/crypto/caam/intern.h b/drivers/crypto/caam/intern.h
index e2bcacc1a921..dbed8baeebe5 100644
--- a/drivers/crypto/caam/intern.h
+++ b/drivers/crypto/caam/intern.h
@@ -66,7 +66,6 @@ struct caam_drv_private_jr {
 struct caam_drv_private {
 
         struct device *dev;
-        struct platform_device **jrpdev; /* Alloc'ed array per sub-device */
         struct platform_device *pdev;
 
         /* Physical-presence section */
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index 41cc853f8569..fc08b4ed69d9 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -1015,6 +1015,7 @@ const struct ccp_vdata ccpv5a = {
 
 const struct ccp_vdata ccpv5b = {
         .version = CCP_VERSION(5, 0),
+        .dma_chan_attr = DMA_PRIVATE,
         .setup = ccp5other_config,
         .perform = &ccp5_actions,
         .bar = 2,
diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index 511ab042b5e7..92d1c6959f08 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -283,11 +283,14 @@ EXPORT_SYMBOL_GPL(ccp_version);
  */
 int ccp_enqueue_cmd(struct ccp_cmd *cmd)
 {
-        struct ccp_device *ccp = ccp_get_device();
+        struct ccp_device *ccp;
         unsigned long flags;
         unsigned int i;
         int ret;
 
+        /* Some commands might need to be sent to a specific device */
+        ccp = cmd->ccp ? cmd->ccp : ccp_get_device();
+
         if (!ccp)
                 return -ENODEV;
 
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 2b5c01fade05..aa36f3f81860 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -179,6 +179,10 @@
 
 /* ------------------------ General CCP Defines ------------------------ */
 
+#define CCP_DMA_DFLT                    0x0
+#define CCP_DMA_PRIV                    0x1
+#define CCP_DMA_PUB                     0x2
+
 #define CCP_DMAPOOL_MAX_SIZE            64
 #define CCP_DMAPOOL_ALIGN               BIT(5)
 
@@ -636,6 +640,7 @@ struct ccp_actions {
 /* Structure to hold CCP version-specific values */
 struct ccp_vdata {
         const unsigned int version;
+        const unsigned int dma_chan_attr;
         void (*setup)(struct ccp_device *);
         const struct ccp_actions *perform;
         const unsigned int bar;
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index e5d9278f4019..e00be01fbf5a 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -10,6 +10,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/dmaengine.h>
 #include <linux/spinlock.h>
@@ -25,6 +26,37 @@
         (mask == 0) ? 64 : fls64(mask); \
 })
 
+/* The CCP as a DMA provider can be configured for public or private
+ * channels. Default is specified in the vdata for the device (PCI ID).
+ * This module parameter will override for all channels on all devices:
+ *   dma_chan_attr = 0x2 to force all channels public
+ *                 = 0x1 to force all channels private
+ *                 = 0x0 to defer to the vdata setting
+ *                 = any other value: warning, revert to 0x0
+ */
+static unsigned int dma_chan_attr = CCP_DMA_DFLT;
+module_param(dma_chan_attr, uint, 0444);
+MODULE_PARM_DESC(dma_chan_attr, "Set DMA channel visibility: 0 (default) = device defaults, 1 = make private, 2 = make public");
+
+unsigned int ccp_get_dma_chan_attr(struct ccp_device *ccp)
+{
+        switch (dma_chan_attr) {
+        case CCP_DMA_DFLT:
+                return ccp->vdata->dma_chan_attr;
+
+        case CCP_DMA_PRIV:
+                return DMA_PRIVATE;
+
+        case CCP_DMA_PUB:
+                return 0;
+
+        default:
+                dev_info_once(ccp->dev, "Invalid value for dma_chan_attr: %d\n",
+                              dma_chan_attr);
+                return ccp->vdata->dma_chan_attr;
+        }
+}
+
 static void ccp_free_cmd_resources(struct ccp_device *ccp,
                                    struct list_head *list)
 {
@@ -390,6 +422,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
                         goto err;
 
                 ccp_cmd = &cmd->ccp_cmd;
+                ccp_cmd->ccp = chan->ccp;
                 ccp_pt = &ccp_cmd->u.passthru_nomap;
                 ccp_cmd->flags = CCP_CMD_MAY_BACKLOG;
                 ccp_cmd->flags |= CCP_CMD_PASSTHRU_NO_DMA_MAP;
@@ -674,6 +707,15 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
         dma_cap_set(DMA_SG, dma_dev->cap_mask);
         dma_cap_set(DMA_INTERRUPT, dma_dev->cap_mask);
 
+        /* The DMA channels for this device can be set to public or private,
+         * and overridden by the module parameter dma_chan_attr.
+         * Default: according to the value in vdata (dma_chan_attr=0)
+         * dma_chan_attr=0x1: all channels private (override vdata)
+         * dma_chan_attr=0x2: all channels public (override vdata)
+         */
+        if (ccp_get_dma_chan_attr(ccp) == DMA_PRIVATE)
+                dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
+
         INIT_LIST_HEAD(&dma_dev->channels);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 chan = ccp->ccp_dma_chan + i;
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index 3e2ab3b14eea..9e95bf94eb13 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -2,6 +2,7 @@ menuconfig DEV_DAX
         tristate "DAX: direct access to differentiated memory"
         default m if NVDIMM_DAX
         depends on TRANSPARENT_HUGEPAGE
+        select SRCU
         help
           Support raw access to differentiated (persistence, bandwidth,
           latency...) memory via an mmap(2) capable character
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 80c6db279ae1..806f180c80d8 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -25,6 +25,7 @@
 #include "dax.h"
 
 static dev_t dax_devt;
+DEFINE_STATIC_SRCU(dax_srcu);
 static struct class *dax_class;
 static DEFINE_IDA(dax_minor_ida);
 static int nr_dax = CONFIG_NR_DEV_DAX;
@@ -60,7 +61,7 @@ struct dax_region {
  * @region - parent region
  * @dev - device backing the character device
  * @cdev - core chardev data
- * @alive - !alive + rcu grace period == no new mappings can be established
+ * @alive - !alive + srcu grace period == no new mappings can be established
  * @id - child id in the region
  * @num_resources - number of physical address extents in this device
  * @res - array of physical address ranges
@@ -569,7 +570,7 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
 static int dax_dev_huge_fault(struct vm_fault *vmf,
                 enum page_entry_size pe_size)
 {
-        int rc;
+        int rc, id;
         struct file *filp = vmf->vma->vm_file;
         struct dax_dev *dax_dev = filp->private_data;
 
@@ -578,7 +579,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
                         ? "write" : "read",
                         vmf->vma->vm_start, vmf->vma->vm_end);
 
-        rcu_read_lock();
+        id = srcu_read_lock(&dax_srcu);
         switch (pe_size) {
         case PE_SIZE_PTE:
                 rc = __dax_dev_pte_fault(dax_dev, vmf);
@@ -592,7 +593,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
         default:
                 return VM_FAULT_FALLBACK;
         }
-        rcu_read_unlock();
+        srcu_read_unlock(&dax_srcu, id);
 
         return rc;
 }
@@ -713,11 +714,11 @@ static void unregister_dax_dev(void *dev)
          * Note, rcu is not protecting the liveness of dax_dev, rcu is
          * ensuring that any fault handlers that might have seen
          * dax_dev->alive == true, have completed.  Any fault handlers
-         * that start after synchronize_rcu() has started will abort
+         * that start after synchronize_srcu() has started will abort
          * upon seeing dax_dev->alive == false.
          */
         dax_dev->alive = false;
-        synchronize_rcu();
+        synchronize_srcu(&dax_srcu);
         unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
         cdev_del(cdev);
         device_unregister(dev);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index e18dc596cf24..6204cc32d09c 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length(
          */
 
         /* have we filled in period_length yet? */
-        if (*total_len + control_block->length < period_len)
+        if (*total_len + control_block->length < period_len) {
+                /* update number of bytes in this period so far */
+                *total_len += control_block->length;
                 return;
+        }
 
         /* calculate the length that remains to reach period_length */
         control_block->length = period_len - *total_len;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 24e0221fd66d..d9118ec23025 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1108,12 +1108,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr)
         switch (order) {
         case 0 ... 1:
                 return &unmap_pool[0];
+#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
         case 2 ... 4:
                 return &unmap_pool[1];
         case 5 ... 7:
                 return &unmap_pool[2];
         case 8:
                 return &unmap_pool[3];
+#endif
         default:
                 BUG();
                 return NULL;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index 82d85cce81f8..4773f2867234 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -43,6 +43,7 @@ config EDAC_LEGACY_SYSFS
 
 config EDAC_DEBUG
         bool "Debugging"
+        select DEBUG_FS
         help
           This turns on debugging information for the entire EDAC subsystem.
           You do so by inserting edac_module with "edac_debug_level=x." Valid
@@ -259,6 +260,15 @@ config EDAC_SKX
           Support for error detection and correction the Intel
           Skylake server Integrated Memory Controllers.
 
+config EDAC_PND2
+        tristate "Intel Pondicherry2"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        help
+          Support for error detection and correction on the Intel
+          Pondicherry2 Integrated Memory Controller. This SoC IP is
+          first used on the Apollo Lake platform and Denverton
+          micro-server but may appear on others in the future.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index 88e472e8b9a9..587107e90996 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_EDAC_I7300)		+= i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
 obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
+obj-$(CONFIG_EDAC_PND2)                 += pnd2_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 1670d27bcac8..f683919981b0 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci)
                         dimm->mtype = MEM_FB_DDR2;
 
                         /* ask what device type on this row */
-                        if (MTR_DRAM_WIDTH(mtr))
+                        if (MTR_DRAM_WIDTH(mtr) == 8)
                                 dimm->dtype = DEV_X8;
                         else
                                 dimm->dtype = DEV_X4;
diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
index abf6ef22e220..37a9ba71da44 100644
--- a/drivers/edac/i5400_edac.c
+++ b/drivers/edac/i5400_edac.c
@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci)
 
                         dimm->nr_pages = size_mb << 8;
                         dimm->grain = 8;
-                        dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4;
+                        dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ?
+                                      DEV_X8 : DEV_X4;
                         dimm->mtype = MEM_FB_DDR2;
                         /*
                          * The eccc mechanism is SDDC (aka SECC), with
                          * is similar to Chipkill.
                          */
-                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ?
+                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ?
                                           EDAC_S8ECD8ED : EDAC_S4ECD4ED;
                         ndimms++;
                 }
diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
new file mode 100644
index 000000000000..928e0dba41fc
--- /dev/null
+++ b/drivers/edac/pnd2_edac.c
@@ -0,0 +1,1546 @@
+/*
+ * Driver for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * [Derived from sb_edac.c]
+ *
+ * Translation of system physical addresses to DIMM addresses
+ * is a two stage process:
+ *
+ * First the Pondicherry 2 memory controller handles slice and channel interleaving
+ * in "sys2pmi()". This is (almost) completley common between platforms.
+ *
+ * Then a platform specific dunit (DIMM unit) completes the process to provide DIMM,
+ * rank, bank, row and column using the appropriate "dunit_ops" functions/parameters.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_mc.h"
+#include "edac_module.h"
+#include "pnd2_edac.h"
+
+#define APL_NUM_CHANNELS        4
+#define DNV_NUM_CHANNELS        2
+#define DNV_MAX_DIMMS           2 /* Max DIMMs per channel */
+
+enum type {
+        APL,
+        DNV, /* All requests go to PMI CH0 on each slice (CH1 disabled) */
+};
+
+struct dram_addr {
+        int chan;
+        int dimm;
+        int rank;
+        int bank;
+        int row;
+        int col;
+};
+
+struct pnd2_pvt {
+        int dimm_geom[APL_NUM_CHANNELS];
+        u64 tolm, tohm;
+};
+
+/*
+ * System address space is divided into multiple regions with
+ * different interleave rules in each. The as0/as1 regions
+ * have no interleaving at all. The as2 region is interleaved
+ * between two channels. The mot region is magic and may overlap
+ * other regions, with its interleave rules taking precedence.
+ * Addresses not in any of these regions are interleaved across
+ * all four channels.
+ */
+static struct region {
+        u64     base;
+        u64     limit;
+        u8      enabled;
+} mot, as0, as1, as2;
+
+static struct dunit_ops {
+        char *name;
+        enum type type;
+        int pmiaddr_shift;
+        int pmiidx_shift;
+        int channels;
+        int dimms_per_channel;
+        int (*rd_reg)(int port, int off, int op, void *data, size_t sz, char *name);
+        int (*get_registers)(void);
+        int (*check_ecc)(void);
+        void (*mk_region)(char *name, struct region *rp, void *asym);
+        void (*get_dimm_config)(struct mem_ctl_info *mci);
+        int (*pmi2mem)(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                   struct dram_addr *daddr, char *msg);
+} *ops;
+
+static struct mem_ctl_info *pnd2_mci;
+
+#define PND2_MSG_SIZE   256
+
+/* Debug macros */
+#define pnd2_printk(level, fmt, arg...)                 \
+        edac_printk(level, "pnd2", fmt, ##arg)
+
+#define pnd2_mc_printk(mci, level, fmt, arg...) \
+        edac_mc_chipset_printk(mci, level, "pnd2", fmt, ##arg)
+
+#define MOT_CHAN_INTLV_BIT_1SLC_2CH 12
+#define MOT_CHAN_INTLV_BIT_2SLC_2CH 13
+#define SELECTOR_DISABLED (-1)
+#define _4GB (1ul << 32)
+
+#define PMI_ADDRESS_WIDTH       31
+#define PND_MAX_PHYS_BIT        39
+
+#define APL_ASYMSHIFT           28
+#define DNV_ASYMSHIFT           31
+#define CH_HASH_MASK_LSB        6
+#define SLICE_HASH_MASK_LSB     6
+#define MOT_SLC_INTLV_BIT       12
+#define LOG2_PMI_ADDR_GRANULARITY       5
+#define MOT_SHIFT       24
+
+#define GET_BITFIELD(v, lo, hi) (((v) & GENMASK_ULL(hi, lo)) >> (lo))
+#define U64_LSHIFT(val, s)      ((u64)(val) << (s))
+
+#ifdef CONFIG_X86_INTEL_SBI_APL
+#include "linux/platform_data/sbi_apl.h"
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        struct sbi_apl_message sbi_arg;
+        int ret, read = 0;
+
+        memset(&sbi_arg, 0, sizeof(sbi_arg));
+
+        if (op == 0 || op == 4 || op == 6)
+                read = 1;
+        else
+                sbi_arg.data = *data;
+
+        sbi_arg.opcode = op;
+        sbi_arg.port_address = port;
+        sbi_arg.register_offset = off;
+        ret = sbi_apl_commit(&sbi_arg);
+        if (ret || sbi_arg.status)
+                edac_dbg(2, "sbi_send status=%d ret=%d data=%x\n",
+                                 sbi_arg.status, ret, sbi_arg.data);
+
+        if (ret == 0)
+                ret = sbi_arg.status;
+
+        if (ret == 0 && read)
+                *data = sbi_arg.data;
+
+        return ret;
+}
+#else
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        return -EUNATCH;
+}
+#endif
+
+static int apl_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        int     ret = 0;
+
+        edac_dbg(2, "Read %s port=%x off=%x op=%x\n", name, port, off, op);
+        switch (sz) {
+        case 8:
+                ret = sbi_send(port, off + 4, op, (u32 *)(data + 4));
+        case 4:
+                ret = sbi_send(port, off, op, (u32 *)data);
+                pnd2_printk(KERN_DEBUG, "%s=%x%08x ret=%d\n", name,
+                                        sz == 8 ? *((u32 *)(data + 4)) : 0, *((u32 *)data), ret);
+                break;
+        }
+
+        return ret;
+}
+
+static u64 get_mem_ctrl_hub_base_addr(void)
+{
+        struct b_cr_mchbar_lo_pci lo;
+        struct b_cr_mchbar_hi_pci hi;
+        struct pci_dev *pdev;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x48, (u32 *)&lo);
+                pci_read_config_dword(pdev, 0x4c, (u32 *)&hi);
+                pci_dev_put(pdev);
+        } else {
+                return 0;
+        }
+
+        if (!lo.enable) {
+                edac_dbg(2, "MMIO via memory controller hub base address is disabled!\n");
+                return 0;
+        }
+
+        return U64_LSHIFT(hi.base, 32) | U64_LSHIFT(lo.base, 15);
+}
+
+static u64 get_sideband_reg_base_addr(void)
+{
+        struct pci_dev *pdev;
+        u32 hi, lo;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x19dd, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x10, &lo);
+                pci_read_config_dword(pdev, 0x14, &hi);
+                pci_dev_put(pdev);
+                return (U64_LSHIFT(hi, 32) | U64_LSHIFT(lo, 0));
+        } else {
+                return 0xfd000000;
+        }
+}
+
+static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        struct pci_dev *pdev;
+        char *base;
+        u64 addr;
+
+        if (op == 4) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+                if (!pdev)
+                        return -ENODEV;
+
+                pci_read_config_dword(pdev, off, data);
+                pci_dev_put(pdev);
+        } else {
+                /* MMIO via memory controller hub base address */
+                if (op == 0 && port == 0x4c) {
+                        addr = get_mem_ctrl_hub_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                } else {
+                        /* MMIO via sideband register base address */
+                        addr = get_sideband_reg_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                        addr += (port << 16);
+                }
+
+                base = ioremap((resource_size_t)addr, 0x10000);
+                if (!base)
+                        return -ENODEV;
+
+                if (sz == 8)
+                        *(u32 *)(data + 4) = *(u32 *)(base + off + 4);
+                *(u32 *)data = *(u32 *)(base + off);
+
+                iounmap(base);
+        }
+
+        edac_dbg(2, "Read %s=%.8x_%.8x\n", name,
+                        (sz == 8) ? *(u32 *)(data + 4) : 0, *(u32 *)data);
+
+        return 0;
+}
+
+#define RD_REGP(regp, regname, port)    \
+        ops->rd_reg(port,                                       \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+#define RD_REG(regp, regname)                   \
+        ops->rd_reg(regname ## _port,           \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+static u64 top_lm, top_hm;
+static bool two_slices;
+static bool two_channels; /* Both PMI channels in one slice enabled */
+
+static u8 sym_chan_mask;
+static u8 asym_chan_mask;
+static u8 chan_mask;
+
+static int slice_selector = -1;
+static int chan_selector = -1;
+static u64 slice_hash_mask;
+static u64 chan_hash_mask;
+
+static void mk_region(char *name, struct region *rp, u64 base, u64 limit)
+{
+        rp->enabled = 1;
+        rp->base = base;
+        rp->limit = limit;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, limit);
+}
+
+static void mk_region_mask(char *name, struct region *rp, u64 base, u64 mask)
+{
+        if (mask == 0) {
+                pr_info(FW_BUG "MOT mask cannot be zero\n");
+                return;
+        }
+        if (mask != GENMASK_ULL(PND_MAX_PHYS_BIT, __ffs(mask))) {
+                pr_info(FW_BUG "MOT mask not power of two\n");
+                return;
+        }
+        if (base & ~mask) {
+                pr_info(FW_BUG "MOT region base/mask alignment error\n");
+                return;
+        }
+        rp->base = base;
+        rp->limit = (base | ~mask) & GENMASK_ULL(PND_MAX_PHYS_BIT, 0);
+        rp->enabled = 1;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, rp->limit);
+}
+
+static bool in_region(struct region *rp, u64 addr)
+{
+        if (!rp->enabled)
+                return false;
+
+        return rp->base <= addr && addr <= rp->limit;
+}
+
+static int gen_sym_mask(struct b_cr_slice_channel_hash *p)
+{
+        int mask = 0;
+
+        if (!p->slice_0_mem_disabled)
+                mask |= p->sym_slice0_channel_enabled;
+
+        if (!p->slice_1_disabled)
+                mask |= p->sym_slice1_channel_enabled << 2;
+
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static int gen_asym_mask(struct b_cr_slice_channel_hash *p,
+                         struct b_cr_asym_mem_region0_mchbar *as0,
+                         struct b_cr_asym_mem_region1_mchbar *as1,
+                         struct b_cr_asym_2way_mem_region_mchbar *as2way)
+{
+        const int intlv[] = { 0x5, 0xA, 0x3, 0xC };
+        int mask = 0;
+
+        if (as2way->asym_2way_interleave_enable)
+                mask = intlv[as2way->asym_2way_intlv_mode];
+        if (as0->slice0_asym_enable)
+                mask |= (1 << as0->slice0_asym_channel_select);
+        if (as1->slice1_asym_enable)
+                mask |= (4 << as1->slice1_asym_channel_select);
+        if (p->slice_0_mem_disabled)
+                mask &= 0xc;
+        if (p->slice_1_disabled)
+                mask &= 0x3;
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static struct b_cr_tolud_pci tolud;
+static struct b_cr_touud_lo_pci touud_lo;
+static struct b_cr_touud_hi_pci touud_hi;
+static struct b_cr_asym_mem_region0_mchbar asym0;
+static struct b_cr_asym_mem_region1_mchbar asym1;
+static struct b_cr_asym_2way_mem_region_mchbar asym_2way;
+static struct b_cr_mot_out_base_mchbar mot_base;
+static struct b_cr_mot_out_mask_mchbar mot_mask;
+static struct b_cr_slice_channel_hash chash;
+
+/* Apollo Lake dunit */
+/*
+ * Validated on board with just two DIMMs in the [0] and [2] positions
+ * in this array. Other port number matches documentation, but caution
+ * advised.
+ */
+static const int apl_dports[APL_NUM_CHANNELS] = { 0x18, 0x10, 0x11, 0x19 };
+static struct d_cr_drp0 drp0[APL_NUM_CHANNELS];
+
+/* Denverton dunit */
+static const int dnv_dports[DNV_NUM_CHANNELS] = { 0x10, 0x12 };
+static struct d_cr_dsch dsch;
+static struct d_cr_ecc_ctrl ecc_ctrl[DNV_NUM_CHANNELS];
+static struct d_cr_drp drp[DNV_NUM_CHANNELS];
+static struct d_cr_dmap dmap[DNV_NUM_CHANNELS];
+static struct d_cr_dmap1 dmap1[DNV_NUM_CHANNELS];
+static struct d_cr_dmap2 dmap2[DNV_NUM_CHANNELS];
+static struct d_cr_dmap3 dmap3[DNV_NUM_CHANNELS];
+static struct d_cr_dmap4 dmap4[DNV_NUM_CHANNELS];
+static struct d_cr_dmap5 dmap5[DNV_NUM_CHANNELS];
+
+static void apl_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region0_mchbar *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice0_asym_base, APL_ASYMSHIFT),
+                          U64_LSHIFT(a->slice0_asym_limit, APL_ASYMSHIFT) +
+                          GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+}
+
+static void dnv_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region_denverton *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice_asym_base, DNV_ASYMSHIFT),
+                          U64_LSHIFT(a->slice_asym_limit, DNV_ASYMSHIFT) +
+                          GENMASK_ULL(DNV_ASYMSHIFT - 1, 0));
+}
+
+static int apl_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&asym_2way, b_cr_asym_2way_mem_region_mchbar))
+                return -ENODEV;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (RD_REGP(&drp0[i], d_cr_drp0, apl_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+static int dnv_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&dsch, d_cr_dsch))
+                return -ENODEV;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                if (RD_REGP(&ecc_ctrl[i], d_cr_ecc_ctrl, dnv_dports[i]) ||
+                        RD_REGP(&drp[i], d_cr_drp, dnv_dports[i]) ||
+                        RD_REGP(&dmap[i], d_cr_dmap, dnv_dports[i]) ||
+                        RD_REGP(&dmap1[i], d_cr_dmap1, dnv_dports[i]) ||
+                        RD_REGP(&dmap2[i], d_cr_dmap2, dnv_dports[i]) ||
+                        RD_REGP(&dmap3[i], d_cr_dmap3, dnv_dports[i]) ||
+                        RD_REGP(&dmap4[i], d_cr_dmap4, dnv_dports[i]) ||
+                        RD_REGP(&dmap5[i], d_cr_dmap5, dnv_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+/*
+ * Read all the h/w config registers once here (they don't
+ * change at run time. Figure out which address ranges have
+ * which interleave characteristics.
+ */
+static int get_registers(void)
+{
+        const int intlv[] = { 10, 11, 12, 12 };
+
+        if (RD_REG(&tolud, b_cr_tolud_pci) ||
+                RD_REG(&touud_lo, b_cr_touud_lo_pci) ||
+                RD_REG(&touud_hi, b_cr_touud_hi_pci) ||
+                RD_REG(&asym0, b_cr_asym_mem_region0_mchbar) ||
+                RD_REG(&asym1, b_cr_asym_mem_region1_mchbar) ||
+                RD_REG(&mot_base, b_cr_mot_out_base_mchbar) ||
+                RD_REG(&mot_mask, b_cr_mot_out_mask_mchbar) ||
+                RD_REG(&chash, b_cr_slice_channel_hash))
+                return -ENODEV;
+
+        if (ops->get_registers())
+                return -ENODEV;
+
+        if (ops->type == DNV) {
+                /* PMI channel idx (always 0) for asymmetric region */
+                asym0.slice0_asym_channel_select = 0;
+                asym1.slice1_asym_channel_select = 0;
+                /* PMI channel bitmap (always 1) for symmetric region */
+                chash.sym_slice0_channel_enabled = 0x1;
+                chash.sym_slice1_channel_enabled = 0x1;
+        }
+
+        if (asym0.slice0_asym_enable)
+                ops->mk_region("as0", &as0, &asym0);
+
+        if (asym1.slice1_asym_enable)
+                ops->mk_region("as1", &as1, &asym1);
+
+        if (asym_2way.asym_2way_interleave_enable) {
+                mk_region("as2way", &as2,
+                                  U64_LSHIFT(asym_2way.asym_2way_base, APL_ASYMSHIFT),
+                                  U64_LSHIFT(asym_2way.asym_2way_limit, APL_ASYMSHIFT) +
+                                  GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+        }
+
+        if (mot_base.imr_en) {
+                mk_region_mask("mot", &mot,
+                                           U64_LSHIFT(mot_base.mot_out_base, MOT_SHIFT),
+                                           U64_LSHIFT(mot_mask.mot_out_mask, MOT_SHIFT));
+        }
+
+        top_lm = U64_LSHIFT(tolud.tolud, 20);
+        top_hm = U64_LSHIFT(touud_hi.touud, 32) | U64_LSHIFT(touud_lo.touud, 20);
+
+        two_slices = !chash.slice_1_disabled &&
+                                 !chash.slice_0_mem_disabled &&
+                                 (chash.sym_slice0_channel_enabled != 0) &&
+                                 (chash.sym_slice1_channel_enabled != 0);
+        two_channels = !chash.ch_1_disabled &&
+                                 !chash.enable_pmi_dual_data_mode &&
+                                 ((chash.sym_slice0_channel_enabled == 3) ||
+                                 (chash.sym_slice1_channel_enabled == 3));
+
+        sym_chan_mask = gen_sym_mask(&chash);
+        asym_chan_mask = gen_asym_mask(&chash, &asym0, &asym1, &asym_2way);
+        chan_mask = sym_chan_mask | asym_chan_mask;
+
+        if (two_slices && !two_channels) {
+                if (chash.hvm_mode)
+                        slice_selector = 29;
+                else
+                        slice_selector = intlv[chash.interleave_mode];
+        } else if (!two_slices && two_channels) {
+                if (chash.hvm_mode)
+                        chan_selector = 29;
+                else
+                        chan_selector = intlv[chash.interleave_mode];
+        } else if (two_slices && two_channels) {
+                if (chash.hvm_mode) {
+                        slice_selector = 29;
+                        chan_selector = 30;
+                } else {
+                        slice_selector = intlv[chash.interleave_mode];
+                        chan_selector = intlv[chash.interleave_mode] + 1;
+                }
+        }
+
+        if (two_slices) {
+                if (!chash.hvm_mode)
+                        slice_hash_mask = chash.slice_hash_mask << SLICE_HASH_MASK_LSB;
+                if (!two_channels)
+                        slice_hash_mask |= BIT_ULL(slice_selector);
+        }
+
+        if (two_channels) {
+                if (!chash.hvm_mode)
+                        chan_hash_mask = chash.ch_hash_mask << CH_HASH_MASK_LSB;
+                if (!two_slices)
+                        chan_hash_mask |= BIT_ULL(chan_selector);
+        }
+
+        return 0;
+}
+
+/* Get a contiguous memory address (remove the MMIO gap) */
+static u64 remove_mmio_gap(u64 sys)
+{
+        return (sys < _4GB) ? sys : sys - (_4GB - top_lm);
+}
+
+/* Squeeze out one address bit, shift upper part down to fill gap */
+static void remove_addr_bit(u64 *addr, int bitidx)
+{
+        u64     mask;
+
+        if (bitidx == -1)
+                return;
+
+        mask = (1ull << bitidx) - 1;
+        *addr = ((*addr >> 1) & ~mask) | (*addr & mask);
+}
+
+/* XOR all the bits from addr specified in mask */
+static int hash_by_mask(u64 addr, u64 mask)
+{
+        u64 result = addr & mask;
+
+        result = (result >> 32) ^ result;
+        result = (result >> 16) ^ result;
+        result = (result >> 8) ^ result;
+        result = (result >> 4) ^ result;
+        result = (result >> 2) ^ result;
+        result = (result >> 1) ^ result;
+
+        return (int)result & 1;
+}
+
+/*
+ * First stage decode. Take the system address and figure out which
+ * second stage will deal with it based on interleave modes.
+ */
+static int sys2pmi(const u64 addr, u32 *pmiidx, u64 *pmiaddr, char *msg)
+{
+        u64 contig_addr, contig_base, contig_offset, contig_base_adj;
+        int mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                MOT_CHAN_INTLV_BIT_1SLC_2CH;
+        int slice_intlv_bit_rm = SELECTOR_DISABLED;
+        int chan_intlv_bit_rm = SELECTOR_DISABLED;
+        /* Determine if address is in the MOT region. */
+        bool mot_hit = in_region(&mot, addr);
+        /* Calculate the number of symmetric regions enabled. */
+        int sym_channels = hweight8(sym_chan_mask);
+
+        /*
+         * The amount we need to shift the asym base can be determined by the
+         * number of enabled symmetric channels.
+         * NOTE: This can only work because symmetric memory is not supposed
+         * to do a 3-way interleave.
+         */
+        int sym_chan_shift = sym_channels >> 1;
+
+        /* Give up if address is out of range, or in MMIO gap */
+        if (addr >= (1ul << PND_MAX_PHYS_BIT) ||
+           (addr >= top_lm && addr < _4GB) || addr >= top_hm) {
+                snprintf(msg, PND2_MSG_SIZE, "Error address 0x%llx is not DRAM", addr);
+                return -EINVAL;
+        }
+
+        /* Get a contiguous memory address (remove the MMIO gap) */
+        contig_addr = remove_mmio_gap(addr);
+
+        if (in_region(&as0, addr)) {
+                *pmiidx = asym0.slice0_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as0.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice0_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as1, addr)) {
+                *pmiidx = 2u + asym1.slice1_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as1.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice1_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as2, addr) && (asym_2way.asym_2way_intlv_mode == 0x3ul)) {
+                bool channel1;
+
+                mot_intlv_bit = MOT_CHAN_INTLV_BIT_1SLC_2CH;
+                *pmiidx = (asym_2way.asym_2way_intlv_mode & 1) << 1;
+                channel1 = mot_hit ? ((bool)((addr >> mot_intlv_bit) & 1)) :
+                        hash_by_mask(contig_addr, chan_hash_mask);
+                *pmiidx |= (u32)channel1;
+
+                contig_base = remove_mmio_gap(as2.base);
+                chan_intlv_bit_rm = mot_hit ? mot_intlv_bit : chan_selector;
+                contig_offset = contig_addr - contig_base;
+                remove_addr_bit(&contig_offset, chan_intlv_bit_rm);
+                contig_addr = (contig_base >> sym_chan_shift) + contig_offset;
+        } else {
+                /* Otherwise we're in normal, boring symmetric mode. */
+                *pmiidx = 0u;
+
+                if (two_slices) {
+                        bool slice1;
+
+                        if (mot_hit) {
+                                slice_intlv_bit_rm = MOT_SLC_INTLV_BIT;
+                                slice1 = (addr >> MOT_SLC_INTLV_BIT) & 1;
+                        } else {
+                                slice_intlv_bit_rm = slice_selector;
+                                slice1 = hash_by_mask(addr, slice_hash_mask);
+                        }
+
+                        *pmiidx = (u32)slice1 << 1;
+                }
+
+                if (two_channels) {
+                        bool channel1;
+
+                        mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                        MOT_CHAN_INTLV_BIT_1SLC_2CH;
+
+                        if (mot_hit) {
+                                chan_intlv_bit_rm = mot_intlv_bit;
+                                channel1 = (addr >> mot_intlv_bit) & 1;
+                        } else {
+                                chan_intlv_bit_rm = chan_selector;
+                                channel1 = hash_by_mask(contig_addr, chan_hash_mask);
+                        }
+
+                        *pmiidx |= (u32)channel1;
+                }
+        }
+
+        /* Remove the chan_selector bit first */
+        remove_addr_bit(&contig_addr, chan_intlv_bit_rm);
+        /* Remove the slice bit (we remove it second because it must be lower */
+        remove_addr_bit(&contig_addr, slice_intlv_bit_rm);
+        *pmiaddr = contig_addr;
+
+        return 0;
+}
+
+/* Translate PMI address to memory (rank, row, bank, column) */
+#define C(n) (0x10 | (n))       /* column */
+#define B(n) (0x20 | (n))       /* bank */
+#define R(n) (0x40 | (n))       /* row */
+#define RS   (0x80)                     /* rank */
+
+/* addrdec values */
+#define AMAP_1KB        0
+#define AMAP_2KB        1
+#define AMAP_4KB        2
+#define AMAP_RSVD       3
+
+/* dden values */
+#define DEN_4Gb         0
+#define DEN_8Gb         2
+
+/* dwid values */
+#define X8              0
+#define X16             1
+
+static struct dimm_geometry {
+        u8      addrdec;
+        u8      dden;
+        u8      dwid;
+        u8      rowbits, colbits;
+        u16     bits[PMI_ADDRESS_WIDTH];
+} dimms[] = {
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        }
+};
+
+static int bank_hash(u64 pmiaddr, int idx, int shft)
+{
+        int bhash = 0;
+
+        switch (idx) {
+        case 0:
+                bhash ^= ((pmiaddr >> (12 + shft)) ^ (pmiaddr >> (9 + shft))) & 1;
+                break;
+        case 1:
+                bhash ^= (((pmiaddr >> (10 + shft)) ^ (pmiaddr >> (8 + shft))) & 1) << 1;
+                bhash ^= ((pmiaddr >> 22) & 1) << 1;
+                break;
+        case 2:
+                bhash ^= (((pmiaddr >> (13 + shft)) ^ (pmiaddr >> (11 + shft))) & 1) << 2;
+                break;
+        }
+
+        return bhash;
+}
+
+static int rank_hash(u64 pmiaddr)
+{
+        return ((pmiaddr >> 16) ^ (pmiaddr >> 10)) & 1;
+}
+
+/* Second stage decode. Compute rank, bank, row & column. */
+static int apl_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                       struct dram_addr *daddr, char *msg)
+{
+        struct d_cr_drp0 *cr_drp0 = &drp0[pmiidx];
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        int g = pvt->dimm_geom[pmiidx];
+        struct dimm_geometry *d = &dimms[g];
+        int column = 0, bank = 0, row = 0, rank = 0;
+        int i, idx, type, skiprs = 0;
+
+        for (i = 0; i < PMI_ADDRESS_WIDTH; i++) {
+                int     bit = (pmiaddr >> i) & 1;
+
+                if (i + skiprs >= PMI_ADDRESS_WIDTH) {
+                        snprintf(msg, PND2_MSG_SIZE, "Bad dimm_geometry[] table\n");
+                        return -EINVAL;
+                }
+
+                type = d->bits[i + skiprs] & ~0xf;
+                idx = d->bits[i + skiprs] & 0xf;
+
+                /*
+                 * On single rank DIMMs ignore the rank select bit
+                 * and shift remainder of "bits[]" down one place.
+                 */
+                if (type == RS && (cr_drp0->rken0 + cr_drp0->rken1) == 1) {
+                        skiprs = 1;
+                        type = d->bits[i + skiprs] & ~0xf;
+                        idx = d->bits[i + skiprs] & 0xf;
+                }
+
+                switch (type) {
+                case C(0):
+                        column |= (bit << idx);
+                        break;
+                case B(0):
+                        bank |= (bit << idx);
+                        if (cr_drp0->bahen)
+                                bank ^= bank_hash(pmiaddr, idx, d->addrdec);
+                        break;
+                case R(0):
+                        row |= (bit << idx);
+                        break;
+                case RS:
+                        rank = bit;
+                        if (cr_drp0->rsien)
+                                rank ^= rank_hash(pmiaddr);
+                        break;
+                default:
+                        if (bit) {
+                                snprintf(msg, PND2_MSG_SIZE, "Bad translation\n");
+                                return -EINVAL;
+                        }
+                        goto done;
+                }
+        }
+
+done:
+        daddr->col = column;
+        daddr->bank = bank;
+        daddr->row = row;
+        daddr->rank = rank;
+        daddr->dimm = 0;
+
+        return 0;
+}
+
+/* Pluck bit "in" from pmiaddr and return value shifted to bit "out" */
+#define dnv_get_bit(pmi, in, out) ((int)(((pmi) >> (in)) & 1u) << (out))
+
+static int dnv_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                           struct dram_addr *daddr, char *msg)
+{
+        /* Rank 0 or 1 */
+        daddr->rank = dnv_get_bit(pmiaddr, dmap[pmiidx].rs0 + 13, 0);
+        /* Rank 2 or 3 */
+        daddr->rank |= dnv_get_bit(pmiaddr, dmap[pmiidx].rs1 + 13, 1);
+
+        /*
+         * Normally ranks 0,1 are DIMM0, and 2,3 are DIMM1, but we
+         * flip them if DIMM1 is larger than DIMM0.
+         */
+        daddr->dimm = (daddr->rank >= 2) ^ drp[pmiidx].dimmflip;
+
+        daddr->bank = dnv_get_bit(pmiaddr, dmap[pmiidx].ba0 + 6, 0);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].ba1 + 6, 1);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg0 + 6, 2);
+        if (dsch.ddr4en)
+                daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg1 + 6, 3);
+        if (dmap1[pmiidx].bxor) {
+                if (dsch.ddr4en) {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                /* 64/72 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                /* 32/40 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 3);
+                } else {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                }
+        }
+
+        daddr->row = dnv_get_bit(pmiaddr, dmap2[pmiidx].row0 + 6, 0);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row1 + 6, 1);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 2);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row3 + 6, 3);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row4 + 6, 4);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row5 + 6, 5);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 6);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 7);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row8 + 6, 8);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row9 + 6, 9);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row10 + 6, 10);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row11 + 6, 11);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row12 + 6, 12);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row13 + 6, 13);
+        if (dmap4[pmiidx].row14 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row14 + 6, 14);
+        if (dmap4[pmiidx].row15 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row15 + 6, 15);
+        if (dmap4[pmiidx].row16 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row16 + 6, 16);
+        if (dmap4[pmiidx].row17 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row17 + 6, 17);
+
+        daddr->col = dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 3);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 4);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca5 + 6, 5);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca6 + 6, 6);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca7 + 6, 7);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca8 + 6, 8);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca9 + 6, 9);
+        if (!dsch.ddr4en && dmap1[pmiidx].ca11 != 0x3f)
+                daddr->col |= dnv_get_bit(pmiaddr, dmap1[pmiidx].ca11 + 13, 11);
+
+        return 0;
+}
+
+static int check_channel(int ch)
+{
+        if (drp0[ch].dramtype != 0) {
+                pnd2_printk(KERN_INFO, "Unsupported DIMM in channel %d\n", ch);
+                return 1;
+        } else if (drp0[ch].eccen == 0) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int apl_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        /* Check dramtype and ECC mode for each present DIMM */
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (chan_mask & BIT(i))
+                        ret += check_channel(i);
+        return ret ? -EINVAL : 0;
+}
+
+#define DIMMS_PRESENT(d) ((d)->rken0 + (d)->rken1 + (d)->rken2 + (d)->rken3)
+
+static int check_unit(int ch)
+{
+        struct d_cr_drp *d = &drp[ch];
+
+        if (DIMMS_PRESENT(d) && !ecc_ctrl[ch].eccen) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int dnv_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                ret += check_unit(i);
+        return ret ? -EINVAL : 0;
+}
+
+static int get_memory_error_data(struct mem_ctl_info *mci, u64 addr,
+                                                                 struct dram_addr *daddr, char *msg)
+{
+        u64     pmiaddr;
+        u32     pmiidx;
+        int     ret;
+
+        ret = sys2pmi(addr, &pmiidx, &pmiaddr, msg);
+        if (ret)
+                return ret;
+
+        pmiaddr >>= ops->pmiaddr_shift;
+        /* pmi channel idx to dimm channel idx */
+        pmiidx >>= ops->pmiidx_shift;
+        daddr->chan = pmiidx;
+
+        ret = ops->pmi2mem(mci, pmiaddr, pmiidx, daddr, msg);
+        if (ret)
+                return ret;
+
+        edac_dbg(0, "SysAddr=%llx PmiAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         addr, pmiaddr, daddr->chan, daddr->dimm, daddr->rank, daddr->bank, daddr->row, daddr->col);
+
+        return 0;
+}
+
+static void pnd2_mce_output_error(struct mem_ctl_info *mci, const struct mce *m,
+                                  struct dram_addr *daddr)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *optype, msg[PND2_MSG_SIZE];
+        bool ripv = m->mcgstatus & MCG_STATUS_RIPV;
+        bool overflow = m->status & MCI_STATUS_OVER;
+        bool uc_err = m->status & MCI_STATUS_UC;
+        bool recov = m->status & MCI_STATUS_S;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+        int rc;
+
+        tp_event = uc_err ? (ripv ? HW_EVENT_ERR_FATAL : HW_EVENT_ERR_UNCORRECTED) :
+                                                 HW_EVENT_ERR_CORRECTED;
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        /* Only decode errors with an valid address (ADDRV) */
+        if (!(m->status & MCI_STATUS_ADDRV))
+                return;
+
+        rc = get_memory_error_data(mci, m->addr, daddr, msg);
+        if (rc)
+                goto address_error;
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x channel:%d DIMM:%d rank:%d row:%d bank:%d col:%d",
+                 overflow ? " OVERFLOW" : "", (uc_err && recov) ? " recoverable" : "", mscod,
+                 errcode, daddr->chan, daddr->dimm, daddr->rank, daddr->row, daddr->bank, daddr->col);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, m->addr >> PAGE_SHIFT,
+                                                 m->addr & ~PAGE_MASK, 0, daddr->chan, daddr->dimm, -1, optype, msg);
+
+        return;
+
+address_error:
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, 0, 0, 0, -1, -1, -1, msg, "");
+}
+
+static void apl_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        struct dimm_info *dimm;
+        struct d_cr_drp0 *d;
+        u64     capacity;
+        int     i, g;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++) {
+                if (!(chan_mask & BIT(i)))
+                        continue;
+
+                dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, 0, 0);
+                if (!dimm) {
+                        edac_dbg(0, "No allocated DIMM for channel %d\n", i);
+                        continue;
+                }
+
+                d = &drp0[i];
+                for (g = 0; g < ARRAY_SIZE(dimms); g++)
+                        if (dimms[g].addrdec == d->addrdec &&
+                            dimms[g].dden == d->dden &&
+                            dimms[g].dwid == d->dwid)
+                                break;
+
+                if (g == ARRAY_SIZE(dimms)) {
+                        edac_dbg(0, "Channel %d: unrecognized DIMM\n", i);
+                        continue;
+                }
+
+                pvt->dimm_geom[i] = g;
+                capacity = (d->rken0 + d->rken1) * 8 * (1ul << dimms[g].rowbits) *
+                                   (1ul << dimms[g].colbits);
+                edac_dbg(0, "Channel %d: %lld MByte DIMM\n", i, capacity >> (20 - 3));
+                dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                dimm->grain = 32;
+                dimm->dtype = (d->dwid == 0) ? DEV_X8 : DEV_X16;
+                dimm->mtype = MEM_DDR3;
+                dimm->edac_mode = EDAC_SECDED;
+                snprintf(dimm->label, sizeof(dimm->label), "Slice#%d_Chan#%d", i / 2, i % 2);
+        }
+}
+
+static const int dnv_dtypes[] = {
+        DEV_X8, DEV_X4, DEV_X16, DEV_UNKNOWN
+};
+
+static void dnv_get_dimm_config(struct mem_ctl_info *mci)
+{
+        int     i, j, ranks_of_dimm[DNV_MAX_DIMMS], banks, rowbits, colbits, memtype;
+        struct dimm_info *dimm;
+        struct d_cr_drp *d;
+        u64     capacity;
+
+        if (dsch.ddr4en) {
+                memtype = MEM_DDR4;
+                banks = 16;
+                colbits = 10;
+        } else {
+                memtype = MEM_DDR3;
+                banks = 8;
+        }
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++) {
+                if (dmap4[i].row14 == 31)
+                        rowbits = 14;
+                else if (dmap4[i].row15 == 31)
+                        rowbits = 15;
+                else if (dmap4[i].row16 == 31)
+                        rowbits = 16;
+                else if (dmap4[i].row17 == 31)
+                        rowbits = 17;
+                else
+                        rowbits = 18;
+
+                if (memtype == MEM_DDR3) {
+                        if (dmap1[i].ca11 != 0x3f)
+                                colbits = 12;
+                        else
+                                colbits = 10;
+                }
+
+                d = &drp[i];
+                /* DIMM0 is present if rank0 and/or rank1 is enabled */
+                ranks_of_dimm[0] = d->rken0 + d->rken1;
+                /* DIMM1 is present if rank2 and/or rank3 is enabled */
+                ranks_of_dimm[1] = d->rken2 + d->rken3;
+
+                for (j = 0; j < DNV_MAX_DIMMS; j++) {
+                        if (!ranks_of_dimm[j])
+                                continue;
+
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, j, 0);
+                        if (!dimm) {
+                                edac_dbg(0, "No allocated DIMM for channel %d DIMM %d\n", i, j);
+                                continue;
+                        }
+
+                        capacity = ranks_of_dimm[j] * banks * (1ul << rowbits) * (1ul << colbits);
+                        edac_dbg(0, "Channel %d DIMM %d: %lld MByte DIMM\n", i, j, capacity >> (20 - 3));
+                        dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                        dimm->grain = 32;
+                        dimm->dtype = dnv_dtypes[j ? d->dimmdwid0 : d->dimmdwid1];
+                        dimm->mtype = memtype;
+                        dimm->edac_mode = EDAC_SECDED;
+                        snprintf(dimm->label, sizeof(dimm->label), "Chan#%d_DIMM#%d", i, j);
+                }
+        }
+}
+
+static int pnd2_register_mci(struct mem_ctl_info **ppmci)
+{
+        struct edac_mc_layer layers[2];
+        struct mem_ctl_info *mci;
+        struct pnd2_pvt *pvt;
+        int rc;
+
+        rc = ops->check_ecc();
+        if (rc < 0)
+                return rc;
+
+        /* Allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = ops->channels;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = ops->dimms_per_channel;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(*pvt));
+        if (!mci)
+                return -ENOMEM;
+
+        pvt = mci->pvt_info;
+        memset(pvt, 0, sizeof(*pvt));
+
+        mci->mod_name = "pnd2_edac.c";
+        mci->dev_name = ops->name;
+        mci->ctl_name = "Pondicherry2";
+
+        /* Get dimm basic config and the memory layout */
+        ops->get_dimm_config(mci);
+
+        if (edac_mc_add_mc(mci)) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                edac_mc_free(mci);
+                return -EINVAL;
+        }
+
+        *ppmci = mci;
+
+        return 0;
+}
+
+static void pnd2_unregister_mci(struct mem_ctl_info *mci)
+{
+        if (unlikely(!mci || !mci->pvt_info)) {
+                pnd2_printk(KERN_ERR, "Couldn't find mci handler\n");
+                return;
+        }
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(NULL);
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+/*
+ * Callback function registered with core kernel mce code.
+ * Called once for each logged error.
+ */
+static int pnd2_mce_check_error(struct notifier_block *nb, unsigned long val, void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct mem_ctl_info *mci;
+        struct dram_addr daddr;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        mci = pnd2_mci;
+        if (!mci)
+                return NOTIFY_DONE;
+
+        /*
+         * Just let mcelog handle it if the error is
+         * outside the memory controller. A memory error
+         * is indicated by bit 7 = 1 and bits = 8-11,13-15 = 0.
+         * bit 12 has an special meaning.
+         */
+        if ((mce->status & 0xefff) >> 7 != 1)
+                return NOTIFY_DONE;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        pnd2_mc_printk(mci, KERN_INFO, "HANDLING MCE MEMORY ERROR\n");
+        pnd2_mc_printk(mci, KERN_INFO, "CPU %u: Machine Check %s: %llx Bank %u: %llx\n",
+                                   mce->extcpu, type, mce->mcgstatus, mce->bank, mce->status);
+        pnd2_mc_printk(mci, KERN_INFO, "TSC %llx ", mce->tsc);
+        pnd2_mc_printk(mci, KERN_INFO, "ADDR %llx ", mce->addr);
+        pnd2_mc_printk(mci, KERN_INFO, "MISC %llx ", mce->misc);
+        pnd2_mc_printk(mci, KERN_INFO, "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x\n",
+                                   mce->cpuvendor, mce->cpuid, mce->time, mce->socketid, mce->apicid);
+
+        pnd2_mce_output_error(mci, mce, &daddr);
+
+        /* Advice mcelog that the error were handled */
+        return NOTIFY_STOP;
+}
+
+static struct notifier_block pnd2_mce_dec = {
+        .notifier_call  = pnd2_mce_check_error,
+};
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static u64 pnd2_fake_addr;
+#define PND2_BLOB_SIZE 1024
+static char pnd2_result[PND2_BLOB_SIZE];
+static struct dentry *pnd2_test;
+static struct debugfs_blob_wrapper pnd2_blob = {
+        .data = pnd2_result,
+        .size = 0
+};
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct dram_addr daddr;
+        struct mce m;
+
+        *(u64 *)data = val;
+        m.mcgstatus = 0;
+        /* ADDRV + MemRd + Unknown channel */
+        m.status = MCI_STATUS_ADDRV + 0x9f;
+        m.addr = val;
+        pnd2_mce_output_error(pnd2_mci, &m, &daddr);
+        snprintf(pnd2_blob.data, PND2_BLOB_SIZE,
+                         "SysAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         m.addr, daddr.chan, daddr.dimm, daddr.rank, daddr.bank, daddr.row, daddr.col);
+        pnd2_blob.size = strlen(pnd2_blob.data);
+
+        return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static void setup_pnd2_debug(void)
+{
+        pnd2_test = edac_debugfs_create_dir("pnd2_test");
+        edac_debugfs_create_file("pnd2_debug_addr", 0200, pnd2_test,
+                                                         &pnd2_fake_addr, &fops_u64_wo);
+        debugfs_create_blob("pnd2_debug_results", 0400, pnd2_test, &pnd2_blob);
+}
+
+static void teardown_pnd2_debug(void)
+{
+        debugfs_remove_recursive(pnd2_test);
+}
+#else
+static void setup_pnd2_debug(void)      {}
+static void teardown_pnd2_debug(void)   {}
+#endif /* CONFIG_EDAC_DEBUG */
+
+
+static int pnd2_probe(void)
+{
+        int rc;
+
+        edac_dbg(2, "\n");
+        rc = get_registers();
+        if (rc)
+                return rc;
+
+        return pnd2_register_mci(&pnd2_mci);
+}
+
+static void pnd2_remove(void)
+{
+        edac_dbg(0, "\n");
+        pnd2_unregister_mci(pnd2_mci);
+}
+
+static struct dunit_ops apl_ops = {
+                .name                   = "pnd2/apl",
+                .type                   = APL,
+                .pmiaddr_shift          = LOG2_PMI_ADDR_GRANULARITY,
+                .pmiidx_shift           = 0,
+                .channels               = APL_NUM_CHANNELS,
+                .dimms_per_channel      = 1,
+                .rd_reg                 = apl_rd_reg,
+                .get_registers          = apl_get_registers,
+                .check_ecc              = apl_check_ecc_active,
+                .mk_region              = apl_mk_region,
+                .get_dimm_config        = apl_get_dimm_config,
+                .pmi2mem                = apl_pmi2mem,
+};
+
+static struct dunit_ops dnv_ops = {
+                .name                   = "pnd2/dnv",
+                .type                   = DNV,
+                .pmiaddr_shift          = 0,
+                .pmiidx_shift           = 1,
+                .channels               = DNV_NUM_CHANNELS,
+                .dimms_per_channel      = 2,
+                .rd_reg                 = dnv_rd_reg,
+                .get_registers          = dnv_get_registers,
+                .check_ecc              = dnv_check_ecc_active,
+                .mk_region              = dnv_mk_region,
+                .get_dimm_config        = dnv_get_dimm_config,
+                .pmi2mem                = dnv_pmi2mem,
+};
+
+static const struct x86_cpu_id pnd2_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT, 0, (kernel_ulong_t)&apl_ops },
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON, 0, (kernel_ulong_t)&dnv_ops },
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, pnd2_cpuids);
+
+static int __init pnd2_init(void)
+{
+        const struct x86_cpu_id *id;
+        int rc;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(pnd2_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        ops = (struct dunit_ops *)id->driver_data;
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        rc = pnd2_probe();
+        if (rc < 0) {
+                pnd2_printk(KERN_ERR, "Failed to register device with error %d.\n", rc);
+                return rc;
+        }
+
+        if (!pnd2_mci)
+                return -ENODEV;
+
+        mce_register_decode_chain(&pnd2_mce_dec);
+        setup_pnd2_debug();
+
+        return 0;
+}
+
+static void __exit pnd2_exit(void)
+{
+        edac_dbg(2, "\n");
+        teardown_pnd2_debug();
+        mce_unregister_decode_chain(&pnd2_mce_dec);
+        pnd2_remove();
+}
+
+module_init(pnd2_init);
+module_exit(pnd2_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel SoC using Pondicherry memory controller");
diff --git a/drivers/edac/pnd2_edac.h b/drivers/edac/pnd2_edac.h
new file mode 100644
index 000000000000..61b6e79492bb
--- /dev/null
+++ b/drivers/edac/pnd2_edac.h
@@ -0,0 +1,301 @@
+/*
+ * Register bitfield descriptions for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _PND2_REGS_H
+#define _PND2_REGS_H
+
+struct b_cr_touud_lo_pci {
+        u32     lock : 1;
+        u32     reserved_1 : 19;
+        u32     touud : 12;
+};
+
+#define b_cr_touud_lo_pci_port 0x4c
+#define b_cr_touud_lo_pci_offset 0xa8
+#define b_cr_touud_lo_pci_r_opcode 0x04
+
+struct b_cr_touud_hi_pci {
+        u32     touud : 7;
+        u32     reserved_0 : 25;
+};
+
+#define b_cr_touud_hi_pci_port 0x4c
+#define b_cr_touud_hi_pci_offset 0xac
+#define b_cr_touud_hi_pci_r_opcode 0x04
+
+struct b_cr_tolud_pci {
+        u32     lock : 1;
+        u32     reserved_0 : 19;
+        u32     tolud : 12;
+};
+
+#define b_cr_tolud_pci_port 0x4c
+#define b_cr_tolud_pci_offset 0xbc
+#define b_cr_tolud_pci_r_opcode 0x04
+
+struct b_cr_mchbar_lo_pci {
+        u32 enable : 1;
+        u32 pad_3_1 : 3;
+        u32 pad_14_4: 11;
+        u32 base: 17;
+};
+
+struct b_cr_mchbar_hi_pci {
+        u32 base : 7;
+        u32 pad_31_7 : 25;
+};
+
+/* Symmetric region */
+struct b_cr_slice_channel_hash {
+        u64     slice_1_disabled : 1;
+        u64     hvm_mode : 1;
+        u64     interleave_mode : 2;
+        u64     slice_0_mem_disabled : 1;
+        u64     reserved_0 : 1;
+        u64     slice_hash_mask : 14;
+        u64     reserved_1 : 11;
+        u64     enable_pmi_dual_data_mode : 1;
+        u64     ch_1_disabled : 1;
+        u64     reserved_2 : 1;
+        u64     sym_slice0_channel_enabled : 2;
+        u64     sym_slice1_channel_enabled : 2;
+        u64     ch_hash_mask : 14;
+        u64     reserved_3 : 11;
+        u64     lock : 1;
+};
+
+#define b_cr_slice_channel_hash_port 0x4c
+#define b_cr_slice_channel_hash_offset 0x4c58
+#define b_cr_slice_channel_hash_r_opcode 0x06
+
+struct b_cr_mot_out_base_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_base : 15;
+        u32     reserved_1 : 1;
+        u32     tr_en : 1;
+        u32     imr_en : 1;
+};
+
+#define b_cr_mot_out_base_mchbar_port 0x4c
+#define b_cr_mot_out_base_mchbar_offset 0x6af0
+#define b_cr_mot_out_base_mchbar_r_opcode 0x00
+
+struct b_cr_mot_out_mask_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_mask : 15;
+        u32     reserved_1 : 1;
+        u32     ia_iwb_en : 1;
+        u32     gt_iwb_en : 1;
+};
+
+#define b_cr_mot_out_mask_mchbar_port 0x4c
+#define b_cr_mot_out_mask_mchbar_offset 0x6af4
+#define b_cr_mot_out_mask_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region0_mchbar {
+        u32     pad : 4;
+        u32     slice0_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice0_asym_limit : 11;
+        u32     slice0_asym_channel_select : 1;
+        u32     slice0_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region0_mchbar_port 0x4c
+#define b_cr_asym_mem_region0_mchbar_offset 0x6e40
+#define b_cr_asym_mem_region0_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region1_mchbar {
+        u32     pad : 4;
+        u32     slice1_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice1_asym_limit : 11;
+        u32     slice1_asym_channel_select : 1;
+        u32     slice1_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region1_mchbar_port 0x4c
+#define b_cr_asym_mem_region1_mchbar_offset 0x6e44
+#define b_cr_asym_mem_region1_mchbar_r_opcode 0x00
+
+/* Some bit fields moved in above two structs on Denverton */
+struct b_cr_asym_mem_region_denverton {
+        u32     pad : 4;
+        u32     slice_asym_base : 8;
+        u32     pad_19_12 : 8;
+        u32     slice_asym_limit : 8;
+        u32     pad_28_30 : 3;
+        u32     slice_asym_enable : 1;
+};
+
+struct b_cr_asym_2way_mem_region_mchbar {
+        u32     pad : 2;
+        u32     asym_2way_intlv_mode : 2;
+        u32     asym_2way_base : 11;
+        u32     pad_16_15 : 2;
+        u32     asym_2way_limit : 11;
+        u32     pad_30_28 : 3;
+        u32     asym_2way_interleave_enable : 1;
+};
+
+#define b_cr_asym_2way_mem_region_mchbar_port 0x4c
+#define b_cr_asym_2way_mem_region_mchbar_offset 0x6e50
+#define b_cr_asym_2way_mem_region_mchbar_r_opcode 0x00
+
+/* Apollo Lake d-unit */
+
+struct d_cr_drp0 {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     ddmen : 1;
+        u32     rsvd3 : 1;
+        u32     dwid : 2;
+        u32     dden : 3;
+        u32     rsvd13_9 : 5;
+        u32     rsien : 1;
+        u32     bahen : 1;
+        u32     rsvd18_16 : 3;
+        u32     caswizzle : 2;
+        u32     eccen : 1;
+        u32     dramtype : 3;
+        u32     blmode : 3;
+        u32     addrdec : 2;
+        u32     dramdevice_pr : 2;
+};
+
+#define d_cr_drp0_offset 0x1400
+#define d_cr_drp0_r_opcode 0x00
+
+/* Denverton d-unit */
+
+struct d_cr_dsch {
+        u32     ch0en : 1;
+        u32     ch1en : 1;
+        u32     ddr4en : 1;
+        u32     coldwake : 1;
+        u32     newbypdis : 1;
+        u32     chan_width : 1;
+        u32     rsvd6_6 : 1;
+        u32     ooodis : 1;
+        u32     rsvd18_8 : 11;
+        u32     ic : 1;
+        u32     rsvd31_20 : 12;
+};
+
+#define d_cr_dsch_port 0x16
+#define d_cr_dsch_offset 0x0
+#define d_cr_dsch_r_opcode 0x0
+
+struct d_cr_ecc_ctrl {
+        u32     eccen : 1;
+        u32     rsvd31_1 : 31;
+};
+
+#define d_cr_ecc_ctrl_offset 0x180
+#define d_cr_ecc_ctrl_r_opcode 0x0
+
+struct d_cr_drp {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     rken2 : 1;
+        u32     rken3 : 1;
+        u32     dimmdwid0 : 2;
+        u32     dimmdden0 : 2;
+        u32     dimmdwid1 : 2;
+        u32     dimmdden1 : 2;
+        u32     rsvd15_12 : 4;
+        u32     dimmflip : 1;
+        u32     rsvd31_17 : 15;
+};
+
+#define d_cr_drp_offset 0x158
+#define d_cr_drp_r_opcode 0x0
+
+struct d_cr_dmap {
+        u32     ba0 : 5;
+        u32     ba1 : 5;
+        u32     bg0 : 5; /* if ddr3, ba2 = bg0 */
+        u32     bg1 : 5; /* if ddr3, ba3 = bg1 */
+        u32     rs0 : 5;
+        u32     rs1 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap_offset 0x174
+#define d_cr_dmap_r_opcode 0x0
+
+struct d_cr_dmap1 {
+        u32     ca11 : 6;
+        u32     bxor : 1;
+        u32     rsvd : 25;
+};
+
+#define d_cr_dmap1_offset 0xb4
+#define d_cr_dmap1_r_opcode 0x0
+
+struct d_cr_dmap2 {
+        u32     row0 : 5;
+        u32     row1 : 5;
+        u32     row2 : 5;
+        u32     row3 : 5;
+        u32     row4 : 5;
+        u32     row5 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap2_offset 0x148
+#define d_cr_dmap2_r_opcode 0x0
+
+struct d_cr_dmap3 {
+        u32     row6 : 5;
+        u32     row7 : 5;
+        u32     row8 : 5;
+        u32     row9 : 5;
+        u32     row10 : 5;
+        u32     row11 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap3_offset 0x14c
+#define d_cr_dmap3_r_opcode 0x0
+
+struct d_cr_dmap4 {
+        u32     row12 : 5;
+        u32     row13 : 5;
+        u32     row14 : 5;
+        u32     row15 : 5;
+        u32     row16 : 5;
+        u32     row17 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap4_offset 0x150
+#define d_cr_dmap4_r_opcode 0x0
+
+struct d_cr_dmap5 {
+        u32     ca3 : 4;
+        u32     ca4 : 4;
+        u32     ca5 : 4;
+        u32     ca6 : 4;
+        u32     ca7 : 4;
+        u32     ca8 : 4;
+        u32     ca9 : 4;
+        u32     rsvd : 4;
+};
+
+#define d_cr_dmap5_offset 0x154
+#define d_cr_dmap5_r_opcode 0x0
+
+#endif /* _PND2_REGS_H */
diff --git a/drivers/edac/xgene_edac.c b/drivers/edac/xgene_edac.c
index 6c270d9d304a..669246056812 100644
--- a/drivers/edac/xgene_edac.c
+++ b/drivers/edac/xgene_edac.c
@@ -1596,7 +1596,7 @@ static void xgene_edac_pa_report(struct edac_device_ctl_info *edac_dev)
         reg = readl(ctx->dev_csr + IOBPATRANSERRINTSTS);
         if (!reg)
                 goto chk_iob_axi0;
-        dev_err(edac_dev->dev, "IOB procesing agent (PA) transaction error\n");
+        dev_err(edac_dev->dev, "IOB processing agent (PA) transaction error\n");
         if (reg & IOBPA_RDATA_CORRUPT_MASK)
                 dev_err(edac_dev->dev, "IOB PA read data RAM error\n");
         if (reg & IOBPA_M_RDATA_CORRUPT_MASK)
diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index 96bbae579c0b..fc09c76248b4 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig
@@ -44,7 +44,7 @@ config EXTCON_GPIO
 
 config EXTCON_INTEL_INT3496
         tristate "Intel INT3496 ACPI device extcon driver"
-        depends on GPIOLIB && ACPI
+        depends on GPIOLIB && ACPI && (X86 || COMPILE_TEST)
         help
           Say Y here to enable extcon support for USB OTG ports controlled by
           an Intel INT3496 ACPI device.
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index a3131b036de6..9d17984bbbd4 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -45,6 +45,17 @@ static const unsigned int int3496_cable[] = {
         EXTCON_NONE,
 };
 
+static const struct acpi_gpio_params id_gpios = { INT3496_GPIO_USB_ID, 0, false };
+static const struct acpi_gpio_params vbus_gpios = { INT3496_GPIO_VBUS_EN, 0, false };
+static const struct acpi_gpio_params mux_gpios = { INT3496_GPIO_USB_MUX, 0, false };
+
+static const struct acpi_gpio_mapping acpi_int3496_default_gpios[] = {
+        { "id-gpios", &id_gpios, 1 },
+        { "vbus-gpios", &vbus_gpios, 1 },
+        { "mux-gpios", &mux_gpios, 1 },
+        { },
+};
+
 static void int3496_do_usb_id(struct work_struct *work)
 {
         struct int3496_data *data =
@@ -83,6 +94,13 @@ static int int3496_probe(struct platform_device *pdev)
         struct int3496_data *data;
         int ret;
 
+        ret = acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
+                                        acpi_int3496_default_gpios);
+        if (ret) {
+                dev_err(dev, "can't add GPIO ACPI mapping\n");
+                return ret;
+        }
+
         data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -90,30 +108,27 @@ static int int3496_probe(struct platform_device *pdev)
         data->dev = dev;
         INIT_DELAYED_WORK(&data->work, int3496_do_usb_id);
 
-        data->gpio_usb_id = devm_gpiod_get_index(dev, "id",
-                                                INT3496_GPIO_USB_ID,
-                                                GPIOD_IN);
+        data->gpio_usb_id = devm_gpiod_get(dev, "id", GPIOD_IN);
         if (IS_ERR(data->gpio_usb_id)) {
                 ret = PTR_ERR(data->gpio_usb_id);
                 dev_err(dev, "can't request USB ID GPIO: %d\n", ret);
                 return ret;
+        } else if (gpiod_get_direction(data->gpio_usb_id) != GPIOF_DIR_IN) {
+                dev_warn(dev, FW_BUG "USB ID GPIO not in input mode, fixing\n");
+                gpiod_direction_input(data->gpio_usb_id);
         }
 
         data->usb_id_irq = gpiod_to_irq(data->gpio_usb_id);
-        if (data->usb_id_irq <= 0) {
+        if (data->usb_id_irq < 0) {
                 dev_err(dev, "can't get USB ID IRQ: %d\n", data->usb_id_irq);
-                return -EINVAL;
+                return data->usb_id_irq;
         }
 
-        data->gpio_vbus_en = devm_gpiod_get_index(dev, "vbus en",
-                                                 INT3496_GPIO_VBUS_EN,
-                                                 GPIOD_ASIS);
+        data->gpio_vbus_en = devm_gpiod_get(dev, "vbus", GPIOD_ASIS);
         if (IS_ERR(data->gpio_vbus_en))
                 dev_info(dev, "can't request VBUS EN GPIO\n");
 
-        data->gpio_usb_mux = devm_gpiod_get_index(dev, "usb mux",
-                                                 INT3496_GPIO_USB_MUX,
-                                                 GPIOD_ASIS);
+        data->gpio_usb_mux = devm_gpiod_get(dev, "mux", GPIOD_ASIS);
         if (IS_ERR(data->gpio_usb_mux))
                 dev_info(dev, "can't request USB MUX GPIO\n");
 
@@ -154,6 +169,8 @@ static int int3496_remove(struct platform_device *pdev)
         devm_free_irq(&pdev->dev, data->usb_id_irq, data);
         cancel_delayed_work_sync(&data->work);
 
+        acpi_dev_remove_driver_gpios(ACPI_COMPANION(&pdev->dev));
+
         return 0;
 }
 
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index e7d404059b73..b372aad3b449 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -389,7 +389,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
                         return 0;
                 }
         }
-        pr_err_once("requested map not found.\n");
         return -ENOENT;
 }
 
diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index 08b026864d4e..8554d7aec31c 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -254,7 +254,7 @@ void __init efi_esrt_init(void)
 
         rc = efi_mem_desc_lookup(efi.esrt, &md);
         if (rc < 0) {
-                pr_err("ESRT header is not in the memory map.\n");
+                pr_warn("ESRT header is not in the memory map.\n");
                 return;
         }
 
diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
index 932742e4cf23..24c461dea7af 100644
--- a/drivers/firmware/efi/libstub/gop.c
+++ b/drivers/firmware/efi/libstub/gop.c
@@ -149,7 +149,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query32(sys_table_arg, gop32, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
@@ -266,7 +267,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query64(sys_table_arg, gop64, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 9e1a138fed53..16a8951b2bed 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -96,7 +96,7 @@ static int altr_a10sr_gpio_probe(struct platform_device *pdev)
         gpio->regmap = a10sr->regmap;
 
         gpio->gp = altr_a10sr_gc;
-
+        gpio->gp.parent = pdev->dev.parent;
         gpio->gp.of_node = pdev->dev.of_node;
 
         ret = devm_gpiochip_add_data(&pdev->dev, &gpio->gp, gpio);
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 5bddbd507ca9..3fe6a21e05a5 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -90,21 +90,18 @@ static int altera_gpio_irq_set_type(struct irq_data *d,
 
         altera_gc = gpiochip_get_data(irq_data_get_irq_chip_data(d));
 
-        if (type == IRQ_TYPE_NONE)
+        if (type == IRQ_TYPE_NONE) {
+                irq_set_handler_locked(d, handle_bad_irq);
                 return 0;
-        if (type == IRQ_TYPE_LEVEL_HIGH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_RISING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_FALLING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_BOTH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH)
+        }
+        if (type == altera_gc->interrupt_trigger) {
+                if (type == IRQ_TYPE_LEVEL_HIGH)
+                        irq_set_handler_locked(d, handle_level_irq);
+                else
+                        irq_set_handler_locked(d, handle_simple_irq);
                 return 0;
-
+        }
+        irq_set_handler_locked(d, handle_bad_irq);
         return -EINVAL;
 }
 
@@ -230,7 +227,6 @@ static void altera_gpio_irq_edge_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
-
 static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc)
 {
         struct altera_gpio_chip *altera_gc;
@@ -310,7 +306,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
         altera_gc->interrupt_trigger = reg;
 
         ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0,
-                handle_simple_irq, IRQ_TYPE_NONE);
+                handle_bad_irq, IRQ_TYPE_NONE);
 
         if (ret) {
                 dev_err(&pdev->dev, "could not add irqchip\n");
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index bdb692345428..2a57d024481d 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -270,8 +270,10 @@ mcp23s08_direction_output(struct gpio_chip *chip, unsigned offset, int value)
 static irqreturn_t mcp23s08_irq(int irq, void *data)
 {
         struct mcp23s08 *mcp = data;
-        int intcap, intf, i;
+        int intcap, intf, i, gpio, gpio_orig, intcap_mask;
         unsigned int child_irq;
+        bool intf_set, intcap_changed, gpio_bit_changed,
+                defval_changed, gpio_set;
 
         mutex_lock(&mcp->lock);
         if (mcp_read(mcp, MCP_INTF, &intf) < 0) {
@@ -287,14 +289,67 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
         }
 
         mcp->cache[MCP_INTCAP] = intcap;
+
+        /* This clears the interrupt(configurable on S18) */
+        if (mcp_read(mcp, MCP_GPIO, &gpio) < 0) {
+                mutex_unlock(&mcp->lock);
+                return IRQ_HANDLED;
+        }
+        gpio_orig = mcp->cache[MCP_GPIO];
+        mcp->cache[MCP_GPIO] = gpio;
         mutex_unlock(&mcp->lock);
 
+        if (mcp->cache[MCP_INTF] == 0) {
+                /* There is no interrupt pending */
+                return IRQ_HANDLED;
+        }
+
+        dev_dbg(mcp->chip.parent,
+                "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n",
+                intcap, intf, gpio_orig, gpio);
 
         for (i = 0; i < mcp->chip.ngpio; i++) {
-                if ((BIT(i) & mcp->cache[MCP_INTF]) &&
-                    ((BIT(i) & intcap & mcp->irq_rise) ||
-                     (mcp->irq_fall & ~intcap & BIT(i)) ||
-                     (BIT(i) & mcp->cache[MCP_INTCON]))) {
+                /* We must check all of the inputs on the chip,
+                 * otherwise we may not notice a change on >=2 pins.
+                 *
+                 * On at least the mcp23s17, INTCAP is only updated
+                 * one byte at a time(INTCAPA and INTCAPB are
+                 * not written to at the same time - only on a per-bank
+                 * basis).
+                 *
+                 * INTF only contains the single bit that caused the
+                 * interrupt per-bank.  On the mcp23s17, there is
+                 * INTFA and INTFB.  If two pins are changed on the A
+                 * side at the same time, INTF will only have one bit
+                 * set.  If one pin on the A side and one pin on the B
+                 * side are changed at the same time, INTF will have
+                 * two bits set.  Thus, INTF can't be the only check
+                 * to see if the input has changed.
+                 */
+
+                intf_set = BIT(i) & mcp->cache[MCP_INTF];
+                if (i < 8 && intf_set)
+                        intcap_mask = 0x00FF;
+                else if (i >= 8 && intf_set)
+                        intcap_mask = 0xFF00;
+                else
+                        intcap_mask = 0x00;
+
+                intcap_changed = (intcap_mask &
+                        (BIT(i) & mcp->cache[MCP_INTCAP])) !=
+                        (intcap_mask & (BIT(i) & gpio_orig));
+                gpio_set = BIT(i) & mcp->cache[MCP_GPIO];
+                gpio_bit_changed = (BIT(i) & gpio_orig) !=
+                        (BIT(i) & mcp->cache[MCP_GPIO]);
+                defval_changed = (BIT(i) & mcp->cache[MCP_INTCON]) &&
+                        ((BIT(i) & mcp->cache[MCP_GPIO]) !=
+                        (BIT(i) & mcp->cache[MCP_DEFVAL]));
+
+                if (((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_rise) && gpio_set) ||
+                    ((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_fall) && !gpio_set) ||
+                    defval_changed) {
                         child_irq = irq_find_mapping(mcp->chip.irqdomain, i);
                         handle_nested_irq(child_irq);
                 }
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 06dac72cb69c..d99338689213 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -197,7 +197,7 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         struct seq_file *sfile;
         struct gpio_desc *desc;
         struct gpio_chip *gc;
-        int status, val;
+        int val;
         char buf;
 
         sfile = file->private_data;
@@ -206,9 +206,8 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         chip = priv->chip;
         gc = &chip->gc;
 
-        status = copy_from_user(&buf, usr_buf, 1);
-        if (status)
-                return status;
+        if (copy_from_user(&buf, usr_buf, 1))
+                return -EFAULT;
 
         if (buf == '0')
                 val = 0;
diff --git a/drivers/gpio/gpio-xgene.c b/drivers/gpio/gpio-xgene.c
index 40a8881c2ce8..f1c6ec17b90a 100644
--- a/drivers/gpio/gpio-xgene.c
+++ b/drivers/gpio/gpio-xgene.c
@@ -42,9 +42,7 @@ struct xgene_gpio {
         struct gpio_chip        chip;
         void __iomem            *base;
         spinlock_t              lock;
-#ifdef CONFIG_PM
         u32                     set_dr_val[XGENE_MAX_GPIO_BANKS];
-#endif
 };
 
 static int xgene_gpio_get(struct gpio_chip *gc, unsigned int offset)
@@ -138,8 +136,7 @@ static int xgene_gpio_dir_out(struct gpio_chip *gc,
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int xgene_gpio_suspend(struct device *dev)
+static __maybe_unused int xgene_gpio_suspend(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -152,7 +149,7 @@ static int xgene_gpio_suspend(struct device *dev)
         return 0;
 }
 
-static int xgene_gpio_resume(struct device *dev)
+static __maybe_unused int xgene_gpio_resume(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -166,10 +163,6 @@ static int xgene_gpio_resume(struct device *dev)
 }
 
 static SIMPLE_DEV_PM_OPS(xgene_gpio_pm, xgene_gpio_suspend, xgene_gpio_resume);
-#define XGENE_GPIO_PM_OPS       (&xgene_gpio_pm)
-#else
-#define XGENE_GPIO_PM_OPS       NULL
-#endif
 
 static int xgene_gpio_probe(struct platform_device *pdev)
 {
@@ -241,7 +234,7 @@ static struct platform_driver xgene_gpio_driver = {
                 .name = "xgene-gpio",
                 .of_match_table = xgene_gpio_of_match,
                 .acpi_match_table = ACPI_PTR(xgene_gpio_acpi_match),
-                .pm     = XGENE_GPIO_PM_OPS,
+                .pm     = &xgene_gpio_pm,
         },
         .probe = xgene_gpio_probe,
 };
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 9b37a3692b3f..2bd683e2be02 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -266,6 +266,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
                 goto fail_free_event;
         }
 
+        if (agpio->wake_capable == ACPI_WAKE_CAPABLE)
+                enable_irq_wake(irq);
+
         list_add_tail(&event->node, &acpi_gpio->events);
         return AE_OK;
 
@@ -339,6 +342,9 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
+                if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+                        disable_irq_wake(event->irq);
+
                 free_irq(event->irq, event);
                 desc = event->desc;
                 if (WARN_ON(IS_ERR(desc)))
@@ -571,8 +577,10 @@ struct gpio_desc *acpi_find_gpio(struct device *dev,
                 }
 
                 desc = acpi_get_gpiod_by_index(adev, propname, idx, &info);
-                if (!IS_ERR(desc) || (PTR_ERR(desc) == -EPROBE_DEFER))
+                if (!IS_ERR(desc))
                         break;
+                if (PTR_ERR(desc) == -EPROBE_DEFER)
+                        return ERR_CAST(desc);
         }
 
         /* Then from plain _CRS GPIOs */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index a3a105ec99e2..de0cf3315484 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -475,7 +475,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
         int r;
 
         if (adev->wb.wb_obj == NULL) {
-                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * 4,
+                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * sizeof(uint32_t),
                                             PAGE_SIZE, AMDGPU_GEM_DOMAIN_GTT,
                                             &adev->wb.wb_obj, &adev->wb.gpu_addr,
                                             (void **)&adev->wb.wb);
@@ -488,7 +488,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
                 memset(&adev->wb.used, 0, sizeof(adev->wb.used));
 
                 /* clear wb memory */
-                memset((char *)adev->wb.wb, 0, AMDGPU_GPU_PAGE_SIZE);
+                memset((char *)adev->wb.wb, 0, AMDGPU_MAX_WB * sizeof(uint32_t));
         }
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index f7adbace428a..b76cd699eb0d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -421,6 +421,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6985, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+        {0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 
         {0, 0, 0}
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index 33b504bafb88..c5dec210d529 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -3465,9 +3465,13 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                         max_sclk = 75000;
                 }
         } else if (adev->asic_type == CHIP_OLAND) {
-                if ((adev->pdev->device == 0x6604) &&
-                    (adev->pdev->subsystem_vendor == 0x1028) &&
-                    (adev->pdev->subsystem_device == 0x066F)) {
+                if ((adev->pdev->revision == 0xC7) ||
+                    (adev->pdev->revision == 0x80) ||
+                    (adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0x87) ||
+                    (adev->pdev->device == 0x6604) ||
+                    (adev->pdev->device == 0x6605)) {
                         max_sclk = 75000;
                 }
         }
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6d4d9700734..324a688b3f30 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1260,9 +1260,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
          * to KMS, hence fail if different settings are requested.
          */
         if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
-            var->xres != fb->width || var->yres != fb->height ||
-            var->xres_virtual != fb->width || var->yres_virtual != fb->height) {
-                DRM_DEBUG("fb userspace requested width/height/bpp different than current fb "
+            var->xres > fb->width || var->yres > fb->height ||
+            var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
+                DRM_DEBUG("fb requested width/height/bpp can't fit in current fb "
                           "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
                           var->xres, var->yres, var->bits_per_pixel,
                           var->xres_virtual, var->yres_virtual,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 130d7d517a19..b78d9239e48f 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1311,15 +1311,15 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
                 goto out_pm_put;
         }
 
+        mutex_lock(&gpu->lock);
+
         fence = etnaviv_gpu_fence_alloc(gpu);
         if (!fence) {
                 event_free(gpu, event);
                 ret = -ENOMEM;
-                goto out_pm_put;
+                goto out_unlock;
         }
 
-        mutex_lock(&gpu->lock);
-
         gpu->event[event].fence = fence;
         submit->fence = fence->seqno;
         gpu->active_fence = submit->fence;
@@ -1357,6 +1357,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         hangcheck_timer_reset(gpu);
         ret = 0;
 
+out_unlock:
         mutex_unlock(&gpu->lock);
 
 out_pm_put:
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 0fd6f7a18364..c0e8d3302292 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -68,6 +68,8 @@ struct decon_context {
         unsigned long                   flags;
         unsigned long                   out_type;
         int                             first_win;
+        spinlock_t                      vblank_lock;
+        u32                             frame_id;
 };
 
 static const uint32_t decon_formats[] = {
@@ -103,7 +105,7 @@ static int decon_enable_vblank(struct exynos_drm_crtc *crtc)
                 if (ctx->out_type & IFTYPE_I80)
                         val |= VIDINTCON0_FRAMEDONE;
                 else
-                        val |= VIDINTCON0_INTFRMEN;
+                        val |= VIDINTCON0_INTFRMEN | VIDINTCON0_FRAMESEL_FP;
 
                 writel(val, ctx->addr + DECON_VIDINTCON0);
         }
@@ -122,14 +124,56 @@ static void decon_disable_vblank(struct exynos_drm_crtc *crtc)
                 writel(0, ctx->addr + DECON_VIDINTCON0);
 }
 
+/* return number of starts/ends of frame transmissions since reset */
+static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+{
+        u32 frm, pfrm, status, cnt = 2;
+
+        /* To get consistent result repeat read until frame id is stable.
+         * Usually the loop will be executed once, in rare cases when the loop
+         * is executed at frame change time 2nd pass will be needed.
+         */
+        frm = readl(ctx->addr + DECON_CRFMID);
+        do {
+                status = readl(ctx->addr + DECON_VIDCON1);
+                pfrm = frm;
+                frm = readl(ctx->addr + DECON_CRFMID);
+        } while (frm != pfrm && --cnt);
+
+        /* CRFMID is incremented on BPORCH in case of I80 and on VSYNC in case
+         * of RGB, it should be taken into account.
+         */
+        if (!frm)
+                return 0;
+
+        switch (status & (VIDCON1_VSTATUS_MASK | VIDCON1_I80_ACTIVE)) {
+        case VIDCON1_VSTATUS_VS:
+                if (!(ctx->out_type & IFTYPE_I80))
+                        --frm;
+                break;
+        case VIDCON1_VSTATUS_BP:
+                --frm;
+                break;
+        case VIDCON1_I80_ACTIVE:
+        case VIDCON1_VSTATUS_AC:
+                if (end)
+                        --frm;
+                break;
+        default:
+                break;
+        }
+
+        return frm;
+}
+
 static void decon_setup_trigger(struct decon_context *ctx)
 {
         if (!(ctx->out_type & (IFTYPE_I80 | I80_HW_TRG)))
                 return;
 
         if (!(ctx->out_type & I80_HW_TRG)) {
-                writel(TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN
-                       | TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
+                writel(TRIGCON_TRIGEN_PER_F | TRIGCON_TRIGEN_F |
+                       TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
                        ctx->addr + DECON_TRIGCON);
                 return;
         }
@@ -365,11 +409,14 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc,
 static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 {
         struct decon_context *ctx = crtc->ctx;
+        unsigned long flags;
         int i;
 
         if (test_bit(BIT_SUSPENDED, &ctx->flags))
                 return;
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+
         for (i = ctx->first_win; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
 
@@ -378,11 +425,18 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         if (ctx->out_type & IFTYPE_I80)
                 set_bit(BIT_WIN_UPDATED, &ctx->flags);
+
+        ctx->frame_id = decon_get_frame_count(ctx, true);
+
+        exynos_crtc_handle_event(crtc);
+
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
 }
 
 static void decon_swreset(struct decon_context *ctx)
 {
         unsigned int tries;
+        unsigned long flags;
 
         writel(0, ctx->addr + DECON_VIDCON0);
         for (tries = 2000; tries; --tries) {
@@ -400,6 +454,10 @@ static void decon_swreset(struct decon_context *ctx)
 
         WARN(tries == 0, "failed to software reset DECON\n");
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+        ctx->frame_id = 0;
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
+
         if (!(ctx->out_type & IFTYPE_HDMI))
                 return;
 
@@ -578,6 +636,24 @@ static const struct component_ops decon_component_ops = {
         .unbind = decon_unbind,
 };
 
+static void decon_handle_vblank(struct decon_context *ctx)
+{
+        u32 frm;
+
+        spin_lock(&ctx->vblank_lock);
+
+        frm = decon_get_frame_count(ctx, true);
+
+        if (frm != ctx->frame_id) {
+                /* handle only if incremented, take care of wrap-around */
+                if ((s32)(frm - ctx->frame_id) > 0)
+                        drm_crtc_handle_vblank(&ctx->crtc->base);
+                ctx->frame_id = frm;
+        }
+
+        spin_unlock(&ctx->vblank_lock);
+}
+
 static irqreturn_t decon_irq_handler(int irq, void *dev_id)
 {
         struct decon_context *ctx = dev_id;
@@ -598,7 +674,7 @@ static irqreturn_t decon_irq_handler(int irq, void *dev_id)
                             (VIDOUT_INTERLACE_EN_F | VIDOUT_INTERLACE_FIELD_F))
                                 return IRQ_HANDLED;
                 }
-                drm_crtc_handle_vblank(&ctx->crtc->base);
+                decon_handle_vblank(ctx);
         }
 
 out:
@@ -671,6 +747,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
         __set_bit(BIT_SUSPENDED, &ctx->flags);
         ctx->dev = dev;
         ctx->out_type = (unsigned long)of_device_get_match_data(dev);
+        spin_lock_init(&ctx->vblank_lock);
 
         if (ctx->out_type & IFTYPE_HDMI) {
                 ctx->first_win = 1;
@@ -678,7 +755,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
                 ctx->out_type |= IFTYPE_I80;
         }
 
-        if (ctx->out_type | I80_HW_TRG) {
+        if (ctx->out_type & I80_HW_TRG) {
                 ctx->sysreg = syscon_regmap_lookup_by_phandle(dev->of_node,
                                                         "samsung,disp-sysreg");
                 if (IS_ERR(ctx->sysreg)) {
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index f9ab19e205e2..48811806fa27 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -526,6 +526,7 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void decon_init(struct decon_context *ctx)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 5367b6664fe3..c65f4509932c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -85,16 +85,28 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
                                      struct drm_crtc_state *old_crtc_state)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
-        struct drm_pending_vblank_event *event;
-        unsigned long flags;
 
         if (exynos_crtc->ops->atomic_flush)
                 exynos_crtc->ops->atomic_flush(exynos_crtc);
+}
+
+static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
+        .enable         = exynos_drm_crtc_enable,
+        .disable        = exynos_drm_crtc_disable,
+        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
+        .atomic_check   = exynos_crtc_atomic_check,
+        .atomic_begin   = exynos_crtc_atomic_begin,
+        .atomic_flush   = exynos_crtc_atomic_flush,
+};
+
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc)
+{
+        struct drm_crtc *crtc = &exynos_crtc->base;
+        struct drm_pending_vblank_event *event = crtc->state->event;
+        unsigned long flags;
 
-        event = crtc->state->event;
         if (event) {
                 crtc->state->event = NULL;
-
                 spin_lock_irqsave(&crtc->dev->event_lock, flags);
                 if (drm_crtc_vblank_get(crtc) == 0)
                         drm_crtc_arm_vblank_event(crtc, event);
@@ -105,15 +117,6 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
 
 }
 
-static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
-        .enable         = exynos_drm_crtc_enable,
-        .disable        = exynos_drm_crtc_disable,
-        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
-        .atomic_check   = exynos_crtc_atomic_check,
-        .atomic_begin   = exynos_crtc_atomic_begin,
-        .atomic_flush   = exynos_crtc_atomic_flush,
-};
-
 static void exynos_drm_crtc_destroy(struct drm_crtc *crtc)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.h b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
index 6a581a8af465..abd5d6ceac0c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
@@ -40,4 +40,6 @@ int exynos_drm_crtc_get_pipe_from_type(struct drm_device *drm_dev,
  */
 void exynos_drm_crtc_te_handler(struct drm_crtc *crtc);
 
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc);
+
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 812e2ec0761d..d7ef26370e67 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -86,7 +86,7 @@
 #define DSIM_SYNC_INFORM                (1 << 27)
 #define DSIM_EOT_DISABLE                (1 << 28)
 #define DSIM_MFLUSH_VS                  (1 << 29)
-/* This flag is valid only for exynos3250/3472/4415/5260/5430 */
+/* This flag is valid only for exynos3250/3472/5260/5430 */
 #define DSIM_CLKLANE_STOP               (1 << 30)
 
 /* DSIM_ESCMODE */
@@ -473,17 +473,6 @@ static const struct exynos_dsi_driver_data exynos4_dsi_driver_data = {
         .reg_values = reg_values,
 };
 
-static const struct exynos_dsi_driver_data exynos4415_dsi_driver_data = {
-        .reg_ofs = exynos_reg_ofs,
-        .plltmr_reg = 0x58,
-        .has_clklane_stop = 1,
-        .num_clks = 2,
-        .max_freq = 1000,
-        .wait_for_reset = 1,
-        .num_bits_resol = 11,
-        .reg_values = reg_values,
-};
-
 static const struct exynos_dsi_driver_data exynos5_dsi_driver_data = {
         .reg_ofs = exynos_reg_ofs,
         .plltmr_reg = 0x58,
@@ -521,8 +510,6 @@ static const struct of_device_id exynos_dsi_of_match[] = {
           .data = &exynos3_dsi_driver_data },
         { .compatible = "samsung,exynos4210-mipi-dsi",
           .data = &exynos4_dsi_driver_data },
-        { .compatible = "samsung,exynos4415-mipi-dsi",
-          .data = &exynos4415_dsi_driver_data },
         { .compatible = "samsung,exynos5410-mipi-dsi",
           .data = &exynos5_dsi_driver_data },
         { .compatible = "samsung,exynos5422-mipi-dsi",
@@ -979,7 +966,7 @@ static void exynos_dsi_send_to_fifo(struct exynos_dsi *dsi,
         bool first = !xfer->tx_done;
         u32 reg;
 
-        dev_dbg(dev, "< xfer %p: tx len %u, done %u, rx len %u, done %u\n",
+        dev_dbg(dev, "< xfer %pK: tx len %u, done %u, rx len %u, done %u\n",
                 xfer, length, xfer->tx_done, xfer->rx_len, xfer->rx_done);
 
         if (length > DSI_TX_FIFO_SIZE)
@@ -1177,7 +1164,7 @@ static bool exynos_dsi_transfer_finish(struct exynos_dsi *dsi)
         spin_unlock_irqrestore(&dsi->transfer_lock, flags);
 
         dev_dbg(dsi->dev,
-                "> xfer %p, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
+                "> xfer %pK, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
                 xfer, xfer->packet.payload_length, xfer->tx_done, xfer->rx_len,
                 xfer->rx_done);
 
@@ -1348,9 +1335,12 @@ static int exynos_dsi_register_te_irq(struct exynos_dsi *dsi)
         int te_gpio_irq;
 
         dsi->te_gpio = of_get_named_gpio(dsi->panel_node, "te-gpios", 0);
+        if (dsi->te_gpio == -ENOENT)
+                return 0;
+
         if (!gpio_is_valid(dsi->te_gpio)) {
-                dev_err(dsi->dev, "no te-gpios specified\n");
                 ret = dsi->te_gpio;
+                dev_err(dsi->dev, "cannot get te-gpios, %d\n", ret);
                 goto out;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 95871577015d..5b18b5c5fdf2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1695,7 +1695,7 @@ static int fimc_probe(struct platform_device *pdev)
                 goto err_put_clk;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         spin_lock_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a9fa444c6053..3f04d72c448d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -71,10 +71,10 @@
 #define TRIGCON                         0x1A4
 #define TRGMODE_ENABLE                  (1 << 0)
 #define SWTRGCMD_ENABLE                 (1 << 1)
-/* Exynos3250, 3472, 4415, 5260 5410, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260 5410, 5420 and 5422 only supported. */
 #define HWTRGEN_ENABLE                  (1 << 3)
 #define HWTRGMASK_ENABLE                (1 << 4)
-/* Exynos3250, 3472, 4415, 5260, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260, 5420 and 5422 only supported. */
 #define HWTRIGEN_PER_ENABLE             (1 << 31)
 
 /* display mode change control register except exynos4 */
@@ -138,18 +138,6 @@ static struct fimd_driver_data exynos4_fimd_driver_data = {
         .has_vtsel = 1,
 };
 
-static struct fimd_driver_data exynos4415_fimd_driver_data = {
-        .timing_base = 0x20000,
-        .lcdblk_offset = 0x210,
-        .lcdblk_vt_shift = 10,
-        .lcdblk_bypass_shift = 1,
-        .trg_type = I80_HW_TRG,
-        .has_shadowcon = 1,
-        .has_vidoutcon = 1,
-        .has_vtsel = 1,
-        .has_trigger_per_te = 1,
-};
-
 static struct fimd_driver_data exynos5_fimd_driver_data = {
         .timing_base = 0x20000,
         .lcdblk_offset = 0x214,
@@ -210,8 +198,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
           .data = &exynos3_fimd_driver_data },
         { .compatible = "samsung,exynos4210-fimd",
           .data = &exynos4_fimd_driver_data },
-        { .compatible = "samsung,exynos4415-fimd",
-          .data = &exynos4415_fimd_driver_data },
         { .compatible = "samsung,exynos5250-fimd",
           .data = &exynos5_fimd_driver_data },
         { .compatible = "samsung,exynos5420-fimd",
@@ -257,7 +243,7 @@ static int fimd_enable_vblank(struct exynos_drm_crtc *crtc)
                         val |= VIDINTCON0_INT_FRAME;
 
                         val &= ~VIDINTCON0_FRAMESEL0_MASK;
-                        val |= VIDINTCON0_FRAMESEL0_VSYNC;
+                        val |= VIDINTCON0_FRAMESEL0_FRONTPORCH;
                         val &= ~VIDINTCON0_FRAMESEL1_MASK;
                         val |= VIDINTCON0_FRAMESEL1_NONE;
                 }
@@ -723,6 +709,8 @@ static void fimd_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 fimd_shadow_protect_win(ctx, i, false);
+
+        exynos_crtc_handle_event(crtc);
 }
 
 static void fimd_update_plane(struct exynos_drm_crtc *crtc,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 4c28f7ffcc4d..55a1579d11b3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -218,7 +218,7 @@ static struct exynos_drm_gem *exynos_drm_gem_init(struct drm_device *dev,
                 return ERR_PTR(ret);
         }
 
-        DRM_DEBUG_KMS("created file object = %p\n", obj->filp);
+        DRM_DEBUG_KMS("created file object = %pK\n", obj->filp);
 
         return exynos_gem;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index bef57987759d..0506b2b17ac1 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1723,7 +1723,7 @@ static int gsc_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         mutex_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 9c84ee76f18a..3edda18cc2d2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -208,7 +208,7 @@ static struct exynos_drm_ippdrv *ipp_find_drv_by_handle(u32 prop_id)
          * e.g PAUSE state, queue buf, command control.
          */
         list_for_each_entry(ippdrv, &exynos_drm_ippdrv_list, drv_list) {
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n", count++, ippdrv);
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n", count++, ippdrv);
 
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry(c_node, &ippdrv->cmd_list, list) {
@@ -388,7 +388,7 @@ int exynos_drm_ipp_set_property(struct drm_device *drm_dev, void *data,
         }
         property->prop_id = ret;
 
-        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%p]\n",
+        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%pK]\n",
                 property->prop_id, property->cmd, ippdrv);
 
         /* stored property information and ippdrv in private data */
@@ -518,7 +518,7 @@ static int ipp_put_mem_node(struct drm_device *drm_dev,
 {
         int i;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid dequeue node.\n");
@@ -562,7 +562,7 @@ static struct drm_exynos_ipp_mem_node
         m_node->buf_id = qbuf->buf_id;
         INIT_LIST_HEAD(&m_node->list);
 
-        DRM_DEBUG_KMS("m_node[%p]ops_id[%d]\n", m_node, qbuf->ops_id);
+        DRM_DEBUG_KMS("m_node[%pK]ops_id[%d]\n", m_node, qbuf->ops_id);
         DRM_DEBUG_KMS("prop_id[%d]buf_id[%d]\n", qbuf->prop_id, m_node->buf_id);
 
         for_each_ipp_planar(i) {
@@ -659,7 +659,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
 
         mutex_lock(&c_node->event_lock);
         list_for_each_entry_safe(e, te, &c_node->event_list, base.link) {
-                DRM_DEBUG_KMS("count[%d]e[%p]\n", count++, e);
+                DRM_DEBUG_KMS("count[%d]e[%pK]\n", count++, e);
 
                 /*
                  * qbuf == NULL condition means all event deletion.
@@ -750,7 +750,7 @@ static struct drm_exynos_ipp_mem_node
 
         /* find memory node from memory list */
         list_for_each_entry(m_node, head, list) {
-                DRM_DEBUG_KMS("count[%d]m_node[%p]\n", count++, m_node);
+                DRM_DEBUG_KMS("count[%d]m_node[%pK]\n", count++, m_node);
 
                 /* compare buffer id */
                 if (m_node->buf_id == qbuf->buf_id)
@@ -767,7 +767,7 @@ static int ipp_set_mem_node(struct exynos_drm_ippdrv *ippdrv,
         struct exynos_drm_ipp_ops *ops = NULL;
         int ret = 0;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid queue node.\n");
@@ -1232,7 +1232,7 @@ static int ipp_start_property(struct exynos_drm_ippdrv *ippdrv,
                         m_node = list_first_entry(head,
                                 struct drm_exynos_ipp_mem_node, list);
 
-                        DRM_DEBUG_KMS("m_node[%p]\n", m_node);
+                        DRM_DEBUG_KMS("m_node[%pK]\n", m_node);
 
                         ret = ipp_set_mem_node(ippdrv, c_node, m_node);
                         if (ret) {
@@ -1601,7 +1601,7 @@ static int ipp_subdrv_probe(struct drm_device *drm_dev, struct device *dev)
                 }
                 ippdrv->prop_list.ipp_id = ret;
 
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]ipp_id[%d]\n",
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]ipp_id[%d]\n",
                         count++, ippdrv, ret);
 
                 /* store parent device for node */
@@ -1659,7 +1659,7 @@ static int ipp_subdrv_open(struct drm_device *drm_dev, struct device *dev,
 
         file_priv->ipp_dev = dev;
 
-        DRM_DEBUG_KMS("done priv[%p]\n", dev);
+        DRM_DEBUG_KMS("done priv[%pK]\n", dev);
 
         return 0;
 }
@@ -1676,7 +1676,7 @@ static void ipp_subdrv_close(struct drm_device *drm_dev, struct device *dev,
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry_safe(c_node, tc_node,
                         &ippdrv->cmd_list, list) {
-                        DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n",
+                        DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n",
                                 count++, ippdrv);
 
                         if (c_node->filp == file) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 6591e406084c..79282a820ecc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -748,7 +748,7 @@ static int rotator_probe(struct platform_device *pdev)
                 goto err_ippdrv_register;
         }
 
-        DRM_DEBUG_KMS("ippdrv[%p]\n", ippdrv);
+        DRM_DEBUG_KMS("ippdrv[%pK]\n", ippdrv);
 
         platform_set_drvdata(pdev, rot);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 57fe514d5c5b..5d9a62a87eec 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -170,6 +170,7 @@ static const struct exynos_drm_crtc_ops vidi_crtc_ops = {
         .enable_vblank = vidi_enable_vblank,
         .disable_vblank = vidi_disable_vblank,
         .update_plane = vidi_update_plane,
+        .atomic_flush = exynos_crtc_handle_event,
 };
 
 static void vidi_fake_vblank_timer(unsigned long arg)
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 72143ac10525..25edb635a197 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1012,6 +1012,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc)
                 return;
 
         mixer_vsync_set_update(mixer_ctx, true);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void mixer_enable(struct exynos_drm_crtc *crtc)
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index 3b6caaca9751..325618d969fe 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -242,7 +242,7 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         const char *item;
 
         if (!param->low_gm_sz || !param->high_gm_sz || !param->fence_sz) {
-                gvt_err("Invalid vGPU creation params\n");
+                gvt_vgpu_err("Invalid vGPU creation params\n");
                 return -EINVAL;
         }
 
@@ -285,9 +285,9 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         return 0;
 
 no_enough_resource:
-        gvt_err("vgpu%d: fail to allocate resource %s\n", vgpu->id, item);
-        gvt_err("vgpu%d: request %luMB avail %luMB max %luMB taken %luMB\n",
-                vgpu->id, BYTES_TO_MB(request), BYTES_TO_MB(avail),
+        gvt_vgpu_err("fail to allocate resource %s\n", item);
+        gvt_vgpu_err("request %luMB avail %luMB max %luMB taken %luMB\n",
+                BYTES_TO_MB(request), BYTES_TO_MB(avail),
                 BYTES_TO_MB(max), BYTES_TO_MB(taken));
         return -ENOSPC;
 }
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index b7d7721e72fa..40af17ec6312 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -285,9 +285,6 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
 {
         int ret;
 
-        if (vgpu->failsafe)
-                return 0;
-
         if (WARN_ON(bytes > 4))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 7ae6e2b241c8..2b92cc8a7d1a 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -817,6 +817,25 @@ static bool is_shadowed_mmio(unsigned int offset)
         return ret;
 }
 
+static inline bool is_force_nonpriv_mmio(unsigned int offset)
+{
+        return (offset >= 0x24d0 && offset < 0x2500);
+}
+
+static int force_nonpriv_reg_handler(struct parser_exec_state *s,
+                                     unsigned int offset, unsigned int index)
+{
+        struct intel_gvt *gvt = s->vgpu->gvt;
+        unsigned int data = cmd_val(s, index + 1);
+
+        if (!intel_gvt_in_force_nonpriv_whitelist(gvt, data)) {
+                gvt_err("Unexpected forcenonpriv 0x%x LRI write, value=0x%x\n",
+                        offset, data);
+                return -EINVAL;
+        }
+        return 0;
+}
+
 static int cmd_reg_handler(struct parser_exec_state *s,
         unsigned int offset, unsigned int index, char *cmd)
 {
@@ -824,23 +843,26 @@ static int cmd_reg_handler(struct parser_exec_state *s,
         struct intel_gvt *gvt = vgpu->gvt;
 
         if (offset + 4 > gvt->device_info.mmio_size) {
-                gvt_err("%s access to (%x) outside of MMIO range\n",
+                gvt_vgpu_err("%s access to (%x) outside of MMIO range\n",
                                 cmd, offset);
                 return -EINVAL;
         }
 
         if (!intel_gvt_mmio_is_cmd_access(gvt, offset)) {
-                gvt_err("vgpu%d: %s access to non-render register (%x)\n",
-                                s->vgpu->id, cmd, offset);
+                gvt_vgpu_err("%s access to non-render register (%x)\n",
+                                cmd, offset);
                 return 0;
         }
 
         if (is_shadowed_mmio(offset)) {
-                gvt_err("vgpu%d: found access of shadowed MMIO %x\n",
-                                s->vgpu->id, offset);
+                gvt_vgpu_err("found access of shadowed MMIO %x\n", offset);
                 return 0;
         }
 
+        if (is_force_nonpriv_mmio(offset) &&
+            force_nonpriv_reg_handler(s, offset, index))
+                return -EINVAL;
+
         if (offset == i915_mmio_reg_offset(DERRMR) ||
                 offset == i915_mmio_reg_offset(FORCEWAKE_MT)) {
                 /* Writing to HW VGT_PVINFO_PAGE offset will be discarded */
@@ -1008,7 +1030,7 @@ static int cmd_handler_pipe_control(struct parser_exec_state *s)
                         ret = cmd_reg_handler(s, 0x2358, 1, "pipe_ctrl");
                 else if (post_sync == 1) {
                         /* check ggtt*/
-                        if ((cmd_val(s, 2) & (1 << 2))) {
+                        if ((cmd_val(s, 1) & PIPE_CONTROL_GLOBAL_GTT_IVB)) {
                                 gma = cmd_val(s, 2) & GENMASK(31, 3);
                                 if (gmadr_bytes == 8)
                                         gma |= (cmd_gma_hi(s, 3)) << 32;
@@ -1129,6 +1151,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 struct mi_display_flip_command_info *info)
 {
         struct drm_i915_private *dev_priv = s->vgpu->gvt->dev_priv;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 dword0 = cmd_val(s, 0);
         u32 dword1 = cmd_val(s, 1);
         u32 dword2 = cmd_val(s, 2);
@@ -1167,7 +1190,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 break;
 
         default:
-                gvt_err("unknown plane code %d\n", plane);
+                gvt_vgpu_err("unknown plane code %d\n", plane);
                 return -EINVAL;
         }
 
@@ -1274,25 +1297,26 @@ static int update_plane_mmio_from_mi_display_flip(
 static int cmd_handler_mi_display_flip(struct parser_exec_state *s)
 {
         struct mi_display_flip_command_info info;
+        struct intel_vgpu *vgpu = s->vgpu;
         int ret;
         int i;
         int len = cmd_length(s);
 
         ret = decode_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to decode MI display flip command\n");
+                gvt_vgpu_err("fail to decode MI display flip command\n");
                 return ret;
         }
 
         ret = check_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("invalid MI display flip command\n");
+                gvt_vgpu_err("invalid MI display flip command\n");
                 return ret;
         }
 
         ret = update_plane_mmio_from_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to update plane mmio\n");
+                gvt_vgpu_err("fail to update plane mmio\n");
                 return ret;
         }
 
@@ -1350,7 +1374,8 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         int ret;
 
         if (op_size > max_surface_size) {
-                gvt_err("command address audit fail name %s\n", s->info->name);
+                gvt_vgpu_err("command address audit fail name %s\n",
+                        s->info->name);
                 return -EINVAL;
         }
 
@@ -1367,7 +1392,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         }
         return 0;
 err:
-        gvt_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
+        gvt_vgpu_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
                         s->info->name, guest_gma, op_size);
 
         pr_err("cmd dump: ");
@@ -1412,8 +1437,10 @@ static int cmd_handler_mi_store_data_imm(struct parser_exec_state *s)
 
 static inline int unexpected_cmd(struct parser_exec_state *s)
 {
-        gvt_err("vgpu%d: Unexpected %s in command buffer!\n",
-                        s->vgpu->id, s->info->name);
+        struct intel_vgpu *vgpu = s->vgpu;
+
+        gvt_vgpu_err("Unexpected %s in command buffer!\n", s->info->name);
+
         return -EINVAL;
 }
 
@@ -1516,7 +1543,7 @@ static int copy_gma_to_hva(struct intel_vgpu *vgpu, struct intel_vgpu_mm *mm,
         while (gma != end_gma) {
                 gpa = intel_vgpu_gma_to_gpa(mm, gma);
                 if (gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid gma address: %lx\n", gma);
+                        gvt_vgpu_err("invalid gma address: %lx\n", gma);
                         return -EFAULT;
                 }
 
@@ -1557,6 +1584,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
         uint32_t bb_size = 0;
         uint32_t cmd_len = 0;
         bool met_bb_end = false;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 cmd;
 
         /* get the start gm address of the batch buffer */
@@ -1565,7 +1593,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -1574,7 +1602,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
                                 gma, gma + 4, &cmd);
                 info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
                 if (info == NULL) {
-                        gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                        gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                         return -EINVAL;
                 }
@@ -1599,6 +1627,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 static int perform_bb_shadow(struct parser_exec_state *s)
 {
         struct intel_shadow_bb_entry *entry_obj;
+        struct intel_vgpu *vgpu = s->vgpu;
         unsigned long gma = 0;
         uint32_t bb_size;
         void *dst = NULL;
@@ -1633,7 +1662,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
 
         ret = i915_gem_object_set_to_cpu_domain(entry_obj->obj, false);
         if (ret) {
-                gvt_err("failed to set shadow batch to CPU\n");
+                gvt_vgpu_err("failed to set shadow batch to CPU\n");
                 goto unmap_src;
         }
 
@@ -1645,7 +1674,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
                               gma, gma + bb_size,
                               dst);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 goto unmap_src;
         }
 
@@ -1676,15 +1705,16 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
 {
         bool second_level;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         if (s->buf_type == BATCH_BUFFER_2ND_LEVEL) {
-                gvt_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
+                gvt_vgpu_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
                 return -EINVAL;
         }
 
         second_level = BATCH_BUFFER_2ND_LEVEL_BIT(cmd_val(s, 0)) == 1;
         if (second_level && (s->buf_type != BATCH_BUFFER_INSTRUCTION)) {
-                gvt_err("Jumping to 2nd level BB from RB is not allowed\n");
+                gvt_vgpu_err("Jumping to 2nd level BB from RB is not allowed\n");
                 return -EINVAL;
         }
 
@@ -1702,7 +1732,7 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
         if (batch_buffer_needs_scan(s)) {
                 ret = perform_bb_shadow(s);
                 if (ret < 0)
-                        gvt_err("invalid shadow batch buffer\n");
+                        gvt_vgpu_err("invalid shadow batch buffer\n");
         } else {
                 /* emulate a batch buffer end to do return right */
                 ret = cmd_handler_mi_batch_buffer_end(s);
@@ -2429,6 +2459,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         int ret = 0;
         cycles_t t0, t1, t2;
         struct parser_exec_state s_before_advance_custom;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         t0 = get_cycles();
 
@@ -2436,7 +2467,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -2452,7 +2483,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (info->handler) {
                 ret = info->handler(s);
                 if (ret < 0) {
-                        gvt_err("%s handler error\n", info->name);
+                        gvt_vgpu_err("%s handler error\n", info->name);
                         return ret;
                 }
         }
@@ -2463,7 +2494,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (!(info->flag & F_IP_ADVANCE_CUSTOM)) {
                 ret = cmd_advance_default(s);
                 if (ret) {
-                        gvt_err("%s IP advance error\n", info->name);
+                        gvt_vgpu_err("%s IP advance error\n", info->name);
                         return ret;
                 }
         }
@@ -2486,6 +2517,7 @@ static int command_scan(struct parser_exec_state *s,
 
         unsigned long gma_head, gma_tail, gma_bottom;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         gma_head = rb_start + rb_head;
         gma_tail = rb_start + rb_tail;
@@ -2497,7 +2529,7 @@ static int command_scan(struct parser_exec_state *s,
                 if (s->buf_type == RING_BUFFER_INSTRUCTION) {
                         if (!(s->ip_gma >= rb_start) ||
                                 !(s->ip_gma < gma_bottom)) {
-                                gvt_err("ip_gma %lx out of ring scope."
+                                gvt_vgpu_err("ip_gma %lx out of ring scope."
                                         "(base:0x%lx, bottom: 0x%lx)\n",
                                         s->ip_gma, rb_start,
                                         gma_bottom);
@@ -2505,7 +2537,7 @@ static int command_scan(struct parser_exec_state *s,
                                 return -EINVAL;
                         }
                         if (gma_out_of_range(s->ip_gma, gma_head, gma_tail)) {
-                                gvt_err("ip_gma %lx out of range."
+                                gvt_vgpu_err("ip_gma %lx out of range."
                                         "base 0x%lx head 0x%lx tail 0x%lx\n",
                                         s->ip_gma, rb_start,
                                         rb_head, rb_tail);
@@ -2515,7 +2547,7 @@ static int command_scan(struct parser_exec_state *s,
                 }
                 ret = cmd_parser_exec(s);
                 if (ret) {
-                        gvt_err("cmd parser error\n");
+                        gvt_vgpu_err("cmd parser error\n");
                         parser_exec_state_dump(s);
                         break;
                 }
@@ -2639,7 +2671,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                                 gma_head, gma_top,
                                 workload->shadow_ring_buffer_va);
                 if (ret) {
-                        gvt_err("fail to copy guest ring buffer\n");
+                        gvt_vgpu_err("fail to copy guest ring buffer\n");
                         return ret;
                 }
                 copy_len = gma_top - gma_head;
@@ -2651,7 +2683,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                         gma_head, gma_tail,
                         workload->shadow_ring_buffer_va + copy_len);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 return ret;
         }
         ring->tail += workload->rb_len;
@@ -2662,16 +2694,17 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
 int intel_gvt_scan_and_shadow_workload(struct intel_vgpu_workload *workload)
 {
         int ret;
+        struct intel_vgpu *vgpu = workload->vgpu;
 
         ret = shadow_workload_ring_buffer(workload);
         if (ret) {
-                gvt_err("fail to shadow workload ring_buffer\n");
+                gvt_vgpu_err("fail to shadow workload ring_buffer\n");
                 return ret;
         }
 
         ret = scan_workload(workload);
         if (ret) {
-                gvt_err("scan workload error\n");
+                gvt_vgpu_err("scan workload error\n");
                 return ret;
         }
         return 0;
@@ -2681,6 +2714,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ctx_size = wa_ctx->indirect_ctx.size;
         unsigned long guest_gma = wa_ctx->indirect_ctx.guest_gma;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
         struct drm_i915_gem_object *obj;
         int ret = 0;
         void *map;
@@ -2694,14 +2728,14 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         /* get the va of the shadow batch buffer */
         map = i915_gem_object_pin_map(obj, I915_MAP_WB);
         if (IS_ERR(map)) {
-                gvt_err("failed to vmap shadow indirect ctx\n");
+                gvt_vgpu_err("failed to vmap shadow indirect ctx\n");
                 ret = PTR_ERR(map);
                 goto put_obj;
         }
 
         ret = i915_gem_object_set_to_cpu_domain(obj, false);
         if (ret) {
-                gvt_err("failed to set shadow indirect ctx to CPU\n");
+                gvt_vgpu_err("failed to set shadow indirect ctx to CPU\n");
                 goto unmap_src;
         }
 
@@ -2710,7 +2744,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
                                 guest_gma, guest_gma + ctx_size,
                                 map);
         if (ret) {
-                gvt_err("fail to copy guest indirect ctx\n");
+                gvt_vgpu_err("fail to copy guest indirect ctx\n");
                 goto unmap_src;
         }
 
@@ -2744,13 +2778,14 @@ static int combine_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ret;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
 
         if (wa_ctx->indirect_ctx.size == 0)
                 return 0;
 
         ret = shadow_indirect_ctx(wa_ctx);
         if (ret) {
-                gvt_err("fail to shadow indirect ctx\n");
+                gvt_vgpu_err("fail to shadow indirect ctx\n");
                 return ret;
         }
 
@@ -2758,7 +2793,7 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 
         ret = scan_wa_ctx(wa_ctx);
         if (ret) {
-                gvt_err("scan wa ctx error\n");
+                gvt_vgpu_err("scan wa ctx error\n");
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/i915/gvt/debug.h b/drivers/gpu/drm/i915/gvt/debug.h
index 68cba7bd980a..b0cff4dc2684 100644
--- a/drivers/gpu/drm/i915/gvt/debug.h
+++ b/drivers/gpu/drm/i915/gvt/debug.h
@@ -27,6 +27,14 @@
 #define gvt_err(fmt, args...) \
         DRM_ERROR("gvt: "fmt, ##args)
 
+#define gvt_vgpu_err(fmt, args...)                                      \
+do {                                                                    \
+        if (IS_ERR_OR_NULL(vgpu))                                       \
+                DRM_DEBUG_DRIVER("gvt: "fmt, ##args);                   \
+        else                                                            \
+                DRM_DEBUG_DRIVER("gvt: vgpu %d: "fmt, vgpu->id, ##args);\
+} while (0)
+
 #define gvt_dbg_core(fmt, args...) \
         DRM_DEBUG_DRIVER("gvt: core: "fmt, ##args)
 
diff --git a/drivers/gpu/drm/i915/gvt/edid.c b/drivers/gpu/drm/i915/gvt/edid.c
index bda85dff7b2a..42cd09ec63fa 100644
--- a/drivers/gpu/drm/i915/gvt/edid.c
+++ b/drivers/gpu/drm/i915/gvt/edid.c
@@ -52,16 +52,16 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
         unsigned char chr = 0;
 
         if (edid->state == I2C_NOT_SPECIFIED || !edid->slave_selected) {
-                gvt_err("Driver tries to read EDID without proper sequence!\n");
+                gvt_vgpu_err("Driver tries to read EDID without proper sequence!\n");
                 return 0;
         }
         if (edid->current_edid_read >= EDID_SIZE) {
-                gvt_err("edid_get_byte() exceeds the size of EDID!\n");
+                gvt_vgpu_err("edid_get_byte() exceeds the size of EDID!\n");
                 return 0;
         }
 
         if (!edid->edid_available) {
-                gvt_err("Reading EDID but EDID is not available!\n");
+                gvt_vgpu_err("Reading EDID but EDID is not available!\n");
                 return 0;
         }
 
@@ -72,7 +72,7 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
                 chr = edid_data->edid_block[edid->current_edid_read];
                 edid->current_edid_read++;
         } else {
-                gvt_err("No EDID available during the reading?\n");
+                gvt_vgpu_err("No EDID available during the reading?\n");
         }
         return chr;
 }
@@ -223,7 +223,7 @@ static int gmbus1_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                         vgpu_vreg(vgpu, PCH_GMBUS2) |= GMBUS_ACTIVE;
                         break;
                 default:
-                        gvt_err("Unknown/reserved GMBUS cycle detected!\n");
+                        gvt_vgpu_err("Unknown/reserved GMBUS cycle detected!\n");
                         break;
                 }
                 /*
@@ -292,8 +292,7 @@ static int gmbus3_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                  */
         } else {
                 memcpy(p_data, &vgpu_vreg(vgpu, offset), bytes);
-                gvt_err("vgpu%d: warning: gmbus3 read with nothing returned\n",
-                                vgpu->id);
+                gvt_vgpu_err("warning: gmbus3 read with nothing returned\n");
         }
         return 0;
 }
@@ -496,7 +495,8 @@ void intel_gvt_i2c_handle_aux_ch_write(struct intel_vgpu *vgpu,
                         unsigned char val = edid_get_byte(vgpu);
 
                         aux_data_for_write = (val << 16);
-                }
+                } else
+                        aux_data_for_write = (0xff << 16);
         }
         /* write the return value in AUX_CH_DATA reg which includes:
          * ACK of I2C_WRITE
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 46eb9fd3c03f..d186c157f65f 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -172,6 +172,7 @@ static int emulate_execlist_ctx_schedule_out(
                 struct intel_vgpu_execlist *execlist,
                 struct execlist_ctx_descriptor_format *ctx)
 {
+        struct intel_vgpu *vgpu = execlist->vgpu;
         struct intel_vgpu_execlist_slot *running = execlist->running_slot;
         struct intel_vgpu_execlist_slot *pending = execlist->pending_slot;
         struct execlist_ctx_descriptor_format *ctx0 = &running->ctx[0];
@@ -183,7 +184,7 @@ static int emulate_execlist_ctx_schedule_out(
         gvt_dbg_el("schedule out context id %x\n", ctx->context_id);
 
         if (WARN_ON(!same_context(ctx, execlist->running_context))) {
-                gvt_err("schedule out context is not running context,"
+                gvt_vgpu_err("schedule out context is not running context,"
                                 "ctx id %x running ctx id %x\n",
                                 ctx->context_id,
                                 execlist->running_context->context_id);
@@ -254,7 +255,7 @@ static struct intel_vgpu_execlist_slot *get_next_execlist_slot(
         status.udw = vgpu_vreg(vgpu, status_reg + 4);
 
         if (status.execlist_queue_full) {
-                gvt_err("virtual execlist slots are full\n");
+                gvt_vgpu_err("virtual execlist slots are full\n");
                 return NULL;
         }
 
@@ -270,11 +271,12 @@ static int emulate_execlist_schedule_in(struct intel_vgpu_execlist *execlist,
 
         struct execlist_ctx_descriptor_format *ctx0, *ctx1;
         struct execlist_context_status_format status;
+        struct intel_vgpu *vgpu = execlist->vgpu;
 
         gvt_dbg_el("emulate schedule-in\n");
 
         if (!slot) {
-                gvt_err("no available execlist slot\n");
+                gvt_vgpu_err("no available execlist slot\n");
                 return -EINVAL;
         }
 
@@ -375,7 +377,6 @@ static void prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
 
                 vma = i915_gem_object_ggtt_pin(entry_obj->obj, NULL, 0, 4, 0);
                 if (IS_ERR(vma)) {
-                        gvt_err("Cannot pin\n");
                         return;
                 }
 
@@ -428,7 +429,6 @@ static void prepare_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         vma = i915_gem_object_ggtt_pin(wa_ctx->indirect_ctx.obj, NULL,
                                        0, CACHELINE_BYTES, 0);
         if (IS_ERR(vma)) {
-                gvt_err("Cannot pin indirect ctx obj\n");
                 return;
         }
 
@@ -561,6 +561,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
 {
         struct execlist_ctx_descriptor_format *desc = &workload->ctx_desc;
         struct intel_vgpu_mm *mm;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int page_table_level;
         u32 pdp[8];
 
@@ -569,7 +570,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
         } else if (desc->addressing_mode == 3) { /* legacy 64 bit */
                 page_table_level = 4;
         } else {
-                gvt_err("Advanced Context mode(SVM) is not supported!\n");
+                gvt_vgpu_err("Advanced Context mode(SVM) is not supported!\n");
                 return -EINVAL;
         }
 
@@ -583,7 +584,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
                 mm = intel_vgpu_create_mm(workload->vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm object.\n");
+                        gvt_vgpu_err("fail to create mm object.\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -609,7 +610,7 @@ static int submit_context(struct intel_vgpu *vgpu, int ring_id,
         ring_context_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm,
                         (u32)((desc->lrca + 1) << GTT_PAGE_SHIFT));
         if (ring_context_gpa == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("invalid guest context LRCA: %x\n", desc->lrca);
+                gvt_vgpu_err("invalid guest context LRCA: %x\n", desc->lrca);
                 return -EINVAL;
         }
 
@@ -724,8 +725,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                         continue;
 
                 if (!desc[i]->privilege_access) {
-                        gvt_err("vgpu%d: unexpected GGTT elsp submission\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("unexpected GGTT elsp submission\n");
                         return -EINVAL;
                 }
 
@@ -735,15 +735,13 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
         }
 
         if (!valid_desc_bitmap) {
-                gvt_err("vgpu%d: no valid desc in a elsp submission\n",
-                                vgpu->id);
+                gvt_vgpu_err("no valid desc in a elsp submission\n");
                 return -EINVAL;
         }
 
         if (!test_bit(0, (void *)&valid_desc_bitmap) &&
                         test_bit(1, (void *)&valid_desc_bitmap)) {
-                gvt_err("vgpu%d: weird elsp submission, desc 0 is not valid\n",
-                                vgpu->id);
+                gvt_vgpu_err("weird elsp submission, desc 0 is not valid\n");
                 return -EINVAL;
         }
 
@@ -752,8 +750,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                 ret = submit_context(vgpu, ring_id, &valid_desc[i],
                                 emulate_schedule_in);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to schedule workload\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("fail to schedule workload\n");
                         return ret;
                 }
                 emulate_schedule_in = false;
@@ -778,7 +775,8 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
                         _EL_OFFSET_STATUS_PTR);
 
         ctx_status_ptr.dw = vgpu_vreg(vgpu, ctx_status_ptr_reg);
-        ctx_status_ptr.read_ptr = ctx_status_ptr.write_ptr = 0x7;
+        ctx_status_ptr.read_ptr = 0;
+        ctx_status_ptr.write_ptr = 0x7;
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 933a7c211a1c..dce8d15f706f 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -75,11 +75,11 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         struct gvt_firmware_header *h;
         void *firmware;
         void *p;
-        unsigned long size;
+        unsigned long size, crc32_start;
         int i;
         int ret;
 
-        size = sizeof(*h) + info->mmio_size + info->cfg_space_size - 1;
+        size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
         firmware = vzalloc(size);
         if (!firmware)
                 return -ENOMEM;
@@ -112,6 +112,9 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
 
         memcpy(gvt->firmware.mmio, p, info->mmio_size);
 
+        crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
+        h->crc32 = crc32_le(0, firmware + crc32_start, size - crc32_start);
+
         firmware_attr.size = size;
         firmware_attr.private = firmware;
 
@@ -234,7 +237,7 @@ int intel_gvt_load_firmware(struct intel_gvt *gvt)
 
         firmware->mmio = mem;
 
-        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%04x.golden_hw_state",
+        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%02x.golden_hw_state",
                  GVT_FIRMWARE_PATH, pdev->vendor, pdev->device,
                  pdev->revision);
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 6a5ff23ded90..b832bea64e03 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -49,8 +49,8 @@ bool intel_gvt_ggtt_validate_range(struct intel_vgpu *vgpu, u64 addr, u32 size)
 {
         if ((!vgpu_gmadr_is_valid(vgpu, addr)) || (size
                         && !vgpu_gmadr_is_valid(vgpu, addr + size - 1))) {
-                gvt_err("vgpu%d: invalid range gmadr 0x%llx size 0x%x\n",
-                                vgpu->id, addr, size);
+                gvt_vgpu_err("invalid range gmadr 0x%llx size 0x%x\n",
+                                addr, size);
                 return false;
         }
         return true;
@@ -430,7 +430,7 @@ static int gtt_entry_p2m(struct intel_vgpu *vgpu, struct intel_gvt_gtt_entry *p,
 
         mfn = intel_gvt_hypervisor_gfn_to_mfn(vgpu, gfn);
         if (mfn == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("fail to translate gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("fail to translate gfn: 0x%lx\n", gfn);
                 return -ENXIO;
         }
 
@@ -611,7 +611,7 @@ static inline int init_shadow_page(struct intel_vgpu *vgpu,
 
         daddr = dma_map_page(kdev, p->page, 0, 4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(kdev, daddr)) {
-                gvt_err("fail to map dma addr\n");
+                gvt_vgpu_err("fail to map dma addr\n");
                 return -EINVAL;
         }
 
@@ -735,7 +735,7 @@ retry:
                 if (reclaim_one_mm(vgpu->gvt))
                         goto retry;
 
-                gvt_err("fail to allocate ppgtt shadow page\n");
+                gvt_vgpu_err("fail to allocate ppgtt shadow page\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -750,14 +750,14 @@ retry:
          */
         ret = init_shadow_page(vgpu, &spt->shadow_page, type);
         if (ret) {
-                gvt_err("fail to initialize shadow page for spt\n");
+                gvt_vgpu_err("fail to initialize shadow page for spt\n");
                 goto err;
         }
 
         ret = intel_vgpu_init_guest_page(vgpu, &spt->guest_page,
                         gfn, ppgtt_write_protection_handler, NULL);
         if (ret) {
-                gvt_err("fail to initialize guest page for spt\n");
+                gvt_vgpu_err("fail to initialize guest page for spt\n");
                 goto err;
         }
 
@@ -776,8 +776,7 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_find_shadow_page(
         if (p)
                 return shadow_page_to_ppgtt_spt(p);
 
-        gvt_err("vgpu%d: fail to find ppgtt shadow page: 0x%lx\n",
-                        vgpu->id, mfn);
+        gvt_vgpu_err("fail to find ppgtt shadow page: 0x%lx\n", mfn);
         return NULL;
 }
 
@@ -827,8 +826,8 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
         }
         s = ppgtt_find_shadow_page(vgpu, ops->get_pfn(e));
         if (!s) {
-                gvt_err("vgpu%d: fail to find shadow page: mfn: 0x%lx\n",
-                                vgpu->id, ops->get_pfn(e));
+                gvt_vgpu_err("fail to find shadow page: mfn: 0x%lx\n",
+                                ops->get_pfn(e));
                 return -ENXIO;
         }
         return ppgtt_invalidate_shadow_page(s);
@@ -836,6 +835,7 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
 
 static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 {
+        struct intel_vgpu *vgpu = spt->vgpu;
         struct intel_gvt_gtt_entry e;
         unsigned long index;
         int ret;
@@ -854,7 +854,7 @@ static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_shadow_entry(spt, &e, index) {
                 if (!gtt_type_is_pt(get_next_pt_type(e.type))) {
-                        gvt_err("GVT doesn't support pse bit for now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit for now\n");
                         return -EINVAL;
                 }
                 ret = ppgtt_invalidate_shadow_page_by_shadow_entry(
@@ -868,8 +868,8 @@ release:
         ppgtt_free_shadow_page(spt);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p shadow entry 0x%llx type %d\n",
-                        spt->vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -914,8 +914,8 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_populate_shadow_page_by_guest_entry(
         }
         return s;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, s, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        s, we->val64, we->type);
         return ERR_PTR(ret);
 }
 
@@ -953,7 +953,7 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_guest_entry(spt, &ge, i) {
                 if (!gtt_type_is_pt(get_next_pt_type(ge.type))) {
-                        gvt_err("GVT doesn't support pse bit now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit now\n");
                         ret = -EINVAL;
                         goto fail;
                 }
@@ -969,8 +969,8 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, ge.val64, ge.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, ge.val64, ge.type);
         return ret;
 }
 
@@ -999,7 +999,7 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
                 struct intel_vgpu_ppgtt_spt *s =
                         ppgtt_find_shadow_page(vgpu, ops->get_pfn(&e));
                 if (!s) {
-                        gvt_err("fail to find guest page\n");
+                        gvt_vgpu_err("fail to find guest page\n");
                         ret = -ENXIO;
                         goto fail;
                 }
@@ -1011,8 +1011,8 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
         ppgtt_set_shadow_entry(spt, &e, index);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -1046,8 +1046,8 @@ static int ppgtt_handle_guest_entry_add(struct intel_vgpu_guest_page *gpt,
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: spt %p guest entry 0x%llx type %d\n", vgpu->id,
-                        spt, we->val64, we->type);
+        gvt_vgpu_err("fail: spt %p guest entry 0x%llx type %d\n",
+                spt, we->val64, we->type);
         return ret;
 }
 
@@ -1250,8 +1250,8 @@ static int ppgtt_handle_guest_write_page_table(
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d.\n",
-                        vgpu->id, spt, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d.\n",
+                        spt, we->val64, we->type);
         return ret;
 }
 
@@ -1493,7 +1493,7 @@ static int shadow_mm(struct intel_vgpu_mm *mm)
 
                 spt = ppgtt_populate_shadow_page_by_guest_entry(vgpu, &ge);
                 if (IS_ERR(spt)) {
-                        gvt_err("fail to populate guest root pointer\n");
+                        gvt_vgpu_err("fail to populate guest root pointer\n");
                         ret = PTR_ERR(spt);
                         goto fail;
                 }
@@ -1566,7 +1566,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
 
         ret = gtt->mm_alloc_page_table(mm);
         if (ret) {
-                gvt_err("fail to allocate page table for mm\n");
+                gvt_vgpu_err("fail to allocate page table for mm\n");
                 goto fail;
         }
 
@@ -1584,7 +1584,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
         }
         return mm;
 fail:
-        gvt_err("fail to create mm\n");
+        gvt_vgpu_err("fail to create mm\n");
         if (mm)
                 intel_gvt_mm_unreference(mm);
         return ERR_PTR(ret);
@@ -1760,7 +1760,7 @@ unsigned long intel_vgpu_gma_to_gpa(struct intel_vgpu_mm *mm, unsigned long gma)
                         mm->page_table_level, gma, gpa);
         return gpa;
 err:
-        gvt_err("invalid mm type: %d gma %lx\n", mm->type, gma);
+        gvt_vgpu_err("invalid mm type: %d gma %lx\n", mm->type, gma);
         return INTEL_GVT_INVALID_ADDR;
 }
 
@@ -1836,13 +1836,16 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         if (ops->test_present(&e)) {
                 ret = gtt_entry_p2m(vgpu, &e, &m);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to translate guest gtt entry\n",
-                                        vgpu->id);
-                        return ret;
+                        gvt_vgpu_err("fail to translate guest gtt entry\n");
+                        /* guest driver may read/write the entry when partial
+                         * update the entry in this situation p2m will fail
+                         * settting the shadow entry to point to a scratch page
+                         */
+                        ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
                 }
         } else {
                 m = e;
-                m.val64 = 0;
+                ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
         }
 
         ggtt_set_shadow_entry(ggtt_mm, &m, g_gtt_index);
@@ -1893,14 +1896,14 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
 
         scratch_pt = (void *)get_zeroed_page(GFP_KERNEL);
         if (!scratch_pt) {
-                gvt_err("fail to allocate scratch page\n");
+                gvt_vgpu_err("fail to allocate scratch page\n");
                 return -ENOMEM;
         }
 
         daddr = dma_map_page(dev, virt_to_page(scratch_pt), 0,
                         4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr)) {
-                gvt_err("fail to dmamap scratch_pt\n");
+                gvt_vgpu_err("fail to dmamap scratch_pt\n");
                 __free_page(virt_to_page(scratch_pt));
                 return -ENOMEM;
         }
@@ -2003,7 +2006,7 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         ggtt_mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_GGTT,
                         NULL, 1, 0);
         if (IS_ERR(ggtt_mm)) {
-                gvt_err("fail to create mm for ggtt.\n");
+                gvt_vgpu_err("fail to create mm for ggtt.\n");
                 return PTR_ERR(ggtt_mm);
         }
 
@@ -2076,7 +2079,6 @@ static int setup_spt_oos(struct intel_gvt *gvt)
         for (i = 0; i < preallocated_oos_pages; i++) {
                 oos_page = kzalloc(sizeof(*oos_page), GFP_KERNEL);
                 if (!oos_page) {
-                        gvt_err("fail to pre-allocate oos page\n");
                         ret = -ENOMEM;
                         goto fail;
                 }
@@ -2166,7 +2168,7 @@ int intel_vgpu_g2v_create_ppgtt_mm(struct intel_vgpu *vgpu,
                 mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm\n");
+                        gvt_vgpu_err("fail to create mm\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -2196,7 +2198,7 @@ int intel_vgpu_g2v_destroy_ppgtt_mm(struct intel_vgpu *vgpu,
 
         mm = intel_vgpu_find_ppgtt_mm(vgpu, page_table_level, pdp);
         if (!mm) {
-                gvt_err("fail to find ppgtt instance.\n");
+                gvt_vgpu_err("fail to find ppgtt instance.\n");
                 return -EINVAL;
         }
         intel_gvt_mm_unreference(mm);
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 3b9d59e457ba..ef3baa0c4754 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -52,6 +52,8 @@ static const struct intel_gvt_ops intel_gvt_ops = {
         .vgpu_create = intel_gvt_create_vgpu,
         .vgpu_destroy = intel_gvt_destroy_vgpu,
         .vgpu_reset = intel_gvt_reset_vgpu,
+        .vgpu_activate = intel_gvt_activate_vgpu,
+        .vgpu_deactivate = intel_gvt_deactivate_vgpu,
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 23791920ced1..becae2fa3b29 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -162,7 +162,6 @@ struct intel_vgpu {
         atomic_t running_workload_num;
         DECLARE_BITMAP(tlb_handle_pending, I915_NUM_ENGINES);
         struct i915_gem_context *shadow_ctx;
-        struct notifier_block shadow_ctx_notifier_block;
 
 #if IS_ENABLED(CONFIG_DRM_I915_GVT_KVMGT)
         struct {
@@ -233,6 +232,7 @@ struct intel_gvt {
         struct intel_gvt_gtt gtt;
         struct intel_gvt_opregion opregion;
         struct intel_gvt_workload_scheduler scheduler;
+        struct notifier_block shadow_ctx_notifier_block[I915_NUM_ENGINES];
         DECLARE_HASHTABLE(cmd_table, GVT_CMD_HASH_BITS);
         struct intel_vgpu_type *types;
         unsigned int num_types;
@@ -382,7 +382,8 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu);
 void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                                  unsigned int engine_mask);
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu);
-
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu);
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu);
 
 /* validating GM functions */
 #define vgpu_gmadr_is_aperture(vgpu, gmadr) \
@@ -449,6 +450,8 @@ struct intel_gvt_ops {
                                 struct intel_vgpu_type *);
         void (*vgpu_destroy)(struct intel_vgpu *);
         void (*vgpu_reset)(struct intel_vgpu *);
+        void (*vgpu_activate)(struct intel_vgpu *);
+        void (*vgpu_deactivate)(struct intel_vgpu *);
 };
 
 
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 8e43395c748a..6da9ae1618e3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -181,11 +181,9 @@ static int sanitize_fence_mmio_access(struct intel_vgpu *vgpu,
                                         GVT_FAILSAFE_UNSUPPORTED_GUEST);
 
                 if (!vgpu->mmio.disable_warn_untrack) {
-                        gvt_err("vgpu%d: found oob fence register access\n",
-                                        vgpu->id);
-                        gvt_err("vgpu%d: total fence %d, access fence %d\n",
-                                        vgpu->id, vgpu_fence_sz(vgpu),
-                                        fence_num);
+                        gvt_vgpu_err("found oob fence register access\n");
+                        gvt_vgpu_err("total fence %d, access fence %d\n",
+                                        vgpu_fence_sz(vgpu), fence_num);
                 }
                 memset(p_data, 0, bytes);
                 return -EINVAL;
@@ -249,7 +247,7 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
                         break;
                 default:
                         /*should not hit here*/
-                        gvt_err("invalid forcewake offset 0x%x\n", offset);
+                        gvt_vgpu_err("invalid forcewake offset 0x%x\n", offset);
                         return -EINVAL;
                 }
         } else {
@@ -530,7 +528,7 @@ static int check_fdi_rx_train_status(struct intel_vgpu *vgpu,
                 fdi_tx_train_bits = FDI_LINK_TRAIN_PATTERN_2;
                 fdi_iir_check_bits = FDI_RX_SYMBOL_LOCK;
         } else {
-                gvt_err("Invalid train pattern %d\n", train_pattern);
+                gvt_vgpu_err("Invalid train pattern %d\n", train_pattern);
                 return -EINVAL;
         }
 
@@ -588,7 +586,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu,
         else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX)
                 index = FDI_RX_IMR_TO_PIPE(offset);
         else {
-                gvt_err("Unsupport registers %x\n", offset);
+                gvt_vgpu_err("Unsupport registers %x\n", offset);
                 return -EINVAL;
         }
 
@@ -818,7 +816,7 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         u32 data;
 
         if (!dpy_is_valid_port(port_index)) {
-                gvt_err("GVT(%d): Unsupported DP port access!\n", vgpu->id);
+                gvt_vgpu_err("Unsupported DP port access!\n");
                 return 0;
         }
 
@@ -972,6 +970,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int mbctl_write(struct intel_vgpu *vgpu, unsigned int offset,
+                void *p_data, unsigned int bytes)
+{
+        *(u32 *)p_data &= (~GEN6_MBCTL_ENABLE_BOOT_FETCH);
+        write_vreg(vgpu, offset, p_data, bytes);
+        return 0;
+}
+
 static int vga_control_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -1016,8 +1022,7 @@ static void write_virtual_sbi_register(struct intel_vgpu *vgpu,
 
         if (i == num) {
                 if (num == SBI_REG_MAX) {
-                        gvt_err("vgpu%d: SBI caching meets maximum limits\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("SBI caching meets maximum limits\n");
                         return;
                 }
                 display->sbi.number++;
@@ -1097,7 +1102,7 @@ static int pvinfo_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                 break;
         }
         if (invalid_read)
-                gvt_err("invalid pvinfo read: [%x:%x] = %x\n",
+                gvt_vgpu_err("invalid pvinfo read: [%x:%x] = %x\n",
                                 offset, bytes, *(u32 *)p_data);
         vgpu->pv_notified = true;
         return 0;
@@ -1125,7 +1130,7 @@ static int handle_g2v_notification(struct intel_vgpu *vgpu, int notification)
         case 1: /* Remove this in guest driver. */
                 break;
         default:
-                gvt_err("Invalid PV notification %d\n", notification);
+                gvt_vgpu_err("Invalid PV notification %d\n", notification);
         }
         return ret;
 }
@@ -1181,7 +1186,7 @@ static int pvinfo_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 enter_failsafe_mode(vgpu, GVT_FAILSAFE_INSUFFICIENT_RESOURCE);
                 break;
         default:
-                gvt_err("invalid pvinfo write offset %x bytes %x data %x\n",
+                gvt_vgpu_err("invalid pvinfo write offset %x bytes %x data %x\n",
                                 offset, bytes, data);
                 break;
         }
@@ -1415,7 +1420,8 @@ static int elsp_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         if (execlist->elsp_dwords.index == 3) {
                 ret = intel_vgpu_submit_execlist(vgpu, ring_id);
                 if(ret)
-                        gvt_err("fail submit workload on ring %d\n", ring_id);
+                        gvt_vgpu_err("fail submit workload on ring %d\n",
+                                ring_id);
         }
 
         ++execlist->elsp_dwords.index;
@@ -2240,7 +2246,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x7180, D_ALL);
         MMIO_D(0x7408, D_ALL);
         MMIO_D(0x7c00, D_ALL);
-        MMIO_D(GEN6_MBCTL, D_ALL);
+        MMIO_DH(GEN6_MBCTL, D_ALL, NULL, mbctl_write);
         MMIO_D(0x911c, D_ALL);
         MMIO_D(0x9120, D_ALL);
         MMIO_DFH(GEN7_UCGCTL4, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2988,3 +2994,20 @@ int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         write_vreg(vgpu, offset, p_data, bytes);
         return 0;
 }
+
+/**
+ * intel_gvt_in_force_nonpriv_whitelist - if a mmio is in whitelist to be
+ * force-nopriv register
+ *
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * True if the register is in force-nonpriv whitelist;
+ * False if outside;
+ */
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset)
+{
+        return in_whitelist(offset);
+}
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 84d801638ede..e466259034e2 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -426,7 +426,7 @@ static void kvmgt_protect_table_del(struct kvmgt_guest_info *info,
 
 static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 {
-        struct intel_vgpu *vgpu;
+        struct intel_vgpu *vgpu = NULL;
         struct intel_vgpu_type *type;
         struct device *pdev;
         void *gvt;
@@ -437,7 +437,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 
         type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
         if (!type) {
-                gvt_err("failed to find type %s to create\n",
+                gvt_vgpu_err("failed to find type %s to create\n",
                                                 kobject_name(kobj));
                 ret = -EINVAL;
                 goto out;
@@ -446,7 +446,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         vgpu = intel_gvt_ops->vgpu_create(gvt, type);
         if (IS_ERR_OR_NULL(vgpu)) {
                 ret = vgpu == NULL ? -EFAULT : PTR_ERR(vgpu);
-                gvt_err("failed to create intel vgpu: %d\n", ret);
+                gvt_vgpu_err("failed to create intel vgpu: %d\n", ret);
                 goto out;
         }
 
@@ -526,7 +526,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY, &events,
                                 &vgpu->vdev.iommu_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for iommu failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for iommu failed: %d\n",
+                        ret);
                 goto out;
         }
 
@@ -534,7 +535,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_GROUP_NOTIFY, &events,
                                 &vgpu->vdev.group_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for group failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for group failed: %d\n",
+                        ret);
                 goto undo_iommu;
         }
 
@@ -542,6 +544,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         if (ret)
                 goto undo_group;
 
+        intel_gvt_ops->vgpu_activate(vgpu);
+
         atomic_set(&vgpu->vdev.released, 0);
         return ret;
 
@@ -567,6 +571,8 @@ static void __intel_vgpu_release(struct intel_vgpu *vgpu)
         if (atomic_cmpxchg(&vgpu->vdev.released, 0, 1))
                 return;
 
+        intel_gvt_ops->vgpu_deactivate(vgpu);
+
         ret = vfio_unregister_notifier(mdev_dev(vgpu->vdev.mdev), VFIO_IOMMU_NOTIFY,
                                         &vgpu->vdev.iommu_notifier);
         WARN(ret, "vfio_unregister_notifier for iommu failed: %d\n", ret);
@@ -635,7 +641,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
 
 
         if (index >= VFIO_PCI_NUM_REGIONS) {
-                gvt_err("invalid index: %u\n", index);
+                gvt_vgpu_err("invalid index: %u\n", index);
                 return -EINVAL;
         }
 
@@ -669,7 +675,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         case VFIO_PCI_VGA_REGION_INDEX:
         case VFIO_PCI_ROM_REGION_INDEX:
         default:
-                gvt_err("unsupported region: %u\n", index);
+                gvt_vgpu_err("unsupported region: %u\n", index);
         }
 
         return ret == 0 ? count : ret;
@@ -861,7 +867,7 @@ static int intel_vgpu_set_msi_trigger(struct intel_vgpu *vgpu,
 
                 trigger = eventfd_ctx_fdget(fd);
                 if (IS_ERR(trigger)) {
-                        gvt_err("eventfd_ctx_fdget failed\n");
+                        gvt_vgpu_err("eventfd_ctx_fdget failed\n");
                         return PTR_ERR(trigger);
                 }
                 vgpu->vdev.msi_trigger = trigger;
@@ -1120,7 +1126,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
                         ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
                                                 VFIO_PCI_NUM_IRQS, &data_size);
                         if (ret) {
-                                gvt_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
+                                gvt_vgpu_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
                                 return -EINVAL;
                         }
                         if (data_size) {
@@ -1310,7 +1316,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
         kvm = vgpu->vdev.kvm;
         if (!kvm || kvm->mm != current->mm) {
-                gvt_err("KVM is required to use Intel vGPU\n");
+                gvt_vgpu_err("KVM is required to use Intel vGPU\n");
                 return -ESRCH;
         }
 
@@ -1324,6 +1330,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
         vgpu->handle = (unsigned long)info;
         info->vgpu = vgpu;
         info->kvm = kvm;
+        kvm_get_kvm(info->kvm);
 
         kvmgt_protect_table_init(info);
         gvt_cache_init(vgpu);
@@ -1337,12 +1344,8 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
 static bool kvmgt_guest_exit(struct kvmgt_guest_info *info)
 {
-        if (!info) {
-                gvt_err("kvmgt_guest_info invalid\n");
-                return false;
-        }
-
         kvm_page_track_unregister_notifier(info->kvm, &info->track_node);
+        kvm_put_kvm(info->kvm);
         kvmgt_protect_table_destroy(info);
         gvt_cache_destroy(info->vgpu);
         vfree(info);
@@ -1383,12 +1386,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         unsigned long iova, pfn;
         struct kvmgt_guest_info *info;
         struct device *dev;
+        struct intel_vgpu *vgpu;
         int rc;
 
         if (!handle_valid(handle))
                 return INTEL_GVT_INVALID_ADDR;
 
         info = (struct kvmgt_guest_info *)handle;
+        vgpu = info->vgpu;
         iova = gvt_cache_find(info->vgpu, gfn);
         if (iova != INTEL_GVT_INVALID_ADDR)
                 return iova;
@@ -1397,13 +1402,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         dev = mdev_dev(info->vgpu->vdev.mdev);
         rc = vfio_pin_pages(dev, &gfn, 1, IOMMU_READ | IOMMU_WRITE, &pfn);
         if (rc != 1) {
-                gvt_err("vfio_pin_pages failed for gfn 0x%lx: %d\n", gfn, rc);
+                gvt_vgpu_err("vfio_pin_pages failed for gfn 0x%lx: %d\n",
+                        gfn, rc);
                 return INTEL_GVT_INVALID_ADDR;
         }
         /* transfer to host iova for GFX to use DMA */
         rc = gvt_dma_map_iova(info->vgpu, pfn, &iova);
         if (rc) {
-                gvt_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
                 vfio_unpin_pages(dev, &gfn, 1);
                 return INTEL_GVT_INVALID_ADDR;
         }
@@ -1417,7 +1423,7 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
 {
         struct kvmgt_guest_info *info;
         struct kvm *kvm;
-        int ret;
+        int idx, ret;
         bool kthread = current->mm == NULL;
 
         if (!handle_valid(handle))
@@ -1429,8 +1435,10 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
         if (kthread)
                 use_mm(kvm->mm);
 
+        idx = srcu_read_lock(&kvm->srcu);
         ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
                       kvm_read_guest(kvm, gpa, buf, len);
+        srcu_read_unlock(&kvm->srcu, idx);
 
         if (kthread)
                 unuse_mm(kvm->mm);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 60b698cb8365..1ba3bdb09341 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -142,10 +142,10 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                         ret = intel_gvt_hypervisor_read_gpa(vgpu, pa,
                                         p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page read error %d, "
+                                gvt_vgpu_err("guest page read error %d, "
                                         "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                        ret, gp->gfn, pa, *(u32 *)p_data,
+                                        bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -200,14 +200,13 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                 ret = intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 
                 if (!vgpu->mmio.disable_warn_untrack) {
-                        gvt_err("vgpu%d: read untracked MMIO %x(%dB) val %x\n",
-                                vgpu->id, offset, bytes, *(u32 *)p_data);
+                        gvt_vgpu_err("read untracked MMIO %x(%dB) val %x\n",
+                                offset, bytes, *(u32 *)p_data);
 
                         if (offset == 0x206c) {
-                                gvt_err("------------------------------------------\n");
-                                gvt_err("vgpu%d: likely triggers a gfx reset\n",
-                                        vgpu->id);
-                                gvt_err("------------------------------------------\n");
+                                gvt_vgpu_err("------------------------------------------\n");
+                                gvt_vgpu_err("likely triggers a gfx reset\n");
+                                gvt_vgpu_err("------------------------------------------\n");
                                 vgpu->mmio.disable_warn_untrack = true;
                         }
                 }
@@ -220,8 +219,8 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO read %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO read %08x len %d\n",
+                        offset, bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
@@ -259,10 +258,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
                 if (gp) {
                         ret = gp->handler(gp, pa, p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page write error %d, "
-                                        "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                gvt_err("guest page write error %d, "
+                                        "gfn 0x%lx, pa 0x%llx, "
+                                        "var 0x%x, len %d\n",
+                                        ret, gp->gfn, pa,
+                                        *(u32 *)p_data, bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -329,8 +329,8 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
                         /* all register bits are RO. */
                         if (ro_mask == ~(u64)0) {
-                                gvt_err("vgpu%d: try to write RO reg %x\n",
-                                                vgpu->id, offset);
+                                gvt_vgpu_err("try to write RO reg %x\n",
+                                        offset);
                                 ret = 0;
                                 goto out;
                         }
@@ -360,8 +360,8 @@ out:
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO write %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO write %08x len %d\n", offset,
+                     bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 3bc620f56f35..a3a027025cd0 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -107,4 +107,7 @@ int intel_vgpu_default_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                                  void *p_data, unsigned int bytes);
 int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                                   void *p_data, unsigned int bytes);
+
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset);
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index 5d1caf9daba9..311799136d7f 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -67,14 +67,15 @@ static int map_vgpu_opregion(struct intel_vgpu *vgpu, bool map)
                 mfn = intel_gvt_hypervisor_virt_to_mfn(vgpu_opregion(vgpu)->va
                         + i * PAGE_SIZE);
                 if (mfn == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("fail to get MFN from VA\n");
+                        gvt_vgpu_err("fail to get MFN from VA\n");
                         return -EINVAL;
                 }
                 ret = intel_gvt_hypervisor_map_gfn_to_mfn(vgpu,
                                 vgpu_opregion(vgpu)->gfn[i],
                                 mfn, 1, map);
                 if (ret) {
-                        gvt_err("fail to map GFN to MFN, errno: %d\n", ret);
+                        gvt_vgpu_err("fail to map GFN to MFN, errno: %d\n",
+                                ret);
                         return ret;
                 }
         }
@@ -287,7 +288,7 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         parm = vgpu_opregion(vgpu)->va + INTEL_GVT_OPREGION_PARM;
 
         if (!(swsci & SWSCI_SCI_SELECT)) {
-                gvt_err("vgpu%d: requesting SMI service\n", vgpu->id);
+                gvt_vgpu_err("requesting SMI service\n");
                 return 0;
         }
         /* ignore non 0->1 trasitions */
@@ -300,9 +301,8 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         func = GVT_OPREGION_FUNC(*scic);
         subfunc = GVT_OPREGION_SUBFUNC(*scic);
         if (!querying_capabilities(*scic)) {
-                gvt_err("vgpu%d: requesting runtime service: func \"%s\","
+                gvt_vgpu_err("requesting runtime service: func \"%s\","
                                 " subfunc \"%s\"\n",
-                                vgpu->id,
                                 opregion_func_name(func),
                                 opregion_subfunc_name(subfunc));
                 /*
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index 73f052a4f424..0beb83563b08 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -167,7 +167,7 @@ static void handle_tlb_pending_event(struct intel_vgpu *vgpu, int ring_id)
         I915_WRITE_FW(reg, 0x1);
 
         if (wait_for_atomic((I915_READ_FW(reg) == 0), 50))
-                gvt_err("timeout in invalidate ring (%d) tlb\n", ring_id);
+                gvt_vgpu_err("timeout in invalidate ring (%d) tlb\n", ring_id);
         else
                 vgpu_vreg(vgpu, regs[ring_id]) = 0;
 
@@ -207,7 +207,7 @@ static void load_mocs(struct intel_vgpu *vgpu, int ring_id)
                 l3_offset.reg = 0xb020;
                 for (i = 0; i < 32; i++) {
                         gen9_render_mocs_L3[i] = I915_READ(l3_offset);
-                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, offset));
+                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, l3_offset));
                         POSTING_READ(l3_offset);
                         l3_offset.reg += 4;
                 }
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 06c9584ac5f0..34b9acdf3479 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -101,7 +101,7 @@ struct tbs_sched_data {
         struct list_head runq_head;
 };
 
-#define GVT_DEFAULT_TIME_SLICE (1 * HZ / 1000)
+#define GVT_DEFAULT_TIME_SLICE (msecs_to_jiffies(1))
 
 static void tbs_sched_func(struct work_struct *work)
 {
@@ -223,7 +223,7 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
                 return;
 
         list_add_tail(&vgpu_data->list, &sched_data->runq_head);
-        schedule_delayed_work(&sched_data->work, sched_data->period);
+        schedule_delayed_work(&sched_data->work, 0);
 }
 
 static void tbs_sched_stop_schedule(struct intel_vgpu *vgpu)
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index d3a56c949025..a44782412f2c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -84,7 +84,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                 GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("Invalid guest context descriptor\n");
+                        gvt_vgpu_err("Invalid guest context descriptor\n");
                         return -EINVAL;
                 }
 
@@ -127,19 +127,22 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
         return 0;
 }
 
+static inline bool is_gvt_request(struct drm_i915_gem_request *req)
+{
+        return i915_gem_context_force_single_submission(req->ctx);
+}
+
 static int shadow_context_status_change(struct notifier_block *nb,
                 unsigned long action, void *data)
 {
-        struct intel_vgpu *vgpu = container_of(nb,
-                        struct intel_vgpu, shadow_ctx_notifier_block);
-        struct drm_i915_gem_request *req =
-                (struct drm_i915_gem_request *)data;
-        struct intel_gvt_workload_scheduler *scheduler =
-                &vgpu->gvt->scheduler;
+        struct drm_i915_gem_request *req = (struct drm_i915_gem_request *)data;
+        struct intel_gvt *gvt = container_of(nb, struct intel_gvt,
+                                shadow_ctx_notifier_block[req->engine->id]);
+        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload =
                 scheduler->current_workload[req->engine->id];
 
-        if (unlikely(!workload))
+        if (!is_gvt_request(req) || unlikely(!workload))
                 return NOTIFY_OK;
 
         switch (action) {
@@ -175,7 +178,9 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         int ring_id = workload->ring_id;
         struct i915_gem_context *shadow_ctx = workload->vgpu->shadow_ctx;
         struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine = dev_priv->engine[ring_id];
         struct drm_i915_gem_request *rq;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int ret;
 
         gvt_dbg_sched("ring id %d prepare to dispatch workload %p\n",
@@ -187,9 +192,24 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 
         mutex_lock(&dev_priv->drm.struct_mutex);
 
+        /* pin shadow context by gvt even the shadow context will be pinned
+         * when i915 alloc request. That is because gvt will update the guest
+         * context from shadow context when workload is completed, and at that
+         * moment, i915 may already unpined the shadow context to make the
+         * shadow_ctx pages invalid. So gvt need to pin itself. After update
+         * the guest context, gvt can unpin the shadow_ctx safely.
+         */
+        ret = engine->context_pin(engine, shadow_ctx);
+        if (ret) {
+                gvt_vgpu_err("fail to pin shadow context\n");
+                workload->status = ret;
+                mutex_unlock(&dev_priv->drm.struct_mutex);
+                return ret;
+        }
+
         rq = i915_gem_request_alloc(dev_priv->engine[ring_id], shadow_ctx);
         if (IS_ERR(rq)) {
-                gvt_err("fail to allocate gem request\n");
+                gvt_vgpu_err("fail to allocate gem request\n");
                 ret = PTR_ERR(rq);
                 goto out;
         }
@@ -202,9 +222,12 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         if (ret)
                 goto out;
 
-        ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
-        if (ret)
-                goto out;
+        if ((workload->ring_id == RCS) &&
+            (workload->wa_ctx.indirect_ctx.size != 0)) {
+                ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
+                if (ret)
+                        goto out;
+        }
 
         ret = populate_shadow_context(workload);
         if (ret)
@@ -227,6 +250,9 @@ out:
 
         if (!IS_ERR_OR_NULL(rq))
                 i915_add_request_no_flush(rq);
+        else
+                engine->context_unpin(engine, shadow_ctx);
+
         mutex_unlock(&dev_priv->drm.struct_mutex);
         return ret;
 }
@@ -322,7 +348,7 @@ static void update_guest_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                         GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid guest context descriptor\n");
+                        gvt_vgpu_err("invalid guest context descriptor\n");
                         return;
                 }
 
@@ -376,6 +402,10 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
          * For the workload w/o request, directly complete the workload.
          */
         if (workload->req) {
+                struct drm_i915_private *dev_priv =
+                        workload->vgpu->gvt->dev_priv;
+                struct intel_engine_cs *engine =
+                        dev_priv->engine[workload->ring_id];
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
@@ -388,6 +418,10 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
                                          INTEL_GVT_EVENT_MAX)
                                 intel_vgpu_trigger_virtual_event(vgpu, event);
                 }
+                mutex_lock(&dev_priv->drm.struct_mutex);
+                /* unpin shadow ctx as the shadow_ctx update is done */
+                engine->context_unpin(engine, workload->vgpu->shadow_ctx);
+                mutex_unlock(&dev_priv->drm.struct_mutex);
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -417,6 +451,7 @@ static int workload_thread(void *priv)
         int ring_id = p->ring_id;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload = NULL;
+        struct intel_vgpu *vgpu = NULL;
         int ret;
         bool need_force_wake = IS_SKYLAKE(gvt->dev_priv);
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
@@ -459,25 +494,14 @@ static int workload_thread(void *priv)
                 mutex_unlock(&gvt->lock);
 
                 if (ret) {
-                        gvt_err("fail to dispatch workload, skip\n");
+                        vgpu = workload->vgpu;
+                        gvt_vgpu_err("fail to dispatch workload, skip\n");
                         goto complete;
                 }
 
                 gvt_dbg_sched("ring id %d wait workload %p\n",
                                 workload->ring_id, workload);
-retry:
-                i915_wait_request(workload->req,
-                                         0, MAX_SCHEDULE_TIMEOUT);
-                /* I915 has replay mechanism and a request will be replayed
-                 * if there is i915 reset. So the seqno will be updated anyway.
-                 * If the seqno is not updated yet after waiting, which means
-                 * the replay may still be in progress and we can wait again.
-                 */
-                if (!i915_gem_request_completed(workload->req)) {
-                        gvt_dbg_sched("workload %p not completed, wait again\n",
-                                        workload);
-                        goto retry;
-                }
+                i915_wait_request(workload->req, 0, MAX_SCHEDULE_TIMEOUT);
 
 complete:
                 gvt_dbg_sched("will complete workload %p, status: %d\n",
@@ -513,15 +537,16 @@ void intel_gvt_wait_vgpu_idle(struct intel_vgpu *vgpu)
 void intel_gvt_clean_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
-        int i;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
 
         gvt_dbg_core("clean workload scheduler\n");
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                if (scheduler->thread[i]) {
-                        kthread_stop(scheduler->thread[i]);
-                        scheduler->thread[i] = NULL;
-                }
+        for_each_engine(engine, gvt->dev_priv, i) {
+                atomic_notifier_chain_unregister(
+                                        &engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
+                kthread_stop(scheduler->thread[i]);
         }
 }
 
@@ -529,18 +554,15 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct workload_thread_param *param = NULL;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
         int ret;
-        int i;
 
         gvt_dbg_core("init workload scheduler\n");
 
         init_waitqueue_head(&scheduler->workload_complete_wq);
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                /* check ring mask at init time */
-                if (!HAS_ENGINE(gvt->dev_priv, i))
-                        continue;
-
+        for_each_engine(engine, gvt->dev_priv, i) {
                 init_waitqueue_head(&scheduler->waitq[i]);
 
                 param = kzalloc(sizeof(*param), GFP_KERNEL);
@@ -559,6 +581,11 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
                         ret = PTR_ERR(scheduler->thread[i]);
                         goto err;
                 }
+
+                gvt->shadow_ctx_notifier_block[i].notifier_call =
+                                        shadow_context_status_change;
+                atomic_notifier_chain_register(&engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
         }
         return 0;
 err:
@@ -570,9 +597,6 @@ err:
 
 void intel_vgpu_clean_gvt_context(struct intel_vgpu *vgpu)
 {
-        atomic_notifier_chain_unregister(&vgpu->shadow_ctx->status_notifier,
-                        &vgpu->shadow_ctx_notifier_block);
-
         i915_gem_context_put_unlocked(vgpu->shadow_ctx);
 }
 
@@ -587,10 +611,5 @@ int intel_vgpu_init_gvt_context(struct intel_vgpu *vgpu)
 
         vgpu->shadow_ctx->engine[RCS].initialised = true;
 
-        vgpu->shadow_ctx_notifier_block.notifier_call =
-                shadow_context_status_change;
-
-        atomic_notifier_chain_register(&vgpu->shadow_ctx->status_notifier,
-                                       &vgpu->shadow_ctx_notifier_block);
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 41cfa5ccae84..649ef280cc9a 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -72,7 +72,7 @@ static struct {
         char *name;
 } vgpu_types[] = {
 /* Fixed vGPU type table */
-        { MB_TO_BYTES(64), MB_TO_BYTES(512), 4, GVT_EDID_1024_768, "8" },
+        { MB_TO_BYTES(64), MB_TO_BYTES(384), 4, GVT_EDID_1024_768, "8" },
         { MB_TO_BYTES(128), MB_TO_BYTES(512), 4, GVT_EDID_1920_1200, "4" },
         { MB_TO_BYTES(256), MB_TO_BYTES(1024), 4, GVT_EDID_1920_1200, "2" },
         { MB_TO_BYTES(512), MB_TO_BYTES(2048), 4, GVT_EDID_1920_1200, "1" },
@@ -179,20 +179,34 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
 }
 
 /**
- * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * intel_gvt_active_vgpu - activate a virtual GPU
  * @vgpu: virtual GPU
  *
- * This function is called when user wants to destroy a virtual GPU.
+ * This function is called when user wants to activate a virtual GPU.
  *
  */
-void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu)
+{
+        mutex_lock(&vgpu->gvt->lock);
+        vgpu->active = true;
+        mutex_unlock(&vgpu->gvt->lock);
+}
+
+/**
+ * intel_gvt_deactive_vgpu - deactivate a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to deactivate a virtual GPU.
+ * All virtual GPU runtime information will be destroyed.
+ *
+ */
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu)
 {
         struct intel_gvt *gvt = vgpu->gvt;
 
         mutex_lock(&gvt->lock);
 
         vgpu->active = false;
-        idr_remove(&gvt->vgpu_idr, vgpu->id);
 
         if (atomic_read(&vgpu->running_workload_num)) {
                 mutex_unlock(&gvt->lock);
@@ -201,6 +215,26 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         }
 
         intel_vgpu_stop_schedule(vgpu);
+
+        mutex_unlock(&gvt->lock);
+}
+
+/**
+ * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to destroy a virtual GPU.
+ *
+ */
+void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+
+        mutex_lock(&gvt->lock);
+
+        WARN(vgpu->active, "vGPU is still active!\n");
+
+        idr_remove(&gvt->vgpu_idr, vgpu->id);
         intel_vgpu_clean_sched_policy(vgpu);
         intel_vgpu_clean_gvt_context(vgpu);
         intel_vgpu_clean_execlist(vgpu);
@@ -277,7 +311,6 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_clean_shadow_ctx;
 
-        vgpu->active = true;
         mutex_unlock(&gvt->lock);
 
         return vgpu;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index e703556eba99..5c089b3c2a7e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -248,6 +248,7 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_IRQ_ACTIVE:
         case I915_PARAM_ALLOW_BATCHBUFFER:
         case I915_PARAM_LAST_DISPATCH:
+        case I915_PARAM_HAS_EXEC_CONSTANTS:
                 /* Reject all old ums/dri params. */
                 return -ENODEV;
         case I915_PARAM_CHIPSET_ID:
@@ -274,9 +275,6 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_HAS_BSD2:
                 value = !!dev_priv->engine[VCS2];
                 break;
-        case I915_PARAM_HAS_EXEC_CONSTANTS:
-                value = INTEL_GEN(dev_priv) >= 4;
-                break;
         case I915_PARAM_HAS_LLC:
                 value = HAS_LLC(dev_priv);
                 break;
@@ -1436,8 +1434,6 @@ static int i915_drm_suspend(struct drm_device *dev)
                 goto out;
         }
 
-        intel_guc_suspend(dev_priv);
-
         intel_display_suspend(dev);
 
         intel_dp_mst_suspend(dev);
@@ -1788,7 +1784,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
                 goto error;
         }
 
-        i915_gem_reset_finish(dev_priv);
+        i915_gem_reset(dev_priv);
         intel_overlay_reset(dev_priv);
 
         /* Ok, now get things going again... */
@@ -1814,6 +1810,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
         i915_queue_hangcheck(dev_priv);
 
 wakeup:
+        i915_gem_reset_finish(dev_priv);
         enable_irq(dev_priv->drm.irq);
         wake_up_bit(&error->flags, I915_RESET_IN_PROGRESS);
         return;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7febe6eecf72..46fcd8b7080a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -806,6 +806,7 @@ struct intel_csr {
         func(has_resource_streamer); \
         func(has_runtime_pm); \
         func(has_snoop); \
+        func(unfenced_needs_alignment); \
         func(cursor_needs_physical); \
         func(hws_needs_physical); \
         func(overlay_needs_physical); \
@@ -1325,7 +1326,7 @@ struct intel_gen6_power_mgmt {
         unsigned boosts;
 
         /* manual wa residency calculations */
-        struct intel_rps_ei up_ei, down_ei;
+        struct intel_rps_ei ei;
 
         /*
          * Protects RPS/RC6 register access and PCU communication.
@@ -2064,8 +2065,6 @@ struct drm_i915_private {
 
         const struct intel_device_info info;
 
-        int relative_constants_mode;
-
         void __iomem *regs;
 
         struct intel_uncore uncore;
@@ -3342,6 +3341,7 @@ static inline u32 i915_reset_count(struct i915_gpu_error *error)
 }
 
 int i915_gem_reset_prepare(struct drm_i915_private *dev_priv);
+void i915_gem_reset(struct drm_i915_private *dev_priv);
 void i915_gem_reset_finish(struct drm_i915_private *dev_priv);
 void i915_gem_set_wedged(struct drm_i915_private *dev_priv);
 void i915_gem_clflush_object(struct drm_i915_gem_object *obj, bool force);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 10777da73039..fe531f904062 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2719,7 +2719,16 @@ int i915_gem_reset_prepare(struct drm_i915_private *dev_priv)
         for_each_engine(engine, dev_priv, id) {
                 struct drm_i915_gem_request *request;
 
+                /* Prevent request submission to the hardware until we have
+                 * completed the reset in i915_gem_reset_finish(). If a request
+                 * is completed by one engine, it may then queue a request
+                 * to a second via its engine->irq_tasklet *just* as we are
+                 * calling engine->init_hw() and also writing the ELSP.
+                 * Turning off the engine->irq_tasklet until the reset is over
+                 * prevents the race.
+                 */
                 tasklet_kill(&engine->irq_tasklet);
+                tasklet_disable(&engine->irq_tasklet);
 
                 if (engine_stalled(engine)) {
                         request = i915_gem_find_active_request(engine);
@@ -2834,7 +2843,7 @@ static void i915_gem_reset_engine(struct intel_engine_cs *engine)
         engine->reset_hw(engine, request);
 }
 
-void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+void i915_gem_reset(struct drm_i915_private *dev_priv)
 {
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
@@ -2856,6 +2865,17 @@ void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
         }
 }
 
+void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+{
+        struct intel_engine_cs *engine;
+        enum intel_engine_id id;
+
+        lockdep_assert_held(&dev_priv->drm.struct_mutex);
+
+        for_each_engine(engine, dev_priv, id)
+                tasklet_enable(&engine->irq_tasklet);
+}
+
 static void nop_submit_request(struct drm_i915_gem_request *request)
 {
         dma_fence_set_error(&request->fence, -EIO);
@@ -4328,6 +4348,8 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv)
         i915_gem_context_lost(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
+        intel_guc_suspend(dev_priv);
+
         cancel_delayed_work_sync(&dev_priv->gpu_error.hangcheck_work);
         cancel_delayed_work_sync(&dev_priv->gt.retire_work);
 
@@ -4674,8 +4696,6 @@ i915_gem_load_init(struct drm_i915_private *dev_priv)
         init_waitqueue_head(&dev_priv->gpu_error.wait_queue);
         init_waitqueue_head(&dev_priv->gpu_error.reset_queue);
 
-        dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
-
         init_waitqueue_head(&dev_priv->pending_flip_queue);
 
         dev_priv->mm.interruptible = true;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 17f90c618208..e2d83b6d376b 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -311,7 +311,6 @@ __create_hw_context(struct drm_i915_private *dev_priv,
         ctx->ring_size = 4 * PAGE_SIZE;
         ctx->desc_template = GEN8_CTX_ADDRESSING_MODE(dev_priv) <<
                              GEN8_CTX_ADDRESSING_MODE_SHIFT;
-        ATOMIC_INIT_NOTIFIER_HEAD(&ctx->status_notifier);
 
         /* GuC requires the ring to be placed above GUC_WOPCM_TOP. If GuC is not
          * present or not in use we still need a small bias as ring wraparound
diff --git a/drivers/gpu/drm/i915/i915_gem_context.h b/drivers/gpu/drm/i915/i915_gem_context.h
index 0ac750b90f3d..e9c008fe14b1 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.h
+++ b/drivers/gpu/drm/i915/i915_gem_context.h
@@ -160,9 +160,6 @@ struct i915_gem_context {
         /** desc_template: invariant fields for the HW context descriptor */
         u32 desc_template;
 
-        /** status_notifier: list of callbacks for context-switch changes */
-        struct atomic_notifier_head status_notifier;
-
         /** guilty_count: How many times this context has caused a GPU hang. */
         unsigned int guilty_count;
         /**
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d02cfaefe1c8..15a15d00a6bf 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -888,6 +888,7 @@ i915_gem_execbuffer_reserve(struct intel_engine_cs *engine,
         struct list_head ordered_vmas;
         struct list_head pinned_vmas;
         bool has_fenced_gpu_access = INTEL_GEN(engine->i915) < 4;
+        bool needs_unfenced_map = INTEL_INFO(engine->i915)->unfenced_needs_alignment;
         int retry;
 
         vm = list_first_entry(vmas, struct i915_vma, exec_list)->vm;
@@ -908,7 +909,8 @@ i915_gem_execbuffer_reserve(struct intel_engine_cs *engine,
                 if (!has_fenced_gpu_access)
                         entry->flags &= ~EXEC_OBJECT_NEEDS_FENCE;
                 need_fence =
-                        entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                        (entry->flags & EXEC_OBJECT_NEEDS_FENCE ||
+                         needs_unfenced_map) &&
                         i915_gem_object_is_tiled(obj);
                 need_mappable = need_fence || need_reloc_mappable(vma);
 
@@ -1408,10 +1410,7 @@ execbuf_submit(struct i915_execbuffer_params *params,
                struct drm_i915_gem_execbuffer2 *args,
                struct list_head *vmas)
 {
-        struct drm_i915_private *dev_priv = params->request->i915;
         u64 exec_start, exec_len;
-        int instp_mode;
-        u32 instp_mask;
         int ret;
 
         ret = i915_gem_execbuffer_move_to_gpu(params->request, vmas);
@@ -1422,56 +1421,11 @@ execbuf_submit(struct i915_execbuffer_params *params,
         if (ret)
                 return ret;
 
-        instp_mode = args->flags & I915_EXEC_CONSTANTS_MASK;
-        instp_mask = I915_EXEC_CONSTANTS_MASK;
-        switch (instp_mode) {
-        case I915_EXEC_CONSTANTS_REL_GENERAL:
-        case I915_EXEC_CONSTANTS_ABSOLUTE:
-        case I915_EXEC_CONSTANTS_REL_SURFACE:
-                if (instp_mode != 0 && params->engine->id != RCS) {
-                        DRM_DEBUG("non-0 rel constants mode on non-RCS\n");
-                        return -EINVAL;
-                }
-
-                if (instp_mode != dev_priv->relative_constants_mode) {
-                        if (INTEL_INFO(dev_priv)->gen < 4) {
-                                DRM_DEBUG("no rel constants on pre-gen4\n");
-                                return -EINVAL;
-                        }
-
-                        if (INTEL_INFO(dev_priv)->gen > 5 &&
-                            instp_mode == I915_EXEC_CONSTANTS_REL_SURFACE) {
-                                DRM_DEBUG("rel surface constants mode invalid on gen5+\n");
-                                return -EINVAL;
-                        }
-
-                        /* The HW changed the meaning on this bit on gen6 */
-                        if (INTEL_INFO(dev_priv)->gen >= 6)
-                                instp_mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
-                }
-                break;
-        default:
-                DRM_DEBUG("execbuf with unknown constants: %d\n", instp_mode);
+        if (args->flags & I915_EXEC_CONSTANTS_MASK) {
+                DRM_DEBUG("I915_EXEC_CONSTANTS_* unsupported\n");
                 return -EINVAL;
         }
 
-        if (params->engine->id == RCS &&
-            instp_mode != dev_priv->relative_constants_mode) {
-                struct intel_ring *ring = params->request->ring;
-
-                ret = intel_ring_begin(params->request, 4);
-                if (ret)
-                        return ret;
-
-                intel_ring_emit(ring, MI_NOOP);
-                intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
-                intel_ring_emit_reg(ring, INSTPM);
-                intel_ring_emit(ring, instp_mask << 16 | instp_mode);
-                intel_ring_advance(ring);
-
-                dev_priv->relative_constants_mode = instp_mode;
-        }
-
         if (args->flags & I915_EXEC_GEN7_SOL_RESET) {
                 ret = i915_reset_gen7_sol_offsets(params->request);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2801a4d56324..96e45a4d5441 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2704,7 +2704,7 @@ void i915_gem_gtt_finish_pages(struct drm_i915_gem_object *obj,
         struct i915_ggtt *ggtt = &dev_priv->ggtt;
 
         if (unlikely(ggtt->do_idle_maps)) {
-                if (i915_gem_wait_for_idle(dev_priv, I915_WAIT_LOCKED)) {
+                if (i915_gem_wait_for_idle(dev_priv, 0)) {
                         DRM_ERROR("Failed to wait for idle; VT'd may hang.\n");
                         /* Wait a bit, in hopes it avoids the hang */
                         udelay(10);
diff --git a/drivers/gpu/drm/i915/i915_gem_request.c b/drivers/gpu/drm/i915/i915_gem_request.c
index e7c3c0318ff6..da70bfe97ec5 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.c
+++ b/drivers/gpu/drm/i915/i915_gem_request.c
@@ -37,6 +37,17 @@ static const char *i915_fence_get_driver_name(struct dma_fence *fence)
 
 static const char *i915_fence_get_timeline_name(struct dma_fence *fence)
 {
+        /* The timeline struct (as part of the ppgtt underneath a context)
+         * may be freed when the request is no longer in use by the GPU.
+         * We could extend the life of a context to beyond that of all
+         * fences, possibly keeping the hw resource around indefinitely,
+         * or we just give them a false name. Since
+         * dma_fence_ops.get_timeline_name is a debug feature, the occasional
+         * lie seems justifiable.
+         */
+        if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+                return "signaled";
+
         return to_request(fence)->timeline->common->name;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 401006b4c6a3..70b3832a79dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -53,6 +53,17 @@ static bool i915_gem_shrinker_lock(struct drm_device *dev, bool *unlock)
         BUG();
 }
 
+static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
+{
+        if (!unlock)
+                return;
+
+        mutex_unlock(&dev->struct_mutex);
+
+        /* expedite the RCU grace period to free some request slabs */
+        synchronize_rcu_expedited();
+}
+
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
 {
         struct i915_vma *vma;
@@ -232,11 +243,8 @@ i915_gem_shrink(struct drm_i915_private *dev_priv,
                 intel_runtime_pm_put(dev_priv);
 
         i915_gem_retire_requests(dev_priv);
-        if (unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
 
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
+        i915_gem_shrinker_unlock(&dev_priv->drm, unlock);
 
         return count;
 }
@@ -263,7 +271,7 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_BOUND |
                                 I915_SHRINK_UNBOUND |
                                 I915_SHRINK_ACTIVE);
-        rcu_barrier(); /* wait until our RCU delayed slab frees are completed */
+        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
 
         return freed;
 }
@@ -293,8 +301,7 @@ i915_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
                         count += obj->base.size >> PAGE_SHIFT;
         }
 
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return count;
 }
@@ -321,8 +328,8 @@ i915_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
                                          sc->nr_to_scan - freed,
                                          I915_SHRINK_BOUND |
                                          I915_SHRINK_UNBOUND);
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return freed;
 }
@@ -364,8 +371,7 @@ i915_gem_shrinker_unlock_uninterruptible(struct drm_i915_private *dev_priv,
                                          struct shrinker_lock_uninterruptible *slu)
 {
         dev_priv->mm.interruptible = slu->was_interruptible;
-        if (slu->unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
+        i915_gem_shrinker_unlock(&dev_priv->drm, slu->unlock);
 }
 
 static int
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e6ffef2f707a..b6c886ac901b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1046,68 +1046,51 @@ static void vlv_c0_read(struct drm_i915_private *dev_priv,
         ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT);
 }
 
-static bool vlv_c0_above(struct drm_i915_private *dev_priv,
-                         const struct intel_rps_ei *old,
-                         const struct intel_rps_ei *now,
-                         int threshold)
-{
-        u64 time, c0;
-        unsigned int mul = 100;
-
-        if (old->cz_clock == 0)
-                return false;
-
-        if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
-                mul <<= 8;
-
-        time = now->cz_clock - old->cz_clock;
-        time *= threshold * dev_priv->czclk_freq;
-
-        /* Workload can be split between render + media, e.g. SwapBuffers
-         * being blitted in X after being rendered in mesa. To account for
-         * this we need to combine both engines into our activity counter.
-         */
-        c0 = now->render_c0 - old->render_c0;
-        c0 += now->media_c0 - old->media_c0;
-        c0 *= mul * VLV_CZ_CLOCK_TO_MILLI_SEC;
-
-        return c0 >= time;
-}
-
 void gen6_rps_reset_ei(struct drm_i915_private *dev_priv)
 {
-        vlv_c0_read(dev_priv, &dev_priv->rps.down_ei);
-        dev_priv->rps.up_ei = dev_priv->rps.down_ei;
+        memset(&dev_priv->rps.ei, 0, sizeof(dev_priv->rps.ei));
 }
 
 static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir)
 {
+        const struct intel_rps_ei *prev = &dev_priv->rps.ei;
         struct intel_rps_ei now;
         u32 events = 0;
 
-        if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0)
+        if ((pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) == 0)
                 return 0;
 
         vlv_c0_read(dev_priv, &now);
         if (now.cz_clock == 0)
                 return 0;
 
-        if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) {
-                if (!vlv_c0_above(dev_priv,
-                                  &dev_priv->rps.down_ei, &now,
-                                  dev_priv->rps.down_threshold))
-                        events |= GEN6_PM_RP_DOWN_THRESHOLD;
-                dev_priv->rps.down_ei = now;
-        }
+        if (prev->cz_clock) {
+                u64 time, c0;
+                unsigned int mul;
+
+                mul = VLV_CZ_CLOCK_TO_MILLI_SEC * 100; /* scale to threshold% */
+                if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
+                        mul <<= 8;
 
-        if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
-                if (vlv_c0_above(dev_priv,
-                                 &dev_priv->rps.up_ei, &now,
-                                 dev_priv->rps.up_threshold))
-                        events |= GEN6_PM_RP_UP_THRESHOLD;
-                dev_priv->rps.up_ei = now;
+                time = now.cz_clock - prev->cz_clock;
+                time *= dev_priv->czclk_freq;
+
+                /* Workload can be split between render + media,
+                 * e.g. SwapBuffers being blitted in X after being rendered in
+                 * mesa. To account for this we need to combine both engines
+                 * into our activity counter.
+                 */
+                c0 = now.render_c0 - prev->render_c0;
+                c0 += now.media_c0 - prev->media_c0;
+                c0 *= mul;
+
+                if (c0 > time * dev_priv->rps.up_threshold)
+                        events = GEN6_PM_RP_UP_THRESHOLD;
+                else if (c0 < time * dev_priv->rps.down_threshold)
+                        events = GEN6_PM_RP_DOWN_THRESHOLD;
         }
 
+        dev_priv->rps.ei = now;
         return events;
 }
 
@@ -4228,7 +4211,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         /* Let's track the enabled rps events */
         if (IS_VALLEYVIEW(dev_priv))
                 /* WaGsvRC0ResidencyMethod:vlv */
-                dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED;
+                dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED;
         else
                 dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
 
@@ -4266,6 +4249,16 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         if (!IS_GEN2(dev_priv))
                 dev->vblank_disable_immediate = true;
 
+        /* Most platforms treat the display irq block as an always-on
+         * power domain. vlv/chv can disable it at runtime and need
+         * special care to avoid writing any of the display block registers
+         * outside of the power domain. We defer setting up the display irqs
+         * in this case to the runtime pm.
+         */
+        dev_priv->display_irqs_enabled = true;
+        if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+                dev_priv->display_irqs_enabled = false;
+
         dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
         dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
 
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index ecb487b5356f..9bbbd4e83e3c 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -60,6 +60,7 @@
         .has_overlay = 1, .overlay_needs_physical = 1, \
         .has_gmch_display = 1, \
         .hws_needs_physical = 1, \
+        .unfenced_needs_alignment = 1, \
         .ring_mask = RENDER_RING, \
         GEN_DEFAULT_PIPEOFFSETS, \
         CURSOR_OFFSETS
@@ -101,6 +102,7 @@ static const struct intel_device_info intel_i915g_info = {
         .platform = INTEL_I915G, .cursor_needs_physical = 1,
         .has_overlay = 1, .overlay_needs_physical = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i915gm_info = {
@@ -112,6 +114,7 @@ static const struct intel_device_info intel_i915gm_info = {
         .supports_tv = 1,
         .has_fbc = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i945g_info = {
@@ -120,6 +123,7 @@ static const struct intel_device_info intel_i945g_info = {
         .has_hotplug = 1, .cursor_needs_physical = 1,
         .has_overlay = 1, .overlay_needs_physical = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i945gm_info = {
@@ -130,6 +134,7 @@ static const struct intel_device_info intel_i945gm_info = {
         .supports_tv = 1,
         .has_fbc = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_g33_info = {
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index a1b7eec58be2..70964ca9251e 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1705,7 +1705,7 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
          */
         if (WARN_ON(stream->sample_flags != props->sample_flags)) {
                 ret = -ENODEV;
-                goto err_alloc;
+                goto err_flags;
         }
 
         list_add(&stream->link, &dev_priv->perf.streams);
@@ -1728,6 +1728,7 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
 
 err_open:
         list_del(&stream->link);
+err_flags:
         if (stream->ops->destroy)
                 stream->ops->destroy(stream);
 err_alloc:
@@ -1793,6 +1794,11 @@ static int read_properties_unlocked(struct drm_i915_private *dev_priv,
                 if (ret)
                         return ret;
 
+                if (id == 0 || id >= DRM_I915_PERF_PROP_MAX) {
+                        DRM_DEBUG("Unknown i915 perf property ID\n");
+                        return -EINVAL;
+                }
+
                 switch ((enum drm_i915_perf_property_id)id) {
                 case DRM_I915_PERF_PROP_CTX_HANDLE:
                         props->single_context = 1;
@@ -1862,9 +1868,8 @@ static int read_properties_unlocked(struct drm_i915_private *dev_priv,
                         props->oa_periodic = true;
                         props->oa_period_exponent = value;
                         break;
-                default:
+                case DRM_I915_PERF_PROP_MAX:
                         MISSING_CASE(id);
-                        DRM_DEBUG("Unknown i915 perf property ID\n");
                         return -EINVAL;
                 }
 
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 0085bc745f6a..de219b71fb76 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,7 +35,6 @@
  */
 
 #define I915_CSR_GLK "i915/glk_dmc_ver1_01.bin"
-MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
 
 #define I915_CSR_KBL "i915/kbl_dmc_ver1_01.bin"
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3282b0f4b134..ed1f4f272b4f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -16696,12 +16696,11 @@ int intel_modeset_init(struct drm_device *dev)
                 }
         }
 
-        intel_update_czclk(dev_priv);
-        intel_update_cdclk(dev_priv);
-        dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq;
-
         intel_shared_dpll_init(dev);
 
+        intel_update_czclk(dev_priv);
+        intel_modeset_init_hw(dev);
+
         if (dev_priv->max_cdclk_freq == 0)
                 intel_update_max_cdclk(dev_priv);
 
@@ -17258,8 +17257,6 @@ void intel_modeset_gem_init(struct drm_device *dev)
 
         intel_init_gt_powersave(dev_priv);
 
-        intel_modeset_init_hw(dev);
-
         intel_setup_overlay(dev_priv);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 371acf109e34..ab1be5c80ea5 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -105,6 +105,8 @@ intel_engine_setup(struct drm_i915_private *dev_priv,
         /* Nothing to do here, execute in order of dependencies */
         engine->schedule = NULL;
 
+        ATOMIC_INIT_NOTIFIER_HEAD(&engine->context_status_notifier);
+
         dev_priv->engine[id] = engine;
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_gvt.c b/drivers/gpu/drm/i915/intel_gvt.c
index d23c0fcff751..8c04eca84351 100644
--- a/drivers/gpu/drm/i915/intel_gvt.c
+++ b/drivers/gpu/drm/i915/intel_gvt.c
@@ -77,6 +77,11 @@ int intel_gvt_init(struct drm_i915_private *dev_priv)
                 goto bail;
         }
 
+        if (!i915.enable_execlists) {
+                DRM_INFO("GPU guest virtualisation [GVT-g] disabled due to disabled execlist submission [i915.enable_execlists module parameter]\n");
+                goto bail;
+        }
+
         /*
          * We're not in host or fail to find a MPT module, disable GVT-g
          */
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ebae2bd83918..24b2fa5b6282 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1298,16 +1298,34 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
 
 static bool hdmi_12bpc_possible(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc_state->base.crtc->dev;
+        struct drm_i915_private *dev_priv =
+                to_i915(crtc_state->base.crtc->dev);
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
+        struct drm_connector *connector;
+        int i;
 
-        if (HAS_GMCH_DISPLAY(to_i915(dev)))
+        if (HAS_GMCH_DISPLAY(dev_priv))
                 return false;
 
         /*
          * HDMI 12bpc affects the clocks, so it's only possible
          * when not cloning with other encoder types.
          */
-        return crtc_state->output_types == 1 << INTEL_OUTPUT_HDMI;
+        if (crtc_state->output_types != 1 << INTEL_OUTPUT_HDMI)
+                return false;
+
+        for_each_connector_in_state(state, connector, connector_state, i) {
+                const struct drm_display_info *info = &connector->display_info;
+
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
+
+                if ((info->edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_36) == 0)
+                        return false;
+        }
+
+        return true;
 }
 
 bool intel_hdmi_compute_config(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index b62e3f8ad415..54208bef7a83 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -219,7 +219,7 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
                         }
                 }
         }
-        if (dev_priv->display.hpd_irq_setup)
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock_irq(&dev_priv->irq_lock);
 
@@ -425,7 +425,7 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
                 }
         }
 
-        if (storm_detected)
+        if (storm_detected && dev_priv->display_irqs_enabled)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock(&dev_priv->irq_lock);
 
@@ -471,10 +471,12 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
          * Interrupt setup is already guaranteed to be single-threaded, this is
          * just to make the assert_spin_locked checks happy.
          */
-        spin_lock_irq(&dev_priv->irq_lock);
-        if (dev_priv->display.hpd_irq_setup)
-                dev_priv->display.hpd_irq_setup(dev_priv);
-        spin_unlock_irq(&dev_priv->irq_lock);
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup) {
+                spin_lock_irq(&dev_priv->irq_lock);
+                if (dev_priv->display_irqs_enabled)
+                        dev_priv->display.hpd_irq_setup(dev_priv);
+                spin_unlock_irq(&dev_priv->irq_lock);
+        }
 }
 
 static void i915_hpd_poll_init_work(struct work_struct *work)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index ebf8023d21e6..47517a02f0a4 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -345,7 +345,8 @@ execlists_context_status_change(struct drm_i915_gem_request *rq,
         if (!IS_ENABLED(CONFIG_DRM_I915_GVT))
                 return;
 
-        atomic_notifier_call_chain(&rq->ctx->status_notifier, status, rq);
+        atomic_notifier_call_chain(&rq->engine->context_status_notifier,
+                                   status, rq);
 }
 
 static void
@@ -669,15 +670,14 @@ static void execlists_submit_request(struct drm_i915_gem_request *request)
 static struct intel_engine_cs *
 pt_lock_engine(struct i915_priotree *pt, struct intel_engine_cs *locked)
 {
-        struct intel_engine_cs *engine;
+        struct intel_engine_cs *engine =
+                container_of(pt, struct drm_i915_gem_request, priotree)->engine;
+
+        GEM_BUG_ON(!locked);
 
-        engine = container_of(pt,
-                              struct drm_i915_gem_request,
-                              priotree)->engine;
         if (engine != locked) {
-                if (locked)
-                        spin_unlock_irq(&locked->timeline->lock);
-                spin_lock_irq(&engine->timeline->lock);
+                spin_unlock(&locked->timeline->lock);
+                spin_lock(&engine->timeline->lock);
         }
 
         return engine;
@@ -685,7 +685,7 @@ pt_lock_engine(struct i915_priotree *pt, struct intel_engine_cs *locked)
 
 static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
 {
-        struct intel_engine_cs *engine = NULL;
+        struct intel_engine_cs *engine;
         struct i915_dependency *dep, *p;
         struct i915_dependency stack;
         LIST_HEAD(dfs);
@@ -719,26 +719,23 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
         list_for_each_entry_safe(dep, p, &dfs, dfs_link) {
                 struct i915_priotree *pt = dep->signaler;
 
-                list_for_each_entry(p, &pt->signalers_list, signal_link)
+                /* Within an engine, there can be no cycle, but we may
+                 * refer to the same dependency chain multiple times
+                 * (redundant dependencies are not eliminated) and across
+                 * engines.
+                 */
+                list_for_each_entry(p, &pt->signalers_list, signal_link) {
+                        GEM_BUG_ON(p->signaler->priority < pt->priority);
                         if (prio > READ_ONCE(p->signaler->priority))
                                 list_move_tail(&p->dfs_link, &dfs);
+                }
 
                 list_safe_reset_next(dep, p, dfs_link);
-                if (!RB_EMPTY_NODE(&pt->node))
-                        continue;
-
-                engine = pt_lock_engine(pt, engine);
-
-                /* If it is not already in the rbtree, we can update the
-                 * priority inplace and skip over it (and its dependencies)
-                 * if it is referenced *again* as we descend the dfs.
-                 */
-                if (prio > pt->priority && RB_EMPTY_NODE(&pt->node)) {
-                        pt->priority = prio;
-                        list_del_init(&dep->dfs_link);
-                }
         }
 
+        engine = request->engine;
+        spin_lock_irq(&engine->timeline->lock);
+
         /* Fifo and depth-first replacement ensure our deps execute before us */
         list_for_each_entry_safe_reverse(dep, p, &dfs, dfs_link) {
                 struct i915_priotree *pt = dep->signaler;
@@ -750,16 +747,15 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
                 if (prio <= pt->priority)
                         continue;
 
-                GEM_BUG_ON(RB_EMPTY_NODE(&pt->node));
-
                 pt->priority = prio;
-                rb_erase(&pt->node, &engine->execlist_queue);
-                if (insert_request(pt, &engine->execlist_queue))
-                        engine->execlist_first = &pt->node;
+                if (!RB_EMPTY_NODE(&pt->node)) {
+                        rb_erase(&pt->node, &engine->execlist_queue);
+                        if (insert_request(pt, &engine->execlist_queue))
+                                engine->execlist_first = &pt->node;
+                }
         }
 
-        if (engine)
-                spin_unlock_irq(&engine->timeline->lock);
+        spin_unlock_irq(&engine->timeline->lock);
 
         /* XXX Do we need to preempt to make room for us and our deps? */
 }
@@ -1439,7 +1435,9 @@ static void reset_common_ring(struct intel_engine_cs *engine,
         GEM_BUG_ON(request->ctx != port[0].request->ctx);
 
         /* Reset WaIdleLiteRestore:bdw,skl as well */
-        request->tail = request->wa_tail - WA_TAIL_DWORDS * sizeof(u32);
+        request->tail =
+                intel_ring_wrap(request->ring,
+                                request->wa_tail - WA_TAIL_DWORDS*sizeof(u32));
 }
 
 static int intel_logical_ring_emit_pdps(struct drm_i915_gem_request *req)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 940bab22d464..6a29784d2b41 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4928,8 +4928,9 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
 {
         u32 mask = 0;
 
+        /* We use UP_EI_EXPIRED interupts for both up/down in manual mode */
         if (val > dev_priv->rps.min_freq_softlimit)
-                mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
+                mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
         if (val < dev_priv->rps.max_freq_softlimit)
                 mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD;
 
@@ -5039,7 +5040,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv)
 {
         mutex_lock(&dev_priv->rps.hw_lock);
         if (dev_priv->rps.enabled) {
-                if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED))
+                if (dev_priv->pm_rps_events & GEN6_PM_RP_UP_EI_EXPIRED)
                         gen6_rps_reset_ei(dev_priv);
                 I915_WRITE(GEN6_PMINTRMSK,
                            gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 91bc4abf5d3e..6c5f9958197d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -2024,6 +2024,8 @@ static int intel_ring_context_pin(struct intel_engine_cs *engine,
                 ret = context_pin(ctx, flags);
                 if (ret)
                         goto error;
+
+                ce->state->obj->mm.dirty = true;
         }
 
         /* The kernel context is only used as a placeholder for flushing the
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 79c2b8d72322..8cb2078c5bfc 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -403,6 +403,9 @@ struct intel_engine_cs {
          */
         struct i915_gem_context *legacy_active_context;
 
+        /* status_notifier: list of callbacks for context-switch changes */
+        struct atomic_notifier_head context_status_notifier;
+
         struct intel_engine_hangcheck hangcheck;
 
         bool needs_cmd_parser;
@@ -518,11 +521,17 @@ static inline void intel_ring_advance(struct intel_ring *ring)
          */
 }
 
+static inline u32
+intel_ring_wrap(const struct intel_ring *ring, u32 pos)
+{
+        return pos & (ring->size - 1);
+}
+
 static inline u32 intel_ring_offset(struct intel_ring *ring, void *addr)
 {
         /* Don't write ring->size (equivalent to 0) as that hangs some GPUs. */
         u32 offset = addr - ring->vaddr;
-        return offset & (ring->size - 1);
+        return intel_ring_wrap(ring, offset);
 }
 
 int __intel_ring_space(int head, int tail, int size);
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 4414cf73735d..36602ac7e248 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -534,7 +534,7 @@ static void a5xx_destroy(struct msm_gpu *gpu)
         }
 
         if (a5xx_gpu->gpmu_bo) {
-                if (a5xx_gpu->gpmu_bo)
+                if (a5xx_gpu->gpmu_iova)
                         msm_gem_put_iova(a5xx_gpu->gpmu_bo, gpu->id);
                 drm_gem_object_unreference_unlocked(a5xx_gpu->gpmu_bo);
         }
@@ -860,7 +860,9 @@ static const struct adreno_gpu_funcs funcs = {
                 .idle = a5xx_idle,
                 .irq = a5xx_irq,
                 .destroy = a5xx_destroy,
+#ifdef CONFIG_DEBUG_FS
                 .show = a5xx_show,
+#endif
         },
         .get_timestamp = a5xx_get_timestamp,
 };
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index c9bd1e6225f4..5ae65426b4e5 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -418,18 +418,27 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         return 0;
 }
 
-void adreno_gpu_cleanup(struct adreno_gpu *gpu)
+void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
 {
-        if (gpu->memptrs_bo) {
-                if (gpu->memptrs)
-                        msm_gem_put_vaddr(gpu->memptrs_bo);
+        struct msm_gpu *gpu = &adreno_gpu->base;
+
+        if (adreno_gpu->memptrs_bo) {
+                if (adreno_gpu->memptrs)
+                        msm_gem_put_vaddr(adreno_gpu->memptrs_bo);
+
+                if (adreno_gpu->memptrs_iova)
+                        msm_gem_put_iova(adreno_gpu->memptrs_bo, gpu->id);
+
+                drm_gem_object_unreference_unlocked(adreno_gpu->memptrs_bo);
+        }
+        release_firmware(adreno_gpu->pm4);
+        release_firmware(adreno_gpu->pfp);
 
-                if (gpu->memptrs_iova)
-                        msm_gem_put_iova(gpu->memptrs_bo, gpu->base.id);
+        msm_gpu_cleanup(gpu);
 
-                drm_gem_object_unreference_unlocked(gpu->memptrs_bo);
+        if (gpu->aspace) {
+                gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu,
+                        iommu_ports, ARRAY_SIZE(iommu_ports));
+                msm_gem_address_space_destroy(gpu->aspace);
         }
-        release_firmware(gpu->pm4);
-        release_firmware(gpu->pfp);
-        msm_gpu_cleanup(&gpu->base);
 }
diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
index 921270ea6059..a879ffa534b4 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
@@ -171,7 +171,7 @@ dsi_mgr_phy_enable(int id,
                         }
                 }
         } else {
-                msm_dsi_host_reset_phy(mdsi->host);
+                msm_dsi_host_reset_phy(msm_dsi->host);
                 ret = enable_phy(msm_dsi, src_pll_id, &shared_timings[id]);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_audio.c b/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
index a54d3bb5baad..8177e8511afd 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
@@ -18,13 +18,6 @@
 #include <linux/hdmi.h>
 #include "hdmi.h"
 
-
-/* Supported HDMI Audio channels */
-#define MSM_HDMI_AUDIO_CHANNEL_2                0
-#define MSM_HDMI_AUDIO_CHANNEL_4                1
-#define MSM_HDMI_AUDIO_CHANNEL_6                2
-#define MSM_HDMI_AUDIO_CHANNEL_8                3
-
 /* maps MSM_HDMI_AUDIO_CHANNEL_n consts used by audio driver to # of channels: */
 static int nchannels[] = { 2, 4, 6, 8 };
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
index 611da7a660c9..238901987e00 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
@@ -18,7 +18,8 @@
 #ifndef __MDP5_PIPE_H__
 #define __MDP5_PIPE_H__
 
-#define SSPP_MAX        (SSPP_RGB3 + 1) /* TODO: Add SSPP_MAX in mdp5.xml.h */
+/* TODO: Add SSPP_MAX in mdp5.xml.h */
+#define SSPP_MAX        (SSPP_CURSOR1 + 1)
 
 /* represents a hw pipe, which is dynamically assigned to a plane */
 struct mdp5_hw_pipe {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 59811f29607d..68e509b3b9e4 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -812,6 +812,12 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev,
 
         size = PAGE_ALIGN(size);
 
+        /* Disallow zero sized objects as they make the underlying
+         * infrastructure grumpy
+         */
+        if (size == 0)
+                return ERR_PTR(-EINVAL);
+
         ret = msm_gem_new_impl(dev, size, flags, NULL, &obj);
         if (ret)
                 goto fail;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 99e05aacbee1..af5b6ba4095b 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -706,9 +706,6 @@ void msm_gpu_cleanup(struct msm_gpu *gpu)
                 msm_ringbuffer_destroy(gpu->rb);
         }
 
-        if (gpu->aspace)
-                msm_gem_address_space_destroy(gpu->aspace);
-
         if (gpu->fctx)
                 msm_fence_context_free(gpu->fctx);
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 0b4440ffbeae..a9182d5e6011 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane,
 {
         struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
         __drm_atomic_helper_plane_destroy_state(&asyw->state);
-        dma_fence_put(asyw->state.fence);
         kfree(asyw);
 }
 
@@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane)
         if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL)))
                 return NULL;
         __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state);
-        asyw->state.fence = NULL;
         asyw->interval = 1;
         asyw->sema = armw->sema;
         asyw->ntfy = armw->ntfy;
@@ -2036,6 +2034,7 @@ nv50_head_atomic_check_mode(struct nv50_head *head, struct nv50_head_atom *asyh)
         u32 vbackp  = (mode->vtotal - mode->vsync_end) * vscan / ilace;
         u32 hfrontp =  mode->hsync_start - mode->hdisplay;
         u32 vfrontp = (mode->vsync_start - mode->vdisplay) * vscan / ilace;
+        u32 blankus;
         struct nv50_head_mode *m = &asyh->mode;
 
         m->h.active = mode->htotal;
@@ -2049,9 +2048,10 @@ nv50_head_atomic_check_mode(struct nv50_head *head, struct nv50_head_atom *asyh)
         m->v.blanks = m->v.active - vfrontp - 1;
 
         /*XXX: Safe underestimate, even "0" works */
-        m->v.blankus = (m->v.active - mode->vdisplay - 2) * m->h.active;
-        m->v.blankus *= 1000;
-        m->v.blankus /= mode->clock;
+        blankus = (m->v.active - mode->vdisplay - 2) * m->h.active;
+        blankus *= 1000;
+        blankus /= mode->clock;
+        m->v.blankus = blankus;
 
         if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
                 m->v.blank2e =  m->v.active + m->v.synce + vbackp;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 273562dd6bbd..3b86a7399567 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -714,7 +714,7 @@ nv4a_chipset = {
         .i2c = nv04_i2c_new,
         .imem = nv40_instmem_new,
         .mc = nv44_mc_new,
-        .mmu = nv44_mmu_new,
+        .mmu = nv04_mmu_new,
         .pci = nv40_pci_new,
         .therm = nv40_therm_new,
         .timer = nv41_timer_new,
@@ -2271,6 +2271,35 @@ nv136_chipset = {
         .fifo = gp100_fifo_new,
 };
 
+static const struct nvkm_device_chip
+nv137_chipset = {
+        .name = "GP107",
+        .bar = gf100_bar_new,
+        .bios = nvkm_bios_new,
+        .bus = gf100_bus_new,
+        .devinit = gm200_devinit_new,
+        .fb = gp102_fb_new,
+        .fuse = gm107_fuse_new,
+        .gpio = gk104_gpio_new,
+        .i2c = gm200_i2c_new,
+        .ibus = gm200_ibus_new,
+        .imem = nv50_instmem_new,
+        .ltc = gp100_ltc_new,
+        .mc = gp100_mc_new,
+        .mmu = gf100_mmu_new,
+        .pci = gp100_pci_new,
+        .pmu = gp102_pmu_new,
+        .timer = gk20a_timer_new,
+        .top = gk104_top_new,
+        .ce[0] = gp102_ce_new,
+        .ce[1] = gp102_ce_new,
+        .ce[2] = gp102_ce_new,
+        .ce[3] = gp102_ce_new,
+        .disp = gp102_disp_new,
+        .dma = gf119_dma_new,
+        .fifo = gp100_fifo_new,
+};
+
 static int
 nvkm_device_event_ctor(struct nvkm_object *object, void *data, u32 size,
                        struct nvkm_notify *notify)
@@ -2708,6 +2737,7 @@ nvkm_device_ctor(const struct nvkm_device_func *func,
                 case 0x132: device->chip = &nv132_chipset; break;
                 case 0x134: device->chip = &nv134_chipset; break;
                 case 0x136: device->chip = &nv136_chipset; break;
+                case 0x137: device->chip = &nv137_chipset; break;
                 default:
                         nvdev_error(device, "unknown chipset (%08x)\n", boot0);
                         goto done;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
index 003ac915eaad..8a8895246d26 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
@@ -198,7 +198,7 @@ nv31_mpeg_intr(struct nvkm_engine *engine)
                 }
 
                 if (type == 0x00000010) {
-                        if (!nv31_mpeg_mthd(mpeg, mthd, data))
+                        if (nv31_mpeg_mthd(mpeg, mthd, data))
                                 show &= ~0x01000000;
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
index e536f37e24b0..c3cf02ed468e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
@@ -172,7 +172,7 @@ nv44_mpeg_intr(struct nvkm_engine *engine)
                 }
 
                 if (type == 0x00000010) {
-                        if (!nv44_mpeg_mthd(subdev->device, mthd, data))
+                        if (nv44_mpeg_mthd(subdev->device, mthd, data))
                                 show &= ~0x01000000;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 684f1703aa5c..aaa3e80fecb4 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
                         rbo->placement.num_busy_placement = 0;
                         for (i = 0; i < rbo->placement.num_placement; i++) {
                                 if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) {
-                                        if (rbo->placements[0].fpfn < fpfn)
-                                                rbo->placements[0].fpfn = fpfn;
+                                        if (rbo->placements[i].fpfn < fpfn)
+                                                rbo->placements[i].fpfn = fpfn;
                                 } else {
                                         rbo->placement.busy_placement =
                                                 &rbo->placements[i];
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 72e1588580a1..c7af9fdd20c7 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2985,9 +2985,13 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                         max_sclk = 75000;
                 }
         } else if (rdev->family == CHIP_OLAND) {
-                if ((rdev->pdev->device == 0x6604) &&
-                    (rdev->pdev->subsystem_vendor == 0x1028) &&
-                    (rdev->pdev->subsystem_device == 0x066F)) {
+                if ((rdev->pdev->revision == 0xC7) ||
+                    (rdev->pdev->revision == 0x80) ||
+                    (rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0x87) ||
+                    (rdev->pdev->device == 0x6604) ||
+                    (rdev->pdev->device == 0x6605)) {
                         max_sclk = 75000;
                 }
         }
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index fdb451e3ec01..26a7ad0f4789 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
         if (unlikely(ret != 0))
                 goto out_err0;
 
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
         if (unlikely(ret != 0))
                 goto out_err1;
 
@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists);
 
 int ttm_ref_object_add(struct ttm_object_file *tfile,
                        struct ttm_base_object *base,
-                       enum ttm_ref_type ref_type, bool *existed)
+                       enum ttm_ref_type ref_type, bool *existed,
+                       bool require_existed)
 {
         struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
         struct ttm_ref_object *ref;
@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
                 }
 
                 rcu_read_unlock();
+                if (require_existed)
+                        return -EPERM;
+
                 ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
                                            false, false);
                 if (unlikely(ret != 0))
@@ -449,10 +453,10 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile)
                 ttm_ref_object_release(&ref->kref);
         }
 
+        spin_unlock(&tfile->lock);
         for (i = 0; i < TTM_REF_NUM; ++i)
                 drm_ht_remove(&tfile->ref_hash[i]);
 
-        spin_unlock(&tfile->lock);
         ttm_object_file_unref(&tfile);
 }
 EXPORT_SYMBOL(ttm_object_file_release);
@@ -529,9 +533,7 @@ void ttm_object_device_release(struct ttm_object_device **p_tdev)
 
         *p_tdev = NULL;
 
-        spin_lock(&tdev->object_lock);
         drm_ht_remove(&tdev->object_hash);
-        spin_unlock(&tdev->object_lock);
 
         kfree(tdev);
 }
@@ -635,7 +637,7 @@ int ttm_prime_fd_to_handle(struct ttm_object_file *tfile,
         prime = (struct ttm_prime_object *) dma_buf->priv;
         base = &prime->base;
         *handle = base->hash.key;
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 
         dma_buf_put(dma_buf);
 
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index 917dcb978c2c..0c87b1ac6b68 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/prefetch.h>
+#include <asm/unaligned.h>
 
 #include <drm/drmP.h>
 #include "udl_drv.h"
@@ -163,7 +164,7 @@ static void udl_compress_hline16(
                         const u8 *const start = pixel;
                         const uint16_t repeating_pixel_val16 = pixel_val16;
 
-                        *(uint16_t *)cmd = cpu_to_be16(pixel_val16);
+                        put_unaligned_be16(pixel_val16, cmd);
 
                         cmd += 2;
                         pixel += bpp;
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 0c06844af445..9fcf05ca492b 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -846,6 +846,17 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc,
         drm_atomic_helper_crtc_destroy_state(crtc, state);
 }
 
+static void
+vc4_crtc_reset(struct drm_crtc *crtc)
+{
+        if (crtc->state)
+                __drm_atomic_helper_crtc_destroy_state(crtc->state);
+
+        crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
+        if (crtc->state)
+                crtc->state->crtc = crtc;
+}
+
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_config = drm_atomic_helper_set_config,
         .destroy = vc4_crtc_destroy,
@@ -853,7 +864,7 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_property = NULL,
         .cursor_set = NULL, /* handled by drm_mode_cursor_universal */
         .cursor_move = NULL, /* handled by drm_mode_cursor_universal */
-        .reset = drm_atomic_helper_crtc_reset,
+        .reset = vc4_crtc_reset,
         .atomic_duplicate_state = vc4_crtc_duplicate_state,
         .atomic_destroy_state = vc4_crtc_destroy_state,
         .gamma_set = vc4_crtc_gamma_set,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 6541dd8b82dc..6b2708b4eafe 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -538,7 +538,7 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
                      struct vmw_fence_obj **p_fence)
 {
         struct vmw_fence_obj *fence;
-        int ret;
+        int ret;
 
         fence = kzalloc(sizeof(*fence), GFP_KERNEL);
         if (unlikely(fence == NULL))
@@ -701,6 +701,41 @@ void vmw_fence_fifo_up(struct vmw_fence_manager *fman)
 }
 
 
+/**
+ * vmw_fence_obj_lookup - Look up a user-space fence object
+ *
+ * @tfile: A struct ttm_object_file identifying the caller.
+ * @handle: A handle identifying the fence object.
+ * @return: A struct vmw_user_fence base ttm object on success or
+ * an error pointer on failure.
+ *
+ * The fence object is looked up and type-checked. The caller needs
+ * to have opened the fence object first, but since that happens on
+ * creation and fence objects aren't shareable, that's not an
+ * issue currently.
+ */
+static struct ttm_base_object *
+vmw_fence_obj_lookup(struct ttm_object_file *tfile, u32 handle)
+{
+        struct ttm_base_object *base = ttm_base_object_lookup(tfile, handle);
+
+        if (!base) {
+                pr_err("Invalid fence object handle 0x%08lx.\n",
+                       (unsigned long)handle);
+                return ERR_PTR(-EINVAL);
+        }
+
+        if (base->refcount_release != vmw_user_fence_base_release) {
+                pr_err("Invalid fence object handle 0x%08lx.\n",
+                       (unsigned long)handle);
+                ttm_base_object_unref(&base);
+                return ERR_PTR(-EINVAL);
+        }
+
+        return base;
+}
+
+
 int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
                              struct drm_file *file_priv)
 {
@@ -726,13 +761,9 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
                 arg->kernel_cookie = jiffies + wait_timeout;
         }
 
-        base = ttm_base_object_lookup(tfile, arg->handle);
-        if (unlikely(base == NULL)) {
-                printk(KERN_ERR "Wait invalid fence object handle "
-                       "0x%08lx.\n",
-                       (unsigned long)arg->handle);
-                return -EINVAL;
-        }
+        base = vmw_fence_obj_lookup(tfile, arg->handle);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
 
         fence = &(container_of(base, struct vmw_user_fence, base)->fence);
 
@@ -771,13 +802,9 @@ int vmw_fence_obj_signaled_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         struct vmw_private *dev_priv = vmw_priv(dev);
 
-        base = ttm_base_object_lookup(tfile, arg->handle);
-        if (unlikely(base == NULL)) {
-                printk(KERN_ERR "Fence signaled invalid fence object handle "
-                       "0x%08lx.\n",
-                       (unsigned long)arg->handle);
-                return -EINVAL;
-        }
+        base = vmw_fence_obj_lookup(tfile, arg->handle);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
 
         fence = &(container_of(base, struct vmw_user_fence, base)->fence);
         fman = fman_from_fence(fence);
@@ -1024,6 +1051,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
                 (struct drm_vmw_fence_event_arg *) data;
         struct vmw_fence_obj *fence = NULL;
         struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
+        struct ttm_object_file *tfile = vmw_fp->tfile;
         struct drm_vmw_fence_rep __user *user_fence_rep =
                 (struct drm_vmw_fence_rep __user *)(unsigned long)
                 arg->fence_rep;
@@ -1037,24 +1065,18 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
          */
         if (arg->handle) {
                 struct ttm_base_object *base =
-                        ttm_base_object_lookup_for_ref(dev_priv->tdev,
-                                                       arg->handle);
-
-                if (unlikely(base == NULL)) {
-                        DRM_ERROR("Fence event invalid fence object handle "
-                                  "0x%08lx.\n",
-                                  (unsigned long)arg->handle);
-                        return -EINVAL;
-                }
+                        vmw_fence_obj_lookup(tfile, arg->handle);
+
+                if (IS_ERR(base))
+                        return PTR_ERR(base);
+
                 fence = &(container_of(base, struct vmw_user_fence,
                                        base)->fence);
                 (void) vmw_fence_obj_reference(fence);
 
                 if (user_fence_rep != NULL) {
-                        bool existed;
-
                         ret = ttm_ref_object_add(vmw_fp->tfile, base,
-                                                 TTM_REF_USAGE, &existed);
+                                                 TTM_REF_USAGE, NULL, false);
                         if (unlikely(ret != 0)) {
                                 DRM_ERROR("Failed to reference a fence "
                                           "object.\n");
@@ -1097,8 +1119,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
         return 0;
 out_no_create:
         if (user_fence_rep != NULL)
-                ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
-                                          handle, TTM_REF_USAGE);
+                ttm_ref_object_base_unref(tfile, handle, TTM_REF_USAGE);
 out_no_ref_obj:
         vmw_fence_obj_unreference(&fence);
         return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index b8c6a03c8c54..5ec24fd801cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -114,8 +114,6 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                 param->value = dev_priv->has_dx;
                 break;
         default:
-                DRM_ERROR("Illegal vmwgfx get param request: %d\n",
-                          param->param);
                 return -EINVAL;
         }
 
@@ -186,7 +184,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
         bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
         struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
 
-        if (unlikely(arg->pad64 != 0)) {
+        if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
                 DRM_ERROR("Illegal GET_3D_CAP argument.\n");
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 65b3f0369636..bf23153d4f55 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -589,7 +589,7 @@ static int vmw_user_dmabuf_synccpu_grab(struct vmw_user_dma_buffer *user_bo,
                 return ret;
 
         ret = ttm_ref_object_add(tfile, &user_bo->prime.base,
-                                 TTM_REF_SYNCCPU_WRITE, &existed);
+                                 TTM_REF_SYNCCPU_WRITE, &existed, false);
         if (ret != 0 || existed)
                 ttm_bo_synccpu_write_release(&user_bo->dma.base);
 
@@ -773,7 +773,7 @@ int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
 
         *handle = user_bo->prime.base.hash.key;
         return ttm_ref_object_add(tfile, &user_bo->prime.base,
-                                  TTM_REF_USAGE, NULL);
+                                  TTM_REF_USAGE, NULL, false);
 }
 
 /*
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b445ce9b9757..05fa092c942b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -713,11 +713,14 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
                         128;
 
         num_sizes = 0;
-        for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+        for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
+                if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
+                        return -EINVAL;
                 num_sizes += req->mip_levels[i];
+        }
 
-        if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
-            DRM_VMW_MAX_MIP_LEVELS)
+        if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
+            num_sizes == 0)
                 return -EINVAL;
 
         size = vmw_user_surface_size + 128 +
@@ -891,17 +894,16 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
         uint32_t handle;
         struct ttm_base_object *base;
         int ret;
+        bool require_exist = false;
 
         if (handle_type == DRM_VMW_HANDLE_PRIME) {
                 ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
                 if (unlikely(ret != 0))
                         return ret;
         } else {
-                if (unlikely(drm_is_render_client(file_priv))) {
-                        DRM_ERROR("Render client refused legacy "
-                                  "surface reference.\n");
-                        return -EACCES;
-                }
+                if (unlikely(drm_is_render_client(file_priv)))
+                        require_exist = true;
+
                 if (ACCESS_ONCE(vmw_fpriv(file_priv)->locked_master)) {
                         DRM_ERROR("Locked master refused legacy "
                                   "surface reference.\n");
@@ -929,17 +931,14 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
 
                 /*
                  * Make sure the surface creator has the same
-                 * authenticating master.
+                 * authenticating master, or is already registered with us.
                  */
                 if (drm_is_primary_client(file_priv) &&
-                    user_srf->master != file_priv->master) {
-                        DRM_ERROR("Trying to reference surface outside of"
-                                  " master domain.\n");
-                        ret = -EACCES;
-                        goto out_bad_resource;
-                }
+                    user_srf->master != file_priv->master)
+                        require_exist = true;
 
-                ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+                ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL,
+                                         require_exist);
                 if (unlikely(ret != 0)) {
                         DRM_ERROR("Could not add a reference to a surface.\n");
                         goto out_bad_resource;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 1aeb80e52424..8c54cb8f5d6d 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -175,11 +175,11 @@ config HID_CHERRY
         Support for Cherry Cymotion keyboard.
 
 config HID_CHICONY
-        tristate "Chicony Tactical pad"
+        tristate "Chicony devices"
         depends on HID
         default !EXPERT
         ---help---
-        Support for Chicony Tactical pad.
+        Support for Chicony Tactical pad and special keys on Chicony keyboards.
 
 config HID_CORSAIR
         tristate "Corsair devices"
@@ -190,6 +190,7 @@ config HID_CORSAIR
 
         Supported devices:
         - Vengeance K90
+        - Scimitar PRO RGB
 
 config HID_PRODIKEYS
         tristate "Prodikeys PC-MIDI Keyboard support"
diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
index bc3cec199fee..f04ed9aabc3f 100644
--- a/drivers/hid/hid-chicony.c
+++ b/drivers/hid/hid-chicony.c
@@ -86,6 +86,7 @@ static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index e9e87d337446..d162f0dc76e3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -819,8 +819,7 @@ static int hid_scan_report(struct hid_device *hid)
                 hid->group = HID_GROUP_WACOM;
                 break;
         case USB_VENDOR_ID_SYNAPTICS:
-                if (hid->group == HID_GROUP_GENERIC ||
-                    hid->group == HID_GROUP_MULTITOUCH_WIN_8)
+                if (hid->group == HID_GROUP_GENERIC)
                         if ((parser->scan_flags & HID_SCAN_FLAG_VENDOR_SPECIFIC)
                             && (parser->scan_flags & HID_SCAN_FLAG_GD_POINTER))
                                 /*
@@ -1870,6 +1869,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
@@ -1910,6 +1910,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
@@ -2094,6 +2095,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
@@ -2110,6 +2112,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
index c0303f61c26a..9ba5d98a1180 100644
--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -3,8 +3,10 @@
  *
  * Supported devices:
  *  - Vengeance K90 Keyboard
+ *  - Scimitar PRO RGB Gaming Mouse
  *
  * Copyright (c) 2015 Clement Vuchener
+ * Copyright (c) 2017 Oscar Campos
  */
 
 /*
@@ -670,10 +672,51 @@ static int corsair_input_mapping(struct hid_device *dev,
         return 0;
 }
 
+/*
+ * The report descriptor of Corsair Scimitar RGB Pro gaming mouse is
+ * non parseable as they define two consecutive Logical Minimum for
+ * the Usage Page (Consumer) in rdescs bytes 75 and 77 being 77 0x16
+ * that should be obviousy 0x26 for Logical Magimum of 16 bits. This
+ * prevents poper parsing of the report descriptor due Logical
+ * Minimum being larger than Logical Maximum.
+ *
+ * This driver fixes the report descriptor for:
+ * - USB ID b1c:1b3e, sold as Scimitar RGB Pro Gaming mouse
+ */
+
+static __u8 *corsair_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+        unsigned int *rsize)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+
+        if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+                /*
+                 * Corsair Scimitar RGB Pro report descriptor is broken and
+                 * defines two different Logical Minimum for the Consumer
+                 * Application. The byte 77 should be a 0x26 defining a 16
+                 * bits integer for the Logical Maximum but it is a 0x16
+                 * instead (Logical Minimum)
+                 */
+                switch (hdev->product) {
+                case USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB:
+                        if (*rsize >= 172 && rdesc[75] == 0x15 && rdesc[77] == 0x16
+                        && rdesc[78] == 0xff && rdesc[79] == 0x0f) {
+                                hid_info(hdev, "Fixing up report descriptor\n");
+                                rdesc[77] = 0x26;
+                        }
+                        break;
+                }
+
+        }
+        return rdesc;
+}
+
 static const struct hid_device_id corsair_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90),
                 .driver_data = CORSAIR_USE_K90_MACRO |
                                CORSAIR_USE_K90_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR,
+            USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         {}
 };
 
@@ -686,10 +729,14 @@ static struct hid_driver corsair_driver = {
         .event = corsair_event,
         .remove = corsair_remove,
         .input_mapping = corsair_input_mapping,
+        .report_fixup = corsair_mouse_report_fixup,
 };
 
 module_hid_driver(corsair_driver);
 
 MODULE_LICENSE("GPL");
+/* Original K90 driver author */
 MODULE_AUTHOR("Clement Vuchener");
+/* Scimitar PRO RGB driver author */
+MODULE_AUTHOR("Oscar Campos");
 MODULE_DESCRIPTION("HID driver for Corsair devices");
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 86c95d30ac80..b26c030926c1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -278,6 +278,9 @@
 #define USB_DEVICE_ID_CORSAIR_K70RGB    0x1b13
 #define USB_DEVICE_ID_CORSAIR_STRAFE    0x1b15
 #define USB_DEVICE_ID_CORSAIR_K65RGB    0x1b17
+#define USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE  0x1b38
+#define USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE  0x1b39
+#define USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB  0x1b3e
 
 #define USB_VENDOR_ID_CREATIVELABS      0x041e
 #define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51      0x322c
@@ -557,6 +560,7 @@
 
 #define USB_VENDOR_ID_JESS              0x0c45
 #define USB_DEVICE_ID_JESS_YUREX        0x1010
+#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD  0x5112
 
 #define USB_VENDOR_ID_JESS2             0x0f30
 #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111
@@ -1024,6 +1028,9 @@
 #define USB_DEVICE_ID_UGEE_TABLET_45            0x0045
 #define USB_DEVICE_ID_YIYNOVA_TABLET            0x004d
 
+#define USB_VENDOR_ID_UGEE              0x28bd
+#define USB_DEVICE_ID_UGEE_TABLET_EX07S         0x0071
+
 #define USB_VENDOR_ID_UNITEC    0x227d
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0709     0x0709
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19     0x0a19
@@ -1078,6 +1085,7 @@
 
 #define USB_VENDOR_ID_XIN_MO                    0x16c0
 #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE        0x05e1
+#define USB_DEVICE_ID_THT_2P_ARCADE             0x75e1
 
 #define USB_VENDOR_ID_XIROKU            0x1477
 #define USB_DEVICE_ID_XIROKU_SPX        0x1006
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index f405b07d0381..740996f9bdd4 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2632,6 +2632,8 @@ err_stop:
                 sony_leds_remove(sc);
         if (sc->quirks & SONY_BATTERY_SUPPORT)
                 sony_battery_remove(sc);
+        if (sc->touchpad)
+                sony_unregister_touchpad(sc);
         sony_cancel_work_sync(sc);
         kfree(sc->output_report_dmabuf);
         sony_remove_dev_list(sc);
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 1509d7287ff3..e3e6e5c893cc 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -977,6 +977,7 @@ static int uclogic_probe(struct hid_device *hdev,
                 }
                 break;
         case USB_DEVICE_ID_UGTIZER_TABLET_GP0610:
+        case USB_DEVICE_ID_UGEE_TABLET_EX07S:
                 /* If this is the pen interface */
                 if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
                         rc = uclogic_tablet_enable(hdev);
@@ -1069,6 +1070,7 @@ static const struct hid_device_id uclogic_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, uclogic_devices);
diff --git a/drivers/hid/hid-xinmo.c b/drivers/hid/hid-xinmo.c
index 7df5227a7e61..9ad7731d2e10 100644
--- a/drivers/hid/hid-xinmo.c
+++ b/drivers/hid/hid-xinmo.c
@@ -46,6 +46,7 @@ static int xinmo_event(struct hid_device *hdev, struct hid_field *field,
 
 static const struct hid_device_id xinmo_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { }
 };
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index d6847a664446..a69a3c88ab29 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -80,6 +80,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index be8f7e2a026f..e2666ef84dc1 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2165,6 +2165,14 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 
         wacom_update_name(wacom, wireless ? " (WL)" : "");
 
+        /* pen only Bamboo neither support touch nor pad */
+        if ((features->type == BAMBOO_PEN) &&
+            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
+            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                error = -ENODEV;
+                goto fail;
+        }
+
         error = wacom_add_shared_data(hdev);
         if (error)
                 goto fail;
@@ -2208,14 +2216,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
         /* touch only Bamboo doesn't support pen */
         if ((features->type == BAMBOO_TOUCH) &&
             (features->device_type & WACOM_DEVICETYPE_PEN)) {
-                error = -ENODEV;
-                goto fail_quirks;
-        }
-
-        /* pen only Bamboo neither support touch nor pad */
-        if ((features->type == BAMBOO_PEN) &&
-            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
-            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                cancel_delayed_work_sync(&wacom->init_work);
+                _wacom_query_tablet_data(wacom);
                 error = -ENODEV;
                 goto fail_quirks;
         }
@@ -2579,7 +2581,9 @@ static void wacom_remove(struct hid_device *hdev)
 
         /* make sure we don't trigger the LEDs */
         wacom_led_groups_release(wacom);
-        wacom_release_resources(wacom);
+
+        if (wacom->wacom_wac.features.type != REMOTE)
+                wacom_release_resources(wacom);
 
         hid_set_drvdata(hdev, NULL);
 }
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4aa3de9f1163..c68ac65db7ff 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1959,8 +1959,10 @@ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
                 input_set_capability(input, EV_KEY, BTN_TOOL_BRUSH);
                 input_set_capability(input, EV_KEY, BTN_TOOL_PENCIL);
                 input_set_capability(input, EV_KEY, BTN_TOOL_AIRBRUSH);
-                input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
-                input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                if (!(features->device_type & WACOM_DEVICETYPE_DIRECT)) {
+                        input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
+                        input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                }
                 break;
         case WACOM_HID_WD_FINGERWHEEL:
                 wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
@@ -2004,7 +2006,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 return;
         case HID_DG_TOOLSERIALNUMBER:
                 wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= value;
+                wacom_wac->serial[0] |= (__u32)value;
                 return;
         case WACOM_HID_WD_SENSE:
                 wacom_wac->hid_data.sense_state = value;
@@ -2174,6 +2176,16 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
                 wacom_wac->hid_data.cc_index = field->index;
                 wacom_wac->hid_data.cc_value_index = usage->usage_index;
                 break;
+        case HID_DG_CONTACTID:
+                if ((field->logical_maximum - field->logical_minimum) < touch_max) {
+                        /*
+                         * The HID descriptor for G11 sensors leaves logical
+                         * maximum set to '1' despite it being a multitouch
+                         * device. Override to a sensible number.
+                         */
+                        field->logical_maximum = 255;
+                }
+                break;
         }
 }
 
@@ -4197,10 +4209,10 @@ static const struct wacom_features wacom_features_0x343 =
           WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x360 =
         { "Wacom Intuos Pro M", 44800, 29600, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 static const struct wacom_features wacom_features_0x361 =
         { "Wacom Intuos Pro L", 62200, 43200, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 
 static const struct wacom_features wacom_features_HID_ANY_ID =
         { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index bd0d1988feb2..321b8833fa6f 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -502,12 +502,15 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
 
         wait_for_completion(&info->waitevent);
 
-        if (channel->rescind) {
-                ret = -ENODEV;
-                goto post_msg_err;
-        }
-
 post_msg_err:
+        /*
+         * If the channel has been rescinded;
+         * we will be awakened by the rescind
+         * handler; set the error code to zero so we don't leak memory.
+         */
+        if (channel->rescind)
+                ret = 0;
+
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
@@ -530,15 +533,13 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
         int ret;
 
         /*
-         * vmbus_on_event(), running in the tasklet, can race
+         * vmbus_on_event(), running in the per-channel tasklet, can race
          * with vmbus_close_internal() in the case of SMP guest, e.g., when
          * the former is accessing channel->inbound.ring_buffer, the latter
-         * could be freeing the ring_buffer pages.
-         *
-         * To resolve the race, we can serialize them by disabling the
-         * tasklet when the latter is running here.
+         * could be freeing the ring_buffer pages, so here we must stop it
+         * first.
          */
-        hv_event_tasklet_disable(channel);
+        tasklet_disable(&channel->callback_event);
 
         /*
          * In case a device driver's probe() fails (e.g.,
@@ -605,8 +606,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                 get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
 
 out:
-        hv_event_tasklet_enable(channel);
-
         return ret;
 }
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index f33465d78a02..fbcb06352308 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -350,7 +350,8 @@ static struct vmbus_channel *alloc_channel(void)
 static void free_channel(struct vmbus_channel *channel)
 {
         tasklet_kill(&channel->callback_event);
-        kfree(channel);
+
+        kfree_rcu(channel, rcu);
 }
 
 static void percpu_channel_enq(void *arg)
@@ -359,14 +360,14 @@ static void percpu_channel_enq(void *arg)
         struct hv_per_cpu_context *hv_cpu
                 = this_cpu_ptr(hv_context.cpu_context);
 
-        list_add_tail(&channel->percpu_list, &hv_cpu->chan_list);
+        list_add_tail_rcu(&channel->percpu_list, &hv_cpu->chan_list);
 }
 
 static void percpu_channel_deq(void *arg)
 {
         struct vmbus_channel *channel = arg;
 
-        list_del(&channel->percpu_list);
+        list_del_rcu(&channel->percpu_list);
 }
 
 
@@ -381,19 +382,6 @@ static void vmbus_release_relid(u32 relid)
                        true);
 }
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel)
-{
-        tasklet_disable(&channel->callback_event);
-}
-
-void hv_event_tasklet_enable(struct vmbus_channel *channel)
-{
-        tasklet_enable(&channel->callback_event);
-
-        /* In case there is any pending event */
-        tasklet_schedule(&channel->callback_event);
-}
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
 {
         unsigned long flags;
@@ -402,7 +390,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
         BUG_ON(!channel->rescind);
         BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
 
-        hv_event_tasklet_disable(channel);
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(channel->target_cpu,
@@ -411,7 +398,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
                 percpu_channel_deq(channel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(channel);
 
         if (channel->primary_channel == NULL) {
                 list_del(&channel->listentry);
@@ -505,7 +491,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
 
         init_vp_index(newchannel, dev_type);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -515,7 +500,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
                 percpu_channel_enq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         /*
          * This state is used to indicate a successful open
@@ -565,7 +549,6 @@ err_deq_chan:
         list_del(&newchannel->listentry);
         mutex_unlock(&vmbus_connection.channel_mutex);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -574,7 +557,6 @@ err_deq_chan:
                 percpu_channel_deq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         vmbus_release_relid(newchannel->offermsg.child_relid);
 
@@ -814,6 +796,7 @@ static void vmbus_onoffer(struct vmbus_channel_message_header *hdr)
         /* Allocate the channel object and save this offer. */
         newchannel = alloc_channel();
         if (!newchannel) {
+                vmbus_release_relid(offer->child_relid);
                 pr_err("Unable to allocate channel object\n");
                 return;
         }
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index 9aee6014339d..a5596a642ed0 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -71,7 +71,6 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data);
 static const char fcopy_devname[] = "vmbus/hv_fcopy";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * This state maintains the version number registered by the daemon.
  */
@@ -331,7 +330,6 @@ static void fcopy_on_reset(void)
 
         if (cancel_delayed_work_sync(&fcopy_timeout_work))
                 fcopy_respond_to_host(HV_E_FAIL);
-        complete(&release_event);
 }
 
 int hv_fcopy_init(struct hv_util_service *srv)
@@ -339,7 +337,6 @@ int hv_fcopy_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         fcopy_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -361,5 +358,4 @@ void hv_fcopy_deinit(void)
         fcopy_transaction.state = HVUTIL_DEVICE_DYING;
         cancel_delayed_work_sync(&fcopy_timeout_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index de263712e247..a1adfe2cfb34 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -101,7 +101,6 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key);
 static const char kvp_devname[] = "vmbus/hv_kvp";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * Register the kernel component with the user-level daemon.
  * As part of this registration, pass the LIC version number.
@@ -714,7 +713,6 @@ static void kvp_on_reset(void)
         if (cancel_delayed_work_sync(&kvp_timeout_work))
                 kvp_respond_to_host(NULL, HV_E_FAIL);
         kvp_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
@@ -723,7 +721,6 @@ hv_kvp_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         kvp_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -747,5 +744,4 @@ void hv_kvp_deinit(void)
         cancel_delayed_work_sync(&kvp_timeout_work);
         cancel_work_sync(&kvp_sendkey_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index bcc03f0748d6..e659d1b94a57 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -79,7 +79,6 @@ static int dm_reg_value;
 static const char vss_devname[] = "vmbus/hv_vss";
 static __u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 
 static void vss_timeout_func(struct work_struct *dummy);
 static void vss_handle_request(struct work_struct *dummy);
@@ -361,13 +360,11 @@ static void vss_on_reset(void)
         if (cancel_delayed_work_sync(&vss_timeout_work))
                 vss_respond_to_host(HV_E_FAIL);
         vss_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
 hv_vss_init(struct hv_util_service *srv)
 {
-        init_completion(&release_event);
         if (vmbus_proto_version < VERSION_WIN8_1) {
                 pr_warn("Integration service 'Backup (volume snapshot)'"
                         " not supported on this host version.\n");
@@ -400,5 +397,4 @@ void hv_vss_deinit(void)
         cancel_delayed_work_sync(&vss_timeout_work);
         cancel_work_sync(&vss_handle_request_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 3042eaa13062..186b10083c55 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -590,6 +590,8 @@ static int hv_timesync_init(struct hv_util_service *srv)
         if (!hyperv_cs)
                 return -ENODEV;
 
+        spin_lock_init(&host_ts.lock);
+
         INIT_WORK(&wrk.work, hv_set_host_time);
 
         /*
diff --git a/drivers/hv/hv_utils_transport.c b/drivers/hv/hv_utils_transport.c
index c235a9515267..4402a71e23f7 100644
--- a/drivers/hv/hv_utils_transport.c
+++ b/drivers/hv/hv_utils_transport.c
@@ -182,10 +182,11 @@ static int hvt_op_release(struct inode *inode, struct file *file)
          * connects back.
          */
         hvt_reset(hvt);
-        mutex_unlock(&hvt->lock);
 
         if (mode_old == HVUTIL_TRANSPORT_DESTROY)
-                hvt_transport_free(hvt);
+                complete(&hvt->release);
+
+        mutex_unlock(&hvt->lock);
 
         return 0;
 }
@@ -304,6 +305,7 @@ struct hvutil_transport *hvutil_transport_init(const char *name,
 
         init_waitqueue_head(&hvt->outmsg_q);
         mutex_init(&hvt->lock);
+        init_completion(&hvt->release);
 
         spin_lock(&hvt_list_lock);
         list_add(&hvt->list, &hvt_list);
@@ -351,6 +353,8 @@ void hvutil_transport_destroy(struct hvutil_transport *hvt)
         if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0)
                 cn_del_callback(&hvt->cn_id);
 
-        if (mode_old != HVUTIL_TRANSPORT_CHARDEV)
-                hvt_transport_free(hvt);
+        if (mode_old == HVUTIL_TRANSPORT_CHARDEV)
+                wait_for_completion(&hvt->release);
+
+        hvt_transport_free(hvt);
 }
diff --git a/drivers/hv/hv_utils_transport.h b/drivers/hv/hv_utils_transport.h
index d98f5225c3e6..79afb626e166 100644
--- a/drivers/hv/hv_utils_transport.h
+++ b/drivers/hv/hv_utils_transport.h
@@ -41,6 +41,7 @@ struct hvutil_transport {
         int outmsg_len;                     /* its length */
         wait_queue_head_t outmsg_q;         /* poll/read wait queue */
         struct mutex lock;                  /* protects struct members */
+        struct completion release;          /* synchronize with fd release */
 };
 
 struct hvutil_transport *hvutil_transport_init(const char *name,
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index da6b59ba5940..8370b9dc6037 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -939,8 +939,10 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                 if (relid == 0)
                         continue;
 
+                rcu_read_lock();
+
                 /* Find channel based on relid */
-                list_for_each_entry(channel, &hv_cpu->chan_list, percpu_list) {
+                list_for_each_entry_rcu(channel, &hv_cpu->chan_list, percpu_list) {
                         if (channel->offermsg.child_relid != relid)
                                 continue;
 
@@ -956,6 +958,8 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                                 tasklet_schedule(&channel->callback_event);
                         }
                 }
+
+                rcu_read_unlock();
         }
 }
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index cccef87963e0..975c43d446f8 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -646,6 +646,9 @@ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value)
                 else
                         err = atk_read_value_new(sensor, value);
 
+                if (err)
+                        return err;
+
                 sensor->is_valid = true;
                 sensor->last_updated = jiffies;
                 sensor->cached_value = *value;
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index efb01c247e2d..4dfc7238313e 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -3198,7 +3198,7 @@ static int __init sm_it87_init(void)
 {
         int sioaddr[2] = { REG_2E, REG_4E };
         struct it87_sio_data sio_data;
-        unsigned short isa_address;
+        unsigned short isa_address[2];
         bool found = false;
         int i, err;
 
@@ -3208,15 +3208,29 @@ static int __init sm_it87_init(void)
 
         for (i = 0; i < ARRAY_SIZE(sioaddr); i++) {
                 memset(&sio_data, 0, sizeof(struct it87_sio_data));
-                isa_address = 0;
-                err = it87_find(sioaddr[i], &isa_address, &sio_data);
-                if (err || isa_address == 0)
+                isa_address[i] = 0;
+                err = it87_find(sioaddr[i], &isa_address[i], &sio_data);
+                if (err || isa_address[i] == 0)
                         continue;
+                /*
+                 * Don't register second chip if its ISA address matches
+                 * the first chip's ISA address.
+                 */
+                if (i && isa_address[i] == isa_address[0])
+                        break;
 
-                err = it87_device_add(i, isa_address, &sio_data);
+                err = it87_device_add(i, isa_address[i], &sio_data);
                 if (err)
                         goto exit_dev_unregister;
+
                 found = true;
+
+                /*
+                 * IT8705F may respond on both SIO addresses.
+                 * Stop probing after finding one.
+                 */
+                if (sio_data.type == it87)
+                        break;
         }
 
         if (!found) {
diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c
index c1b9275978f9..281491cca510 100644
--- a/drivers/hwmon/max31790.c
+++ b/drivers/hwmon/max31790.c
@@ -311,7 +311,7 @@ static int max31790_write_pwm(struct device *dev, u32 attr, int channel,
                 data->pwm[channel] = val << 8;
                 err = i2c_smbus_write_word_swapped(client,
                                                    MAX31790_REG_PWMOUT(channel),
-                                                   val);
+                                                   data->pwm[channel]);
                 break;
         case hwmon_pwm_enable:
                 fan_config = data->fan_config[channel];
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index cdd9b3b26195..7563eceeaaea 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -221,8 +221,10 @@ static int intel_th_output_activate(struct intel_th_device *thdev)
         else
                 intel_th_trace_enable(thdev);
 
-        if (ret)
+        if (ret) {
                 pm_runtime_put(&thdev->dev);
+                module_put(thdrv->driver.owner);
+        }
 
         return ret;
 }
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 0bba3842336e..590cf90dd21a 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -85,6 +85,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa2a6),
                 .driver_data = (kernel_ulong_t)0,
         },
+        {
+                /* Denverton */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x19e1),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
+                /* Gemini Lake */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
+                .driver_data = (kernel_ulong_t)0,
+        },
         { 0 },
 };
 
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index dfc1c0e37c40..ad31d21da316 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -35,7 +35,6 @@
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/gpio/consumer.h>
 #include <linux/i2c.h>
@@ -117,6 +116,10 @@ static const struct chip_desc chips[] = {
                 .has_irq = 1,
                 .muxtype = pca954x_isswi,
         },
+        [pca_9546] = {
+                .nchans = 4,
+                .muxtype = pca954x_isswi,
+        },
         [pca_9547] = {
                 .nchans = 8,
                 .enable = 0x8,
@@ -134,28 +137,13 @@ static const struct i2c_device_id pca954x_id[] = {
         { "pca9543", pca_9543 },
         { "pca9544", pca_9544 },
         { "pca9545", pca_9545 },
-        { "pca9546", pca_9545 },
+        { "pca9546", pca_9546 },
         { "pca9547", pca_9547 },
         { "pca9548", pca_9548 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, pca954x_id);
 
-#ifdef CONFIG_ACPI
-static const struct acpi_device_id pca954x_acpi_ids[] = {
-        { .id = "PCA9540", .driver_data = pca_9540 },
-        { .id = "PCA9542", .driver_data = pca_9542 },
-        { .id = "PCA9543", .driver_data = pca_9543 },
-        { .id = "PCA9544", .driver_data = pca_9544 },
-        { .id = "PCA9545", .driver_data = pca_9545 },
-        { .id = "PCA9546", .driver_data = pca_9545 },
-        { .id = "PCA9547", .driver_data = pca_9547 },
-        { .id = "PCA9548", .driver_data = pca_9548 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, pca954x_acpi_ids);
-#endif
-
 #ifdef CONFIG_OF
 static const struct of_device_id pca954x_of_match[] = {
         { .compatible = "nxp,pca9540", .data = &chips[pca_9540] },
@@ -393,17 +381,8 @@ static int pca954x_probe(struct i2c_client *client,
         match = of_match_device(of_match_ptr(pca954x_of_match), &client->dev);
         if (match)
                 data->chip = of_device_get_match_data(&client->dev);
-        else if (id)
+        else
                 data->chip = &chips[id->driver_data];
-        else {
-                const struct acpi_device_id *acpi_id;
-
-                acpi_id = acpi_match_device(ACPI_PTR(pca954x_acpi_ids),
-                                                &client->dev);
-                if (!acpi_id)
-                        return -ENODEV;
-                data->chip = &chips[acpi_id->driver_data];
-        }
 
         data->last_chan = 0;               /* force the first selection */
 
@@ -492,7 +471,6 @@ static struct i2c_driver pca954x_driver = {
                 .name   = "pca954x",
                 .pm     = &pca954x_pm,
                 .of_match_table = of_match_ptr(pca954x_of_match),
-                .acpi_match_table = ACPI_PTR(pca954x_acpi_ids),
         },
         .probe          = pca954x_probe,
         .remove         = pca954x_remove,
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index ca5759c0c318..43a6cb078193 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -370,10 +370,12 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
                 name = "accel_3d";
                 channel_spec = accel_3d_channels;
                 channel_size = sizeof(accel_3d_channels);
+                indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels);
         } else {
                 name = "gravity";
                 channel_spec = gravity_channels;
                 channel_size = sizeof(gravity_channels);
+                indio_dev->num_channels = ARRAY_SIZE(gravity_channels);
         }
         ret = hid_sensor_parse_common_attributes(hsdev, hsdev->usage,
                                         &accel_state->common_attributes);
@@ -395,7 +397,6 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
                 goto error_free_dev_mem;
         }
 
-        indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels);
         indio_dev->dev.parent = &pdev->dev;
         indio_dev->info = &accel_3d_info;
         indio_dev->name = name;
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index ad9dec30bb30..4282ceca3d8f 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -169,7 +169,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
 {
         struct iio_dev *indio_dev = private;
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        unsigned int status, config;
+        unsigned int status, config, adc_fsm;
+        unsigned short count = 0;
+
         status = tiadc_readl(adc_dev, REG_IRQSTATUS);
 
         /*
@@ -183,6 +185,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
                 tiadc_writel(adc_dev, REG_CTRL, config);
                 tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN
                                 | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES);
+
+                /* wait for idle state.
+                 * ADC needs to finish the current conversion
+                 * before disabling the module
+                 */
+                do {
+                        adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM);
+                } while (adc_fsm != 0x10 && count++ < 100);
+
                 tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB));
                 return IRQ_HANDLED;
         } else if (status & IRQENB_FIFO1THRES) {
diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
index d6c372bb433b..c17596f7ed2c 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
@@ -61,7 +61,7 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
                 ret = st->core.read_ec_sensors_data(indio_dev, 1 << idx, &data);
                 if (ret < 0)
                         break;
-
+                ret = IIO_VAL_INT;
                 *val = data;
                 break;
         case IIO_CHAN_INFO_CALIBBIAS:
@@ -76,7 +76,7 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
                 for (i = CROS_EC_SENSOR_X; i < CROS_EC_SENSOR_MAX_AXIS; i++)
                         st->core.calib[i] =
                                 st->core.resp->sensor_offset.offset[i];
-
+                ret = IIO_VAL_INT;
                 *val = st->core.calib[idx];
                 break;
         case IIO_CHAN_INFO_SCALE:
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index 7afdac42ed42..01e02b9926d4 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -379,6 +379,8 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
 {
 
         struct hid_sensor_hub_attribute_info timestamp;
+        s32 value;
+        int ret;
 
         hid_sensor_get_reporting_interval(hsdev, usage_id, st);
 
@@ -417,6 +419,14 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
                 st->sensitivity.index, st->sensitivity.report_id,
                 timestamp.index, timestamp.report_id);
 
+        ret = sensor_hub_get_feature(hsdev,
+                                st->power_state.report_id,
+                                st->power_state.index, sizeof(value), &value);
+        if (ret < 0)
+                return ret;
+        if (value < 0)
+                return -EINVAL;
+
         return 0;
 }
 EXPORT_SYMBOL(hid_sensor_parse_common_attributes);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index a3cce3a38300..ecf592d69043 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                         st->report_state.report_id,
                         st->report_state.index,
                         HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM);
-
-                poll_value = hid_sensor_read_poll_value(st);
         } else {
                 int val;
 
@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
                                st->power_state.index,
                                sizeof(state_val), &state_val);
-        if (state && poll_value)
+        if (state)
+                poll_value = hid_sensor_read_poll_value(st);
+        if (poll_value > 0)
                 msleep_interruptible(poll_value * 2);
 
         return 0;
diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
index f7fcfa886f72..821919dd245b 100644
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -27,6 +27,7 @@
 #include <linux/iio/trigger_consumer.h>
 #include <linux/iio/triggered_buffer.h>
 #include <linux/regmap.h>
+#include <linux/delay.h>
 #include "bmg160.h"
 
 #define BMG160_IRQ_NAME         "bmg160_event"
@@ -52,6 +53,9 @@
 #define BMG160_DEF_BW                   100
 #define BMG160_REG_PMU_BW_RES           BIT(7)
 
+#define BMG160_GYRO_REG_RESET           0x14
+#define BMG160_GYRO_RESET_VAL           0xb6
+
 #define BMG160_REG_INT_MAP_0            0x17
 #define BMG160_INT_MAP_0_BIT_ANY        BIT(1)
 
@@ -236,6 +240,14 @@ static int bmg160_chip_init(struct bmg160_data *data)
         int ret;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 30ms after
+         * reset is required according to the datasheet.
+         */
+        regmap_write(data->regmap, BMG160_GYRO_REG_RESET,
+                     BMG160_GYRO_RESET_VAL);
+        usleep_range(30000, 30700);
+
         ret = regmap_read(data->regmap, BMG160_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error reading reg_chip_id\n");
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
index 78532ce07449..81b572d7699a 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -193,8 +193,8 @@ int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
         if (err < 0)
                 goto out;
 
-        fifo_watermark = ((data & ~ST_LSM6DSX_FIFO_TH_MASK) << 8) |
-                          (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
+        fifo_watermark = ((data << 8) & ~ST_LSM6DSX_FIFO_TH_MASK) |
+                         (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
 
         wdata = cpu_to_le16(fifo_watermark);
         err = hw->tf->write(hw->dev, ST_LSM6DSX_REG_FIFO_THL_ADDR,
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index d18ded45bedd..3ff91e02fee3 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -610,10 +610,9 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
                 tmp0 = (int)div_s64_rem(tmp, 1000000000, &tmp1);
                 return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
         case IIO_VAL_FRACTIONAL_LOG2:
-                tmp = (s64)vals[0] * 1000000000LL >> vals[1];
-                tmp1 = do_div(tmp, 1000000000LL);
-                tmp0 = tmp;
-                return snprintf(buf, len, "%d.%09u", tmp0, tmp1);
+                tmp = shift_right((s64)vals[0] * 1000000000LL, vals[1]);
+                tmp0 = (int)div_s64_rem(tmp, 1000000000LL, &tmp1);
+                return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
         case IIO_VAL_INT_MULTIPLE:
         {
                 int i;
diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
index 6dd8cbd7ce95..e13370dc9b1c 100644
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -763,7 +763,7 @@ power_off:
         return ret;
 }
 
-static int __exit ak8974_remove(struct i2c_client *i2c)
+static int ak8974_remove(struct i2c_client *i2c)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(i2c);
         struct ak8974 *ak8974 = iio_priv(indio_dev);
@@ -845,7 +845,7 @@ static struct i2c_driver ak8974_driver = {
                 .of_match_table = of_match_ptr(ak8974_of_match),
         },
         .probe    = ak8974_probe,
-        .remove   = __exit_p(ak8974_remove),
+        .remove   = ak8974_remove,
         .id_table = ak8974_id,
 };
 module_i2c_driver(ak8974_driver);
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 5f2680855552..fd0edca0e656 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -457,6 +457,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
                 .multi_read_bit = true,
+                .bootime = 2,
         },
 };
 
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index e95510117a6d..f2ae75fa3128 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -29,7 +29,13 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
 {
         int i, n, completed = 0;
 
-        while ((n = ib_poll_cq(cq, IB_POLL_BATCH, cq->wc)) > 0) {
+        /*
+         * budget might be (-1) if the caller does not
+         * want to bound this call, thus we need unsigned
+         * minimum here.
+         */
+        while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
+                        budget - completed), cq->wc)) > 0) {
                 for (i = 0; i < n; i++) {
                         struct ib_wc *wc = &cq->wc[i];
 
@@ -196,7 +202,7 @@ void ib_free_cq(struct ib_cq *cq)
                 irq_poll_disable(&cq->iop);
                 break;
         case IB_POLL_WORKQUEUE:
-                flush_work(&cq->work);
+                cancel_work_sync(&cq->work);
                 break;
         default:
                 WARN_ON_ONCE(1);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 593d2ce6ec7c..7c9e34d679d3 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -336,12 +336,26 @@ int ib_register_device(struct ib_device *device,
         struct device *parent = device->dev.parent;
 
         WARN_ON_ONCE(!parent);
-        if (!device->dev.dma_ops)
-                device->dev.dma_ops = parent->dma_ops;
-        if (!device->dev.dma_mask)
-                device->dev.dma_mask = parent->dma_mask;
-        if (!device->dev.coherent_dma_mask)
-                device->dev.coherent_dma_mask = parent->coherent_dma_mask;
+        WARN_ON_ONCE(device->dma_device);
+        if (device->dev.dma_ops) {
+                /*
+                 * The caller provided custom DMA operations. Copy the
+                 * DMA-related fields that are used by e.g. dma_alloc_coherent()
+                 * into device->dev.
+                 */
+                device->dma_device = &device->dev;
+                if (!device->dev.dma_mask)
+                        device->dev.dma_mask = parent->dma_mask;
+                if (!device->dev.coherent_dma_mask)
+                        device->dev.coherent_dma_mask =
+                                parent->coherent_dma_mask;
+        } else {
+                /*
+                 * The caller did not provide custom DMA operations. Use the
+                 * DMA mapping operations of the parent device.
+                 */
+                device->dma_device = parent;
+        }
 
         mutex_lock(&device_mutex);
 
@@ -1015,8 +1029,7 @@ static int __init ib_core_init(void)
                 return -ENOMEM;
 
         ib_comp_wq = alloc_workqueue("ib-comp-wq",
-                        WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM,
-                        WQ_UNBOUND_MAX_ACTIVE);
+                        WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
         if (!ib_comp_wq) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0f5d43d1f5fc..70c3e9e79508 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -160,6 +160,9 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         upper_dev = netdev_master_upper_dev_get(netdev);
         if (netdev != event_netdev)
@@ -214,6 +217,9 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         if (netdev != event_netdev)
                 return NOTIFY_DONE;
@@ -260,6 +266,8 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
                 if (!iwhdl)
                         return NOTIFY_DONE;
                 iwdev = &iwhdl->device;
+                if (iwdev->init_state < INET_NOTIFIER)
+                        return NOTIFY_DONE;
                 p = (__be32 *)neigh->primary_key;
                 i40iw_copy_ip_ntohl(local_ipaddr, p);
                 if (neigh->nud_state & NUD_VALID) {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index bc9fb144e57b..c52edeafd616 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -372,7 +372,7 @@ static int _ocrdma_pd_mgr_put_bitmap(struct ocrdma_dev *dev, u16 pd_id,
         return 0;
 }
 
-static u8 ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
+static int ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
                                    bool dpp_pool)
 {
         int status;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 12c4208fd701..af9f596bb68b 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -7068,7 +7068,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
         unsigned long flags;
 
         while (wait) {
-                unsigned long shadow;
+                unsigned long shadow = 0;
                 int cstart, previ = -1;
 
                 /*
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 3cd96c1b9502..9fbe22d3467b 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -69,6 +69,9 @@
  */
 #define PCI_DEVICE_ID_VMWARE_PVRDMA     0x0820
 
+#define PVRDMA_NUM_RING_PAGES           4
+#define PVRDMA_QP_NUM_HEADER_PAGES      1
+
 struct pvrdma_dev;
 
 struct pvrdma_page_dir {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
index e69d6f3cae32..09078ccfaec7 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
@@ -132,7 +132,7 @@ enum pvrdma_pci_resource {
 
 enum pvrdma_device_ctl {
         PVRDMA_DEVICE_CTL_ACTIVATE,     /* Activate device. */
-        PVRDMA_DEVICE_CTL_QUIESCE,      /* Quiesce device. */
+        PVRDMA_DEVICE_CTL_UNQUIESCE,    /* Unquiesce device. */
         PVRDMA_DEVICE_CTL_RESET,        /* Reset device. */
 };
 
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 100bea5c42ff..34ebc7615411 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -56,7 +56,7 @@
 #include "pvrdma.h"
 
 #define DRV_NAME        "vmw_pvrdma"
-#define DRV_VERSION     "1.0.0.0-k"
+#define DRV_VERSION     "1.0.1.0-k"
 
 static DEFINE_MUTEX(pvrdma_device_list_lock);
 static LIST_HEAD(pvrdma_device_list);
@@ -660,7 +660,16 @@ static void pvrdma_netdevice_event_handle(struct pvrdma_dev *dev,
                 pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ERR);
                 break;
         case NETDEV_UP:
-                pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
+                pvrdma_write_reg(dev, PVRDMA_REG_CTL,
+                                 PVRDMA_DEVICE_CTL_UNQUIESCE);
+
+                mb();
+
+                if (pvrdma_read_reg(dev, PVRDMA_REG_ERR))
+                        dev_err(&dev->pdev->dev,
+                                "failed to activate device during link up\n");
+                else
+                        pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
                 break;
         default:
                 dev_dbg(&dev->pdev->dev, "ignore netdevice event %ld on %s\n",
@@ -858,7 +867,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->resp_slot_dma = (u64)slot_dma;
 
         /* Async event ring */
-        dev->dsr->async_ring_pages.num_pages = 4;
+        dev->dsr->async_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->async_pdir,
                                    dev->dsr->async_ring_pages.num_pages, true);
         if (ret)
@@ -867,7 +876,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->async_ring_pages.pdir_dma = dev->async_pdir.dir_dma;
 
         /* CQ notification ring */
-        dev->dsr->cq_ring_pages.num_pages = 4;
+        dev->dsr->cq_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->cq_pdir,
                                    dev->dsr->cq_ring_pages.num_pages, true);
         if (ret)
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index dbbfd35e7da7..30062aad3af1 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -170,8 +170,9 @@ static int pvrdma_set_sq_size(struct pvrdma_dev *dev, struct ib_qp_cap *req_cap,
                                              sizeof(struct pvrdma_sge) *
                                              qp->sq.max_sg);
         /* Note: one extra page for the header. */
-        qp->npages_send = 1 + (qp->sq.wqe_cnt * qp->sq.wqe_size +
-                               PAGE_SIZE - 1) / PAGE_SIZE;
+        qp->npages_send = PVRDMA_QP_NUM_HEADER_PAGES +
+                          (qp->sq.wqe_cnt * qp->sq.wqe_size + PAGE_SIZE - 1) /
+                                                                PAGE_SIZE;
 
         return 0;
 }
@@ -288,7 +289,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
                         qp->npages = qp->npages_send + qp->npages_recv;
 
                         /* Skip header page. */
-                        qp->sq.offset = PAGE_SIZE;
+                        qp->sq.offset = PVRDMA_QP_NUM_HEADER_PAGES * PAGE_SIZE;
 
                         /* Recv queue pages are after send pages. */
                         qp->rq.offset = qp->npages_send * PAGE_SIZE;
@@ -341,7 +342,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
         cmd->qp_type = ib_qp_type_to_pvrdma(init_attr->qp_type);
         cmd->access_flags = IB_ACCESS_LOCAL_WRITE;
         cmd->total_chunks = qp->npages;
-        cmd->send_chunks = qp->npages_send - 1;
+        cmd->send_chunks = qp->npages_send - PVRDMA_QP_NUM_HEADER_PAGES;
         cmd->pdir_dma = qp->pdir.dir_dma;
 
         dev_dbg(&dev->pdev->dev, "create queuepair with %d, %d, %d, %d\n",
@@ -554,13 +555,13 @@ out:
         return ret;
 }
 
-static inline void *get_sq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_sq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->sq.offset + n * qp->sq.wqe_size);
 }
 
-static inline void *get_rq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_rq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->rq.offset + n * qp->rq.wqe_size);
@@ -598,9 +599,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         unsigned long flags;
         struct pvrdma_sq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int i, index;
-        int nreq;
-        int ret;
+        int i, ret;
 
         /*
          * In states lower than RTS, we can fail immediately. In other states,
@@ -613,9 +612,8 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         spin_lock_irqsave(&qp->sq.lock, flags);
 
-        index = pvrdma_idx(&qp->sq.ring->prod_tail, qp->sq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(!pvrdma_idx_ring_has_space(
                                 qp->sq.ring, qp->sq.wqe_cnt, &tail))) {
@@ -680,7 +678,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, tail);
                 memset(wqe_hdr, 0, sizeof(*wqe_hdr));
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
@@ -771,12 +769,11 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->sq.wqe_cnt))
-                        index = 0;
                 /* Update shared sq ring */
                 pvrdma_idx_ring_inc(&qp->sq.ring->prod_tail,
                                     qp->sq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         ret = 0;
@@ -806,7 +803,6 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
         struct pvrdma_qp *qp = to_vqp(ibqp);
         struct pvrdma_rq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int index, nreq;
         int ret = 0;
         int i;
 
@@ -821,9 +817,8 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
         spin_lock_irqsave(&qp->rq.lock, flags);
 
-        index = pvrdma_idx(&qp->rq.ring->prod_tail, qp->rq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(wr->num_sge > qp->rq.max_sg ||
                              wr->num_sge < 0)) {
@@ -843,7 +838,7 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                         goto out;
                 }
 
-                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, tail);
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
                 wqe_hdr->total_len = 0;
@@ -859,12 +854,11 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->rq.wqe_cnt))
-                        index = 0;
                 /* Update shared rq ring */
                 pvrdma_idx_ring_inc(&qp->rq.ring->prod_tail,
                                     qp->rq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         spin_unlock_irqrestore(&qp->rq.lock, flags);
diff --git a/drivers/infiniband/sw/rdmavt/mmap.c b/drivers/infiniband/sw/rdmavt/mmap.c
index e202b8142759..6b712eecbd37 100644
--- a/drivers/infiniband/sw/rdmavt/mmap.c
+++ b/drivers/infiniband/sw/rdmavt/mmap.c
@@ -170,9 +170,9 @@ struct rvt_mmap_info *rvt_create_mmap_info(struct rvt_dev_info *rdi,
 
         spin_lock_irq(&rdi->mmap_offset_lock);
         if (rdi->mmap_offset == 0)
-                rdi->mmap_offset = PAGE_SIZE;
+                rdi->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
         ip->offset = rdi->mmap_offset;
-        rdi->mmap_offset += size;
+        rdi->mmap_offset += ALIGN(size, SHMLBA);
         spin_unlock_irq(&rdi->mmap_offset_lock);
 
         INIT_LIST_HEAD(&ip->pending_mmaps);
diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
index 7d1ac27ed251..6332dedc11e8 100644
--- a/drivers/infiniband/sw/rxe/Kconfig
+++ b/drivers/infiniband/sw/rxe/Kconfig
@@ -22,4 +22,4 @@ config RDMA_RXE
         To configure and work with soft-RoCE driver please use the
         following wiki page under "configure Soft-RoCE (RXE)" section:
 
-        https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
+        https://github.com/linux-rdma/rdma-core/blob/master/Documentation/rxe.md
diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
index c572a4c09359..bd812e00988e 100644
--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
+++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
@@ -156,10 +156,10 @@ struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *rxe,
         spin_lock_bh(&rxe->mmap_offset_lock);
 
         if (rxe->mmap_offset == 0)
-                rxe->mmap_offset = PAGE_SIZE;
+                rxe->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
 
         ip->info.offset = rxe->mmap_offset;
-        rxe->mmap_offset += size;
+        rxe->mmap_offset += ALIGN(size, SHMLBA);
 
         spin_unlock_bh(&rxe->mmap_offset_lock);
 
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index dbfde0dc6ff7..9f95f50b2909 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -729,11 +729,11 @@ next_wqe:
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
-                kfree_skb(skb);
 
                 rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
 
                 if (ret == -EAGAIN) {
+                        kfree_skb(skb);
                         rxe_run_task(&qp->req.task, 1);
                         goto exit;
                 }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index d404a8aba7af..c9dd385ce62e 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -813,18 +813,17 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
                 WARN_ON_ONCE(1);
         }
 
-        /* We successfully processed this new request. */
-        qp->resp.msn++;
-
         /* next expected psn, read handles this separately */
         qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
 
         qp->resp.opcode = pkt->opcode;
         qp->resp.status = IB_WC_SUCCESS;
 
-        if (pkt->mask & RXE_COMP_MASK)
+        if (pkt->mask & RXE_COMP_MASK) {
+                /* We successfully processed this new request. */
+                qp->resp.msn++;
                 return RESPST_COMPLETE;
-        else if (qp_type(qp) == IB_QPT_RC)
+        } else if (qp_type(qp) == IB_QPT_RC)
                 return RESPST_ACKNOWLEDGE;
         else
                 return RESPST_CLEANUP;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 9d0b22ad58c1..c1ae4aeae2f9 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -430,6 +430,7 @@ struct iser_fr_desc {
         struct list_head                  list;
         struct iser_reg_resources         rsc;
         struct iser_pi_context           *pi_ctx;
+        struct list_head                  all_list;
 };
 
 /**
@@ -443,6 +444,7 @@ struct iser_fr_pool {
         struct list_head        list;
         spinlock_t              lock;
         int                     size;
+        struct list_head        all_list;
 };
 
 /**
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 30b622f2ab73..c538a38c91ce 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -362,6 +362,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
         int i, ret;
 
         INIT_LIST_HEAD(&fr_pool->list);
+        INIT_LIST_HEAD(&fr_pool->all_list);
         spin_lock_init(&fr_pool->lock);
         fr_pool->size = 0;
         for (i = 0; i < cmds_max; i++) {
@@ -373,6 +374,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
                 }
 
                 list_add_tail(&desc->list, &fr_pool->list);
+                list_add_tail(&desc->all_list, &fr_pool->all_list);
                 fr_pool->size++;
         }
 
@@ -392,13 +394,13 @@ void iser_free_fastreg_pool(struct ib_conn *ib_conn)
         struct iser_fr_desc *desc, *tmp;
         int i = 0;
 
-        if (list_empty(&fr_pool->list))
+        if (list_empty(&fr_pool->all_list))
                 return;
 
         iser_info("freeing conn %p fr pool\n", ib_conn);
 
-        list_for_each_entry_safe(desc, tmp, &fr_pool->list, list) {
-                list_del(&desc->list);
+        list_for_each_entry_safe(desc, tmp, &fr_pool->all_list, all_list) {
+                list_del(&desc->all_list);
                 iser_free_reg_res(&desc->rsc);
                 if (desc->pi_ctx)
                         iser_free_pi_ctx(desc->pi_ctx);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 91cbe86b25c8..fcbed35e95a8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -817,6 +817,7 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count)
                 rx_wr->sg_list = &rx_desc->rx_sg;
                 rx_wr->num_sge = 1;
                 rx_wr->next = rx_wr + 1;
+                rx_desc->in_use = false;
         }
         rx_wr--;
         rx_wr->next = NULL; /* mark end of work requests list */
@@ -835,6 +836,15 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
         struct ib_recv_wr *rx_wr_failed, rx_wr;
         int ret;
 
+        if (!rx_desc->in_use) {
+                /*
+                 * if the descriptor is not in-use we already reposted it
+                 * for recv, so just silently return
+                 */
+                return 0;
+        }
+
+        rx_desc->in_use = false;
         rx_wr.wr_cqe = &rx_desc->rx_cqe;
         rx_wr.sg_list = &rx_desc->rx_sg;
         rx_wr.num_sge = 1;
@@ -1397,6 +1407,8 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
                 return;
         }
 
+        rx_desc->in_use = true;
+
         ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
                         ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
 
@@ -1659,10 +1671,23 @@ isert_rdma_write_done(struct ib_cq *cq, struct ib_wc *wc)
         ret = isert_check_pi_status(cmd, isert_cmd->rw.sig->sig_mr);
         isert_rdma_rw_ctx_destroy(isert_cmd, isert_conn);
 
-        if (ret)
-                transport_send_check_condition_and_sense(cmd, cmd->pi_err, 0);
-        else
-                isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+        if (ret) {
+                /*
+                 * transport_generic_request_failure() expects to have
+                 * plus two references to handle queue-full, so re-add
+                 * one here as target-core will have already dropped
+                 * it after the first isert_put_datain() callback.
+                 */
+                kref_get(&cmd->cmd_kref);
+                transport_generic_request_failure(cmd, cmd->pi_err);
+        } else {
+                /*
+                 * XXX: isert_put_response() failure is not retried.
+                 */
+                ret = isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+                if (ret)
+                        pr_warn_ratelimited("isert_put_response() ret: %d\n", ret);
+        }
 }
 
 static void
@@ -1699,13 +1724,15 @@ isert_rdma_read_done(struct ib_cq *cq, struct ib_wc *wc)
         cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
         spin_unlock_bh(&cmd->istate_lock);
 
-        if (ret) {
-                target_put_sess_cmd(se_cmd);
-                transport_send_check_condition_and_sense(se_cmd,
-                                                         se_cmd->pi_err, 0);
-        } else {
+        /*
+         * transport_generic_request_failure() will drop the extra
+         * se_cmd->cmd_kref reference after T10-PI error, and handle
+         * any non-zero ->queue_status() callback error retries.
+         */
+        if (ret)
+                transport_generic_request_failure(se_cmd, se_cmd->pi_err);
+        else
                 target_execute_cmd(se_cmd);
-        }
 }
 
 static void
@@ -2171,26 +2198,28 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                 chain_wr = &isert_cmd->tx_desc.send_wr;
         }
 
-        isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
-        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ\n", isert_cmd);
-        return 1;
+        rc = isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
+        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ rc: %d\n",
+                  isert_cmd, rc);
+        return rc;
 }
 
 static int
 isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
 {
         struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+        int ret;
 
         isert_dbg("Cmd: %p RDMA_READ data_length: %u write_data_done: %u\n",
                  isert_cmd, cmd->se_cmd.data_length, cmd->write_data_done);
 
         isert_cmd->tx_desc.tx_cqe.done = isert_rdma_read_done;
-        isert_rdma_rw_ctx_post(isert_cmd, conn->context,
-                        &isert_cmd->tx_desc.tx_cqe, NULL);
+        ret = isert_rdma_rw_ctx_post(isert_cmd, conn->context,
+                                     &isert_cmd->tx_desc.tx_cqe, NULL);
 
-        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
-                 isert_cmd);
-        return 0;
+        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE rc: %d\n",
+                 isert_cmd, ret);
+        return ret;
 }
 
 static int
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index c02ada57d7f5..87d994de8c91 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -60,7 +60,7 @@
 
 #define ISER_RX_PAD_SIZE        (ISCSI_DEF_MAX_RECV_SEG_LEN + 4096 - \
                 (ISER_RX_PAYLOAD_SIZE + sizeof(u64) + sizeof(struct ib_sge) + \
-                 sizeof(struct ib_cqe)))
+                 sizeof(struct ib_cqe) + sizeof(bool)))
 
 #define ISCSI_ISER_SG_TABLESIZE         256
 
@@ -85,6 +85,7 @@ struct iser_rx_desc {
         u64             dma_addr;
         struct ib_sge   rx_sg;
         struct ib_cqe   rx_cqe;
+        bool            in_use;
         char            pad[ISER_RX_PAD_SIZE];
 } __packed;
 
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index d96aa27dfcdc..db64adfbe1af 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         epirq = &interface->endpoint[0].desc;
         epout = &interface->endpoint[1].desc;
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 155fcb3b6230..153b1ee13e03 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -202,6 +202,7 @@ static const struct xpad_device {
         { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
         { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
         { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+        { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
         { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
@@ -326,6 +327,7 @@ static struct usb_device_id xpad_table[] = {
         XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive Controllers */
         XPAD_XBOX360_VENDOR(0x1532),            /* Razer Sabertooth */
+        XPAD_XBOXONE_VENDOR(0x1532),            /* Razer Wildcat */
         XPAD_XBOX360_VENDOR(0x15e4),            /* Numark X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x162e),            /* Joytech X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x1689),            /* Razer Onza */
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 9cc6d057c302..23c191a2a071 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -700,6 +700,10 @@ static int cm109_usb_probe(struct usb_interface *intf,
         int error = -ENOMEM;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
 
         if (!usb_endpoint_is_int_in(endpoint))
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 9c0ea36913b4..f4e8fbec6a94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
                 return -EINVAL;
 
         alt = pcu->ctrl_intf->cur_altsetting;
+
+        if (alt->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         pcu->ep_ctrl = &alt->endpoint[0].desc;
         pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
 
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 79c964c075f1..6e7ff9561d92 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -875,6 +875,10 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
         int ret, pipe, i;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
         if (!usb_endpoint_is_int_in(endpoint))
                 return -ENODEV;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 72b28ebfe360..f210e19ddba6 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1282,10 +1282,8 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
         /* handle buttons */
         if (pkt_id == SS4_PACKET_ID_STICK) {
                 f->ts_left = !!(SS4_BTN_V2(p) & 0x01);
-                if (!(priv->flags & ALPS_BUTTONPAD)) {
-                        f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
-                        f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
-                }
+                f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
+                f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
         } else {
                 f->left = !!(SS4_BTN_V2(p) & 0x01);
                 if (!(priv->flags & ALPS_BUTTONPAD)) {
@@ -2462,14 +2460,34 @@ static int alps_update_device_area_ss4_v2(unsigned char otp[][4],
         int num_y_electrode;
         int x_pitch, y_pitch, x_phys, y_phys;
 
-        num_x_electrode = SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
-        num_y_electrode = SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                num_x_electrode =
+                        SS4PLUS_NUMSENSOR_XOFFSET + (otp[0][2] & 0x0F);
+                num_y_electrode =
+                        SS4PLUS_NUMSENSOR_YOFFSET + ((otp[0][2] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
 
-        priv->x_max = (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-        priv->y_max = (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                x_pitch = (otp[0][1] & 0x0F) + SS4PLUS_MIN_PITCH_MM;
+                y_pitch = ((otp[0][1] >> 4) & 0x0F) + SS4PLUS_MIN_PITCH_MM;
 
-        x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
-        y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        } else {
+                num_x_electrode =
+                        SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
+                num_y_electrode =
+                        SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+
+                x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
+                y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        }
 
         x_phys = x_pitch * (num_x_electrode - 1); /* In 0.1 mm units */
         y_phys = y_pitch * (num_y_electrode - 1); /* In 0.1 mm units */
@@ -2485,7 +2503,10 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
 {
         unsigned char is_btnless;
 
-        is_btnless = (otp[1][1] >> 3) & 0x01;
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_btnless = (otp[1][0] >> 1) & 0x01;
+        else
+                is_btnless = (otp[1][1] >> 3) & 0x01;
 
         if (is_btnless)
                 priv->flags |= ALPS_BUTTONPAD;
@@ -2493,6 +2514,21 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
         return 0;
 }
 
+static int alps_update_dual_info_ss4_v2(unsigned char otp[][4],
+                                       struct alps_data *priv)
+{
+        bool is_dual = false;
+
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_dual = (otp[0][0] >> 4) & 0x01;
+
+        if (is_dual)
+                priv->flags |= ALPS_DUALPOINT |
+                                        ALPS_DUALPOINT_WITH_PRESSURE;
+
+        return 0;
+}
+
 static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
                                     struct alps_data *priv)
 {
@@ -2508,6 +2544,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
 
         alps_update_btn_info_ss4_v2(otp, priv);
 
+        alps_update_dual_info_ss4_v2(otp, priv);
+
         return 0;
 }
 
@@ -2753,10 +2791,6 @@ static int alps_set_protocol(struct psmouse *psmouse,
                 if (alps_set_defaults_ss4_v2(psmouse, priv))
                         return -EIO;
 
-                if (priv->fw_ver[1] == 0x1)
-                        priv->flags |= ALPS_DUALPOINT |
-                                        ALPS_DUALPOINT_WITH_PRESSURE;
-
                 break;
         }
 
@@ -2827,10 +2861,7 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
                            ec[2] >= 0x90 && ec[2] <= 0x9d) {
                         protocol = &alps_v3_protocol_data;
                 } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x14 && ec[1] == 0x02) {
-                        protocol = &alps_v8_protocol_data;
-                } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x28 && ec[1] == 0x01) {
+                           (e7[2] == 0x14 || e7[2] == 0x28)) {
                         protocol = &alps_v8_protocol_data;
                 } else {
                         psmouse_dbg(psmouse,
@@ -2840,7 +2871,8 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
         }
 
         if (priv) {
-                /* Save the Firmware version */
+                /* Save Device ID and Firmware version */
+                memcpy(priv->dev_id, e7, 3);
                 memcpy(priv->fw_ver, ec, 3);
                 error = alps_set_protocol(psmouse, priv, protocol);
                 if (error)
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index 6d279aa27cb9..4334f2805d93 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -54,6 +54,16 @@ enum SS4_PACKET_ID {
 
 #define SS4_MASK_NORMAL_BUTTONS         0x07
 
+#define SS4PLUS_COUNT_PER_ELECTRODE     128
+#define SS4PLUS_NUMSENSOR_XOFFSET       16
+#define SS4PLUS_NUMSENSOR_YOFFSET       5
+#define SS4PLUS_MIN_PITCH_MM            37
+
+#define IS_SS4PLUS_DEV(_b)      (((_b[0]) == 0x73) &&   \
+                                 ((_b[1]) == 0x03) &&   \
+                                 ((_b[2]) == 0x28)              \
+                                )
+
 #define SS4_IS_IDLE_V2(_b)      (((_b[0]) == 0x18) &&           \
                                  ((_b[1]) == 0x10) &&           \
                                  ((_b[2]) == 0x00) &&           \
@@ -283,6 +293,7 @@ struct alps_data {
         int addr_command;
         u16 proto_version;
         u8 byte0, mask0;
+        u8 dev_id[3];
         u8 fw_ver[3];
         int flags;
         int x_max;
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 352050e9031d..d5ab9ddef3e3 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -218,17 +218,19 @@ static int elan_query_product(struct elan_tp_data *data)
 
 static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
 {
-        if (data->ic_type != 0x0E)
-                return false;
-
-        switch (data->product_id) {
-        case 0x05 ... 0x07:
-        case 0x09:
-        case 0x13:
+        if (data->ic_type == 0x0E) {
+                switch (data->product_id) {
+                case 0x05 ... 0x07:
+                case 0x09:
+                case 0x13:
+                        return true;
+                }
+        } else if (data->ic_type == 0x08 && data->product_id == 0x26) {
+                /* ASUS EeeBook X205TA */
                 return true;
-        default:
-                return false;
         }
+
+        return false;
 }
 
 static int __elan_initialize(struct elan_tp_data *data)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index efc8ec342351..e73d968023f7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,6 +1118,7 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
@@ -1524,6 +1525,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E547"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 198678613382..34dfee555b20 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -170,6 +170,10 @@ static int rmi_f30_config(struct rmi_function *fn)
                                 rmi_get_platform_data(fn->rmi_dev);
         int error;
 
+        /* can happen if f30_data.disable is set */
+        if (!f30)
+                return 0;
+
         if (pdata->f30_data.trackstick_buttons) {
                 /* Try [re-]establish link to F03. */
                 f30->f03 = rmi_find_function(fn->rmi_dev, 0x03);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 05afd16ea9c9..312bd6ca9198 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -120,6 +120,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                 },
         },
         {
+                /* Dell Embedded Box PC 3000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
+                },
+        },
+        {
                 /* OQO Model 01 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
@@ -513,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
+        {
+                /* TUXEDO BU1406 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
index cd852059b99e..df4bea96d7ed 100644
--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
         int error;
         int i;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!hanwang || !input_dev) {
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index e850d7e8afbc..4d9d64908b59 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
         struct input_dev *input_dev;
         int error = -ENOMEM;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!kbtab || !input_dev)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index aefb6e11f88a..4c0eecae065c 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -527,6 +527,9 @@ static int sur40_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0xFF)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 5)
+                return -ENODEV;
+
         /* Use endpoint #4 (0x86). */
         endpoint = &iface_desc->endpoint[4].desc;
         if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 98940d1392cb..b17536d6e69b 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3202,7 +3202,7 @@ static void amd_iommu_get_resv_regions(struct device *dev,
 
         region = iommu_alloc_resv_region(MSI_RANGE_START,
                                          MSI_RANGE_END - MSI_RANGE_START + 1,
-                                         0, IOMMU_RESV_RESERVED);
+                                         0, IOMMU_RESV_MSI);
         if (!region)
                 return;
         list_add_tail(&region->list, head);
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 5806a6acc94e..591bb96047c9 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1888,7 +1888,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index abf6496843a6..b493c99e17f7 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1608,7 +1608,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index a7e0821c9967..c01bfcdb2383 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -512,7 +512,13 @@ static void sysmmu_tlb_invalidate_flpdcache(struct sysmmu_drvdata *data,
         spin_lock_irqsave(&data->lock, flags);
         if (data->active && data->version >= MAKE_MMU_VER(3, 3)) {
                 clk_enable(data->clk_master);
-                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                if (sysmmu_block(data)) {
+                        if (data->version >= MAKE_MMU_VER(5, 0))
+                                __sysmmu_tlb_invalidate(data);
+                        else
+                                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                        sysmmu_unblock(data);
+                }
                 clk_disable(data->clk_master);
         }
         spin_unlock_irqrestore(&data->lock, flags);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 238ad3447712..d412a313a372 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -916,7 +916,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                                  * which we used for the IOMMU lookup. Strictly speaking
                                  * we could do this for all PCI devices; we only need to
                                  * get the BDF# from the scope table for ACPI matches. */
-                                if (pdev->is_virtfn)
+                                if (pdev && pdev->is_virtfn)
                                         goto got_pdev;
 
                                 *bus = drhd->devices[i].bus;
@@ -5249,7 +5249,7 @@ static void intel_iommu_get_resv_regions(struct device *device,
 
         reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
                                       IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
-                                      0, IOMMU_RESV_RESERVED);
+                                      0, IOMMU_RESV_MSI);
         if (!reg)
                 return;
         list_add_tail(&reg->list, head);
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 1c049e2e12bf..8d6ca28c3e1f 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -422,8 +422,12 @@ static int __arm_v7s_map(struct arm_v7s_io_pgtable *data, unsigned long iova,
                         pte |= ARM_V7S_ATTR_NS_TABLE;
 
                 __arm_v7s_set_pte(ptep, pte, 1, cfg);
-        } else {
+        } else if (ARM_V7S_PTE_IS_TABLE(pte, lvl)) {
                 cptep = iopte_deref(pte, lvl);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index feacc54bec68..f9bc6ebb8140 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,
                 if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
                         pte |= ARM_LPAE_PTE_NSTABLE;
                 __arm_lpae_set_pte(ptep, pte, cfg);
-        } else {
+        } else if (!iopte_leaf(pte, lvl)) {
                 cptep = iopte_deref(pte, data);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 8ea14f41a979..3b67144dead2 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -72,6 +72,7 @@ static const char * const iommu_group_resv_type_string[] = {
         [IOMMU_RESV_DIRECT]     = "direct",
         [IOMMU_RESV_RESERVED]   = "reserved",
         [IOMMU_RESV_MSI]        = "msi",
+        [IOMMU_RESV_SW_MSI]     = "msi",
 };
 
 #define IOMMU_GROUP_ATTR(_name, _mode, _show, _store)           \
@@ -1743,8 +1744,8 @@ void iommu_put_resv_regions(struct device *dev, struct list_head *list)
 }
 
 struct iommu_resv_region *iommu_alloc_resv_region(phys_addr_t start,
-                                                  size_t length,
-                                                  int prot, int type)
+                                                  size_t length, int prot,
+                                                  enum iommu_resv_type type)
 {
         struct iommu_resv_region *region;
 
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 125528f39e92..8162121bb1bc 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -262,6 +262,7 @@ config IRQ_MXS
 
 config MVEBU_ODMI
         bool
+        select GENERIC_MSI_IRQ_DOMAIN
 
 config MVEBU_PIC
         bool
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 15af9a9753e5..2d203b422129 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init(struct device_node *node,
                 return -ENOMEM;
         }
 
+        raw_spin_lock_init(&cd->rlock);
+
         cd->gpc_base = of_iomap(node, 0);
         if (!cd->gpc_base) {
                 pr_err("fsl-gpcv2: unable to map gpc registers\n");
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 11d12bccc4e7..cd20df12d63d 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -991,8 +991,12 @@ static void __init gic_map_single_int(struct device_node *node,
 
 static void __init gic_map_interrupts(struct device_node *node)
 {
+        gic_map_single_int(node, GIC_LOCAL_INT_WD);
+        gic_map_single_int(node, GIC_LOCAL_INT_COMPARE);
         gic_map_single_int(node, GIC_LOCAL_INT_TIMER);
         gic_map_single_int(node, GIC_LOCAL_INT_PERFCTR);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT0);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT1);
         gic_map_single_int(node, GIC_LOCAL_INT_FDC);
 }
 
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 1dfd1085a04f..9ca691d6c13b 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1032,6 +1032,7 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
                                                      sizeof(avmb1_carddef))))
                                 return -EFAULT;
                         cdef.cardtype = AVM_CARDTYPE_B1;
+                        cdef.cardnr = 0;
                 } else {
                         if ((retval = copy_from_user(&cdef, data,
                                                      sizeof(avmb1_extcarddef))))
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index e4c2c1a1e993..6735c8d6a445 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -932,7 +932,7 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
         *result = true;
 
         r = dm_bitset_cursor_begin(&cmd->dirty_info, cmd->dirty_root,
-                                   from_cblock(begin), &cmd->dirty_cursor);
+                                   from_cblock(cmd->cache_blocks), &cmd->dirty_cursor);
         if (r) {
                 DMERR("%s: dm_bitset_cursor_begin for dirty failed", __func__);
                 return r;
@@ -959,14 +959,16 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
                         return 0;
                 }
 
+                begin = to_cblock(from_cblock(begin) + 1);
+                if (begin == end)
+                        break;
+
                 r = dm_bitset_cursor_next(&cmd->dirty_cursor);
                 if (r) {
                         DMERR("%s: dm_bitset_cursor_next for dirty failed", __func__);
                         dm_bitset_cursor_end(&cmd->dirty_cursor);
                         return r;
                 }
-
-                begin = to_cblock(from_cblock(begin) + 1);
         }
 
         dm_bitset_cursor_end(&cmd->dirty_cursor);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index f8564d63982f..1e217ba84d09 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3726,7 +3726,7 @@ static int raid_preresume(struct dm_target *ti)
                 return r;
 
         /* Resize bitmap to adjust to changed region size (aka MD bitmap chunksize) */
-        if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) &&
+        if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) && mddev->bitmap &&
             mddev->bitmap_info.chunksize != to_bytes(rs->requested_bitmap_chunk_sectors)) {
                 r = bitmap_resize(mddev->bitmap, mddev->dev_sectors,
                                   to_bytes(rs->requested_bitmap_chunk_sectors), 0);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 28955b94d2b2..0b081d170087 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -755,6 +755,7 @@ static int dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                 /* Undo dm_start_request() before requeuing */
                 rq_end_stats(md, rq);
                 rq_completed(md, rq_data_dir(rq), false);
+                blk_mq_delay_run_hw_queue(hctx, 100/*ms*/);
                 return BLK_MQ_RQ_QUEUE_BUSY;
         }
 
diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index 0f0eb8a3d922..78f36012eaca 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -146,8 +146,6 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
                 block = fec_buffer_rs_block(v, fio, n, i);
                 res = fec_decode_rs8(v, fio, block, &par[offset], neras);
                 if (res < 0) {
-                        dm_bufio_release(buf);
-
                         r = res;
                         goto error;
                 }
@@ -172,6 +170,8 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
 done:
         r = corrected;
 error:
+        dm_bufio_release(buf);
+
         if (r < 0 && neras)
                 DMERR_LIMIT("%s: FEC %llu: failed to correct: %d",
                             v->data_dev->name, (unsigned long long)rsb, r);
@@ -269,7 +269,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io,
                                           &is_zero) == 0) {
                         /* skip known zero blocks entirely */
                         if (is_zero)
-                                continue;
+                                goto done;
 
                         /*
                          * skip if we have already found the theoretical
@@ -439,6 +439,13 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
         if (!verity_fec_is_enabled(v))
                 return -EOPNOTSUPP;
 
+        if (fio->level >= DM_VERITY_FEC_MAX_RECURSION) {
+                DMWARN_LIMIT("%s: FEC: recursion too deep", v->data_dev->name);
+                return -EIO;
+        }
+
+        fio->level++;
+
         if (type == DM_VERITY_BLOCK_TYPE_METADATA)
                 block += v->data_blocks;
 
@@ -470,7 +477,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
         if (r < 0) {
                 r = fec_decode_rsb(v, io, fio, rsb, offset, true);
                 if (r < 0)
-                        return r;
+                        goto done;
         }
 
         if (dest)
@@ -480,6 +487,8 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
                 r = verity_for_bv_block(v, io, iter, fec_bv_copy);
         }
 
+done:
+        fio->level--;
         return r;
 }
 
@@ -520,6 +529,7 @@ void verity_fec_init_io(struct dm_verity_io *io)
         memset(fio->bufs, 0, sizeof(fio->bufs));
         fio->nbufs = 0;
         fio->output = NULL;
+        fio->level = 0;
 }
 
 /*
diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h
index 7fa0298b995e..bb31ce87a933 100644
--- a/drivers/md/dm-verity-fec.h
+++ b/drivers/md/dm-verity-fec.h
@@ -27,6 +27,9 @@
 #define DM_VERITY_FEC_BUF_MAX \
         (1 << (PAGE_SHIFT - DM_VERITY_FEC_BUF_RS_BITS))
 
+/* maximum recursion level for verity_fec_decode */
+#define DM_VERITY_FEC_MAX_RECURSION     4
+
 #define DM_VERITY_OPT_FEC_DEV           "use_fec_from_device"
 #define DM_VERITY_OPT_FEC_BLOCKS        "fec_blocks"
 #define DM_VERITY_OPT_FEC_START         "fec_start"
@@ -58,6 +61,7 @@ struct dm_verity_fec_io {
         unsigned nbufs;         /* number of buffers allocated */
         u8 *output;             /* buffer for corrected output */
         size_t output_pos;
+        unsigned level;         /* recursion level */
 };
 
 #ifdef CONFIG_DM_VERITY_FEC
diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c
index 67fd8ffa60a4..669a4c82f1ff 100644
--- a/drivers/media/platform/coda/imx-vdoa.c
+++ b/drivers/media/platform/coda/imx-vdoa.c
@@ -321,7 +321,7 @@ static const struct of_device_id vdoa_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, vdoa_dt_ids);
 
-static const struct platform_driver vdoa_driver = {
+static struct platform_driver vdoa_driver = {
         .probe          = vdoa_probe,
         .remove         = vdoa_remove,
         .driver         = {
diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
index cbb03768f5d7..0f0c389f8897 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -861,9 +861,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer *vb,
 
         if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
                 swap(addr->cb, addr->cr);
 
diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
index 823608112d89..7918b928f058 100644
--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
@@ -632,8 +632,8 @@ static int bdisp_open(struct file *file)
 
 error_ctrls:
         bdisp_ctrls_delete(ctx);
-error_fh:
         v4l2_fh_del(&ctx->fh);
+error_fh:
         v4l2_fh_exit(&ctx->fh);
         bdisp_hw_free_nodes(ctx);
 mem_ctx:
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index ab9866024ec7..04033efe7ad5 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
 {
         struct hexline *hx;
-        u8 reset;
-        int ret,pos=0;
+        u8 *buf;
+        int ret, pos = 0;
+        u16 cpu_cs_register = cypress[type].cpu_cs_register;
 
-        hx = kmalloc(sizeof(*hx), GFP_KERNEL);
-        if (!hx)
+        buf = kmalloc(sizeof(*hx), GFP_KERNEL);
+        if (!buf)
                 return -ENOMEM;
+        hx = (struct hexline *)buf;
 
         /* stop the CPU */
-        reset = 1;
-        if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
+        buf[0] = 1;
+        if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
                 err("could not stop the USB controller CPU.");
 
         while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
@@ -61,21 +63,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw
         }
         if (ret < 0) {
                 err("firmware download failed at %d with %d",pos,ret);
-                kfree(hx);
+                kfree(buf);
                 return ret;
         }
 
         if (ret == 0) {
                 /* restart the CPU */
-                reset = 0;
-                if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
+                buf[0] = 0;
+                if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
                         err("could not restart the USB controller CPU.");
                         ret = -EINVAL;
                 }
         } else
                 ret = -EIO;
 
-        kfree(hx);
+        kfree(buf);
 
         return ret;
 }
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 5457c361ad58..bf0fe0137dfe 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1947,9 +1947,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev,
         if (!of_property_read_u32(child, "dma-channel", &val))
                 gpmc_onenand_data->dma_channel = val;
 
-        gpmc_onenand_init(gpmc_onenand_data);
-
-        return 0;
+        return gpmc_onenand_init(gpmc_onenand_data);
 }
 #else
 static int gpmc_probe_onenand_child(struct platform_device *pdev,
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 91f645992c94..b27ea98b781f 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1792,15 +1792,14 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
 
         /* If we're permanently dead, give up. */
         if (state == pci_channel_io_perm_failure) {
-                /* Tell the AFU drivers; but we don't care what they
-                 * say, we're going away.
-                 */
                 for (i = 0; i < adapter->slices; i++) {
                         afu = adapter->afu[i];
-                        /* Only participate in EEH if we are on a virtual PHB */
-                        if (afu->phb == NULL)
-                                return PCI_ERS_RESULT_NONE;
-                        cxl_vphb_error_detected(afu, state);
+                        /*
+                         * Tell the AFU drivers; but we don't care what they
+                         * say, we're going away.
+                         */
+                        if (afu->phb != NULL)
+                                cxl_vphb_error_detected(afu, state);
                 }
                 return PCI_ERS_RESULT_DISCONNECT;
         }
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index 3600c9993a98..29f2daed37e0 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -112,11 +112,9 @@ struct mkhi_msg {
 
 static int mei_osver(struct mei_cl_device *cldev)
 {
-        int ret;
         const size_t size = sizeof(struct mkhi_msg_hdr) +
                             sizeof(struct mkhi_fwcaps) +
                             sizeof(struct mei_os_ver);
-        size_t length = 8;
         char buf[size];
         struct mkhi_msg *req;
         struct mkhi_fwcaps *fwcaps;
@@ -137,15 +135,7 @@ static int mei_osver(struct mei_cl_device *cldev)
         os_ver = (struct mei_os_ver *)fwcaps->data;
         os_ver->os_type = OSTYPE_LINUX;
 
-        ret = __mei_cl_send(cldev->cl, buf, size, mode);
-        if (ret < 0)
-                return ret;
-
-        ret = __mei_cl_recv(cldev->cl, buf, length, 0);
-        if (ret < 0)
-                return ret;
-
-        return 0;
+        return __mei_cl_send(cldev->cl, buf, size, mode);
 }
 
 static void mei_mkhi_fix(struct mei_cl_device *cldev)
@@ -160,7 +150,7 @@ static void mei_mkhi_fix(struct mei_cl_device *cldev)
                 return;
 
         ret = mei_osver(cldev);
-        if (ret)
+        if (ret < 0)
                 dev_err(&cldev->dev, "OS version command failed %d\n", ret);
 
         mei_cldev_disable(cldev);
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index cfb1cdf176fa..13c55b8f9261 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -124,8 +124,6 @@ int mei_reset(struct mei_device *dev)
 
         mei_clear_interrupts(dev);
 
-        mei_synchronize_irq(dev);
-
         /* we're already in reset, cancel the init timer
          * if the reset was called due the hbm protocol error
          * we need to call it before hw start
@@ -304,6 +302,9 @@ static void mei_reset_work(struct work_struct *work)
                 container_of(work, struct mei_device,  reset_work);
         int ret;
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         ret = mei_reset(dev);
@@ -328,6 +329,9 @@ void mei_stop(struct mei_device *dev)
 
         mei_cancel_work(dev);
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         dev->dev_state = MEI_DEV_POWER_DOWN;
diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index 9d659542a335..dad5abee656e 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -566,10 +566,10 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
          */
         error = pci_alloc_irq_vectors(pdev, VMCI_MAX_INTRS, VMCI_MAX_INTRS,
                         PCI_IRQ_MSIX);
-        if (error) {
+        if (error < 0) {
                 error = pci_alloc_irq_vectors(pdev, 1, 1,
                                 PCI_IRQ_MSIX | PCI_IRQ_MSI | PCI_IRQ_LEGACY);
-                if (error)
+                if (error < 0)
                         goto err_remove_bitmap;
         } else {
                 vmci_dev->exclusive_vectors = true;
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 1621fa08e206..ff3da960c473 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1560,11 +1560,8 @@ static bool mmc_blk_rw_cmd_err(struct mmc_blk_data *md, struct mmc_card *card,
                                struct mmc_blk_request *brq, struct request *req,
                                bool old_req_pending)
 {
-        struct mmc_queue_req *mq_rq;
         bool req_pending;
 
-        mq_rq = container_of(brq, struct mmc_queue_req, brq);
-
         /*
          * If this is an SD card and we're writing, we can first
          * mark the known good sectors as ok.
@@ -1701,7 +1698,8 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 case MMC_BLK_CMD_ERR:
                         req_pending = mmc_blk_rw_cmd_err(md, card, brq, old_req, req_pending);
                         if (mmc_blk_reset(md, card->host, type)) {
-                                mmc_blk_rw_cmd_abort(card, old_req);
+                                if (req_pending)
+                                        mmc_blk_rw_cmd_abort(card, old_req);
                                 mmc_blk_rw_try_restart(mq, new_req);
                                 return;
                         }
@@ -1817,6 +1815,7 @@ void mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 mmc_blk_issue_flush(mq, req);
         } else {
                 mmc_blk_issue_rw_rq(mq, req);
+                card->host->context_info.is_waiting_last_req = false;
         }
 
 out:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 7fd722868875..b502601df228 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1730,7 +1730,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                 err = mmc_select_hs400(card);
                 if (err)
                         goto free_card;
-        } else {
+        } else if (!mmc_card_hs400es(card)) {
                 /* Select the desired bus width optionally */
                 err = mmc_select_bus_width(card);
                 if (err > 0 && mmc_card_hs(card)) {
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index e992a7f8a16f..2b32b88949ba 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -267,7 +267,7 @@ static void sdio_release_func(struct device *dev)
         sdio_free_func_cis(func);
 
         kfree(func->info);
-
+        kfree(func->tmpbuf);
         kfree(func);
 }
 
@@ -282,6 +282,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
         if (!func)
                 return ERR_PTR(-ENOMEM);
 
+        /*
+         * allocate buffer separately to make sure it's properly aligned for
+         * DMA usage (incl. 64 bit DMA)
+         */
+        func->tmpbuf = kmalloc(4, GFP_KERNEL);
+        if (!func->tmpbuf) {
+                kfree(func);
+                return ERR_PTR(-ENOMEM);
+        }
+
         func->card = card;
 
         device_initialize(&func->dev);
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index a9ac0b457313..8718432751c5 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -22,6 +22,7 @@
 #include <linux/ioport.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/stat.h>
@@ -1621,10 +1622,16 @@ static void dw_mci_init_card(struct mmc_host *mmc, struct mmc_card *card)
 
                 if (card->type == MMC_TYPE_SDIO ||
                     card->type == MMC_TYPE_SD_COMBO) {
-                        set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (!test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_get_noresume(mmc->parent);
+                                set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                         clk_en_a = clk_en_a_old & ~clken_low_pwr;
                 } else {
-                        clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_put_noidle(mmc->parent);
+                                clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                         clk_en_a = clk_en_a_old | clken_low_pwr;
                 }
 
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8e32580c12b5..b235d8da0602 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -580,7 +580,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
                 }
         }
         sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV,
-                        (mode << 8) | (div % 0xff));
+                      (mode << 8) | div);
         sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
         while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
                 cpu_relax();
@@ -1559,7 +1559,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
         host->src_clk_freq = clk_get_rate(host->src_clk);
         /* Set host parameters to mmc */
         mmc->ops = &mt_msdc_ops;
-        mmc->f_min = host->src_clk_freq / (4 * 255);
+        mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255);
 
         mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23;
         /* MMC core transfer sizes tunable parameters */
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 7123ef96ed18..445fc47dc3e7 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -830,6 +830,7 @@ static int esdhc_change_pinstate(struct sdhci_host *host,
 
         switch (uhs) {
         case MMC_TIMING_UHS_SDR50:
+        case MMC_TIMING_UHS_DDR50:
                 pinctrl = imx_data->pins_100mhz;
                 break;
         case MMC_TIMING_UHS_SDR104:
diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 410a55b1c25f..1cfd7f900339 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -28,13 +28,9 @@
 #include "sdhci-pltfm.h"
 #include <linux/of.h>
 
-#define SDHCI_ARASAN_CLK_CTRL_OFFSET    0x2c
 #define SDHCI_ARASAN_VENDOR_REGISTER    0x78
 
 #define VENDOR_ENHANCED_STROBE          BIT(0)
-#define CLK_CTRL_TIMEOUT_SHIFT          16
-#define CLK_CTRL_TIMEOUT_MASK           (0xf << CLK_CTRL_TIMEOUT_SHIFT)
-#define CLK_CTRL_TIMEOUT_MIN_EXP        13
 
 #define PHY_CLK_TOO_SLOW_HZ             400000
 
@@ -163,15 +159,15 @@ static int sdhci_arasan_syscon_write(struct sdhci_host *host,
 
 static unsigned int sdhci_arasan_get_timeout_clock(struct sdhci_host *host)
 {
-        u32 div;
         unsigned long freq;
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        div = readl(host->ioaddr + SDHCI_ARASAN_CLK_CTRL_OFFSET);
-        div = (div & CLK_CTRL_TIMEOUT_MASK) >> CLK_CTRL_TIMEOUT_SHIFT;
+        /* SDHCI timeout clock is in kHz */
+        freq = DIV_ROUND_UP(clk_get_rate(pltfm_host->clk), 1000);
 
-        freq = clk_get_rate(pltfm_host->clk);
-        freq /= 1 << (CLK_CTRL_TIMEOUT_MIN_EXP + div);
+        /* or in MHz */
+        if (host->caps & SDHCI_TIMEOUT_CLK_UNIT)
+                freq = DIV_ROUND_UP(freq, 1000);
 
         return freq;
 }
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 2f9ad213377a..d5430ed02a67 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -29,6 +29,8 @@
 
 #include "sdhci-pltfm.h"
 
+#define SDMMC_MC1R      0x204
+#define         SDMMC_MC1R_DDR          BIT(3)
 #define SDMMC_CACR      0x230
 #define         SDMMC_CACR_CAPWREN      BIT(0)
 #define         SDMMC_CACR_KEY          (0x46 << 8)
@@ -85,11 +87,37 @@ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
         sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
 }
 
+/*
+ * In this specific implementation of the SDHCI controller, the power register
+ * needs to have a valid voltage set even when the power supply is managed by
+ * an external regulator.
+ */
+static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode,
+                     unsigned short vdd)
+{
+        if (!IS_ERR(host->mmc->supply.vmmc)) {
+                struct mmc_host *mmc = host->mmc;
+
+                spin_unlock_irq(&host->lock);
+                mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+                spin_lock_irq(&host->lock);
+        }
+        sdhci_set_power_noreg(host, mode, vdd);
+}
+
+void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
+{
+        if (timing == MMC_TIMING_MMC_DDR52)
+                sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R);
+        sdhci_set_uhs_signaling(host, timing);
+}
+
 static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
         .set_clock              = sdhci_at91_set_clock,
         .set_bus_width          = sdhci_set_bus_width,
         .reset                  = sdhci_reset,
-        .set_uhs_signaling      = sdhci_set_uhs_signaling,
+        .set_uhs_signaling      = sdhci_at91_set_uhs_signaling,
+        .set_power              = sdhci_at91_set_power,
 };
 
 static const struct sdhci_pltfm_data soc_data_sama5d2 = {
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 982b3e349426..86560d590786 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -451,6 +451,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
         if (mode == MMC_POWER_OFF)
                 return;
 
+        spin_unlock_irq(&host->lock);
+
         /*
          * Bus power might not enable after D3 -> D0 transition due to the
          * present state not yet having propagated. Retry for up to 2ms.
@@ -463,6 +465,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
                 reg |= SDHCI_POWER_ON;
                 sdhci_writeb(host, reg, SDHCI_POWER_CONTROL);
         }
+
+        spin_lock_irq(&host->lock);
 }
 
 static const struct sdhci_ops sdhci_intel_byt_ops = {
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6fdd7a70f229..63bc33a54d0d 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1362,7 +1362,9 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
                         return;
                 }
                 timeout--;
-                mdelay(1);
+                spin_unlock_irq(&host->lock);
+                usleep_range(900, 1100);
+                spin_lock_irq(&host->lock);
         }
 
         clk |= SDHCI_CLOCK_CARD_EN;
@@ -1828,6 +1830,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
         struct sdhci_host *host = mmc_priv(mmc);
         unsigned long flags;
 
+        if (enable)
+                pm_runtime_get_noresume(host->mmc->parent);
+
         spin_lock_irqsave(&host->lock, flags);
         if (enable)
                 host->flags |= SDHCI_SDIO_IRQ_ENABLED;
@@ -1836,6 +1841,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
 
         sdhci_enable_sdio_irq_nolock(host, enable);
         spin_unlock_irqrestore(&host->lock, flags);
+
+        if (!enable)
+                pm_runtime_put_noidle(host->mmc->parent);
 }
 
 static int sdhci_start_signal_voltage_switch(struct mmc_host *mmc,
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index d2c386f09d69..1d843357422e 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -426,6 +426,9 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct ushc_data *ushc;
         int ret;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
         if (mmc == NULL)
                 return -ENOMEM;
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 0134ba32a057..39712560b4c1 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -148,11 +148,11 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                         return err;
         }
 
-        if (bytes == 0) {
-                err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
-                if (err)
-                        return err;
+        err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
+        if (err)
+                return err;
 
+        if (bytes == 0) {
                 err = clear_update_marker(ubi, vol, 0);
                 if (err)
                         return err;
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 138f5ae75c0b..4d1fe8d95042 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -557,7 +557,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
         int work_done = 0;
 
         u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
-        u32 rxstcmd = readl(priv->base + IFI_CANFD_STCMD);
+        u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
         u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
 
         /* Handle bus state changes */
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index caed4e6960f8..11662f479e76 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -826,8 +826,7 @@ static int rcar_can_probe(struct platform_device *pdev)
 
         devm_can_led_init(ndev);
 
-        dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
-                 priv->regs, ndev->irq);
+        dev_info(&pdev->dev, "device registered (IRQ%d)\n", ndev->irq);
 
         return 0;
 fail_candev:
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 8a280e7d66bd..127adbeefb10 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -984,29 +984,29 @@
 #define XP_ECC_CNT1_DESC_DED_WIDTH              8
 #define XP_ECC_CNT1_DESC_SEC_INDEX              0
 #define XP_ECC_CNT1_DESC_SEC_WIDTH              8
-#define XP_ECC_IER_DESC_DED_INDEX               0
+#define XP_ECC_IER_DESC_DED_INDEX               5
 #define XP_ECC_IER_DESC_DED_WIDTH               1
-#define XP_ECC_IER_DESC_SEC_INDEX               1
+#define XP_ECC_IER_DESC_SEC_INDEX               4
 #define XP_ECC_IER_DESC_SEC_WIDTH               1
-#define XP_ECC_IER_RX_DED_INDEX                 2
+#define XP_ECC_IER_RX_DED_INDEX                 3
 #define XP_ECC_IER_RX_DED_WIDTH                 1
-#define XP_ECC_IER_RX_SEC_INDEX                 3
+#define XP_ECC_IER_RX_SEC_INDEX                 2
 #define XP_ECC_IER_RX_SEC_WIDTH                 1
-#define XP_ECC_IER_TX_DED_INDEX                 4
+#define XP_ECC_IER_TX_DED_INDEX                 1
 #define XP_ECC_IER_TX_DED_WIDTH                 1
-#define XP_ECC_IER_TX_SEC_INDEX                 5
+#define XP_ECC_IER_TX_SEC_INDEX                 0
 #define XP_ECC_IER_TX_SEC_WIDTH                 1
-#define XP_ECC_ISR_DESC_DED_INDEX               0
+#define XP_ECC_ISR_DESC_DED_INDEX               5
 #define XP_ECC_ISR_DESC_DED_WIDTH               1
-#define XP_ECC_ISR_DESC_SEC_INDEX               1
+#define XP_ECC_ISR_DESC_SEC_INDEX               4
 #define XP_ECC_ISR_DESC_SEC_WIDTH               1
-#define XP_ECC_ISR_RX_DED_INDEX                 2
+#define XP_ECC_ISR_RX_DED_INDEX                 3
 #define XP_ECC_ISR_RX_DED_WIDTH                 1
-#define XP_ECC_ISR_RX_SEC_INDEX                 3
+#define XP_ECC_ISR_RX_SEC_INDEX                 2
 #define XP_ECC_ISR_RX_SEC_WIDTH                 1
-#define XP_ECC_ISR_TX_DED_INDEX                 4
+#define XP_ECC_ISR_TX_DED_INDEX                 1
 #define XP_ECC_ISR_TX_DED_WIDTH                 1
-#define XP_ECC_ISR_TX_SEC_INDEX                 5
+#define XP_ECC_ISR_TX_SEC_INDEX                 0
 #define XP_ECC_ISR_TX_SEC_WIDTH                 1
 #define XP_I2C_MUTEX_BUSY_INDEX                 31
 #define XP_I2C_MUTEX_BUSY_WIDTH                 1
@@ -1148,8 +1148,8 @@
 #define RX_PACKET_ATTRIBUTES_CSUM_DONE_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_INDEX    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_WIDTH    1
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_INDEX   2
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_WIDTH   1
+#define RX_PACKET_ATTRIBUTES_LAST_INDEX         2
+#define RX_PACKET_ATTRIBUTES_LAST_WIDTH         1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_INDEX 3
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_WIDTH 1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_INDEX      4
@@ -1158,6 +1158,8 @@
 #define RX_PACKET_ATTRIBUTES_RX_TSTAMP_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_INDEX     6
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_WIDTH     1
+#define RX_PACKET_ATTRIBUTES_FIRST_INDEX        7
+#define RX_PACKET_ATTRIBUTES_FIRST_WIDTH        1
 
 #define RX_NORMAL_DESC0_OVT_INDEX               0
 #define RX_NORMAL_DESC0_OVT_WIDTH               16
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 937f37a5dcb2..24a687ce4388 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1896,10 +1896,15 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
 
         /* Get the header length */
         if (XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, FD)) {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 1);
                 rdata->rx.hdr_len = XGMAC_GET_BITS_LE(rdesc->desc2,
                                                       RX_NORMAL_DESC2, HL);
                 if (rdata->rx.hdr_len)
                         pdata->ext_stats.rx_split_header_packets++;
+        } else {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 0);
         }
 
         /* Get the RSS hash */
@@ -1922,19 +1927,16 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
                 }
         }
 
-        /* Get the packet length */
-        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
-
-        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) {
-                /* Not all the data has been transferred for this packet */
-                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                               INCOMPLETE, 1);
+        /* Not all the data has been transferred for this packet */
+        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD))
                 return 0;
-        }
 
         /* This is the last of the data for this packet */
         XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                       INCOMPLETE, 0);
+                       LAST, 1);
+
+        /* Get the packet length */
+        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
 
         /* Set checksum done indicator as appropriate */
         if (netdev->features & NETIF_F_RXCSUM)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index ffea9859f5a7..a713abd9d03e 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1971,13 +1971,12 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 {
         struct sk_buff *skb;
         u8 *packet;
-        unsigned int copy_len;
 
         skb = napi_alloc_skb(napi, rdata->rx.hdr.dma_len);
         if (!skb)
                 return NULL;
 
-        /* Start with the header buffer which may contain just the header
+        /* Pull in the header buffer which may contain just the header
          * or the header plus data
          */
         dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
@@ -1986,30 +1985,49 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 
         packet = page_address(rdata->rx.hdr.pa.pages) +
                  rdata->rx.hdr.pa.pages_offset;
-        copy_len = (rdata->rx.hdr_len) ? rdata->rx.hdr_len : len;
-        copy_len = min(rdata->rx.hdr.dma_len, copy_len);
-        skb_copy_to_linear_data(skb, packet, copy_len);
-        skb_put(skb, copy_len);
-
-        len -= copy_len;
-        if (len) {
-                /* Add the remaining data as a frag */
-                dma_sync_single_range_for_cpu(pdata->dev,
-                                              rdata->rx.buf.dma_base,
-                                              rdata->rx.buf.dma_off,
-                                              rdata->rx.buf.dma_len,
-                                              DMA_FROM_DEVICE);
-
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-                                rdata->rx.buf.pa.pages,
-                                rdata->rx.buf.pa.pages_offset,
-                                len, rdata->rx.buf.dma_len);
-                rdata->rx.buf.pa.pages = NULL;
-        }
+        skb_copy_to_linear_data(skb, packet, len);
+        skb_put(skb, len);
 
         return skb;
 }
 
+static unsigned int xgbe_rx_buf1_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet)
+{
+        /* Always zero if not the first descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, FIRST))
+                return 0;
+
+        /* First descriptor with split header, return header length */
+        if (rdata->rx.hdr_len)
+                return rdata->rx.hdr_len;
+
+        /* First descriptor but not the last descriptor and no split header,
+         * so the full buffer was used
+         */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.hdr.dma_len;
+
+        /* First descriptor and last descriptor and no split header, so
+         * calculate how much of the buffer was used
+         */
+        return min_t(unsigned int, rdata->rx.hdr.dma_len, rdata->rx.len);
+}
+
+static unsigned int xgbe_rx_buf2_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet,
+                                     unsigned int len)
+{
+        /* Always the full buffer if not the last descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.buf.dma_len;
+
+        /* Last descriptor so calculate how much of the buffer was used
+         * for the last bit of data
+         */
+        return rdata->rx.len - len;
+}
+
 static int xgbe_tx_poll(struct xgbe_channel *channel)
 {
         struct xgbe_prv_data *pdata = channel->pdata;
@@ -2092,8 +2110,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct napi_struct *napi;
         struct sk_buff *skb;
         struct skb_shared_hwtstamps *hwtstamps;
-        unsigned int incomplete, error, context_next, context;
-        unsigned int len, rdesc_len, max_len;
+        unsigned int last, error, context_next, context;
+        unsigned int len, buf1_len, buf2_len, max_len;
         unsigned int received = 0;
         int packet_count = 0;
 
@@ -2103,7 +2121,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         if (!ring)
                 return 0;
 
-        incomplete = 0;
+        last = 0;
         context_next = 0;
 
         napi = (pdata->per_channel_irq) ? &channel->napi : &pdata->napi;
@@ -2137,9 +2155,8 @@ read_again:
                 received++;
                 ring->cur++;
 
-                incomplete = XGMAC_GET_BITS(packet->attributes,
-                                            RX_PACKET_ATTRIBUTES,
-                                            INCOMPLETE);
+                last = XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                                      LAST);
                 context_next = XGMAC_GET_BITS(packet->attributes,
                                               RX_PACKET_ATTRIBUTES,
                                               CONTEXT_NEXT);
@@ -2148,7 +2165,7 @@ read_again:
                                          CONTEXT);
 
                 /* Earlier error, just drain the remaining data */
-                if ((incomplete || context_next) && error)
+                if ((!last || context_next) && error)
                         goto read_again;
 
                 if (error || packet->errors) {
@@ -2160,16 +2177,22 @@ read_again:
                 }
 
                 if (!context) {
-                        /* Length is cumulative, get this descriptor's length */
-                        rdesc_len = rdata->rx.len - len;
-                        len += rdesc_len;
+                        /* Get the data length in the descriptor buffers */
+                        buf1_len = xgbe_rx_buf1_len(rdata, packet);
+                        len += buf1_len;
+                        buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
+                        len += buf2_len;
 
-                        if (rdesc_len && !skb) {
+                        if (!skb) {
                                 skb = xgbe_create_skb(pdata, napi, rdata,
-                                                      rdesc_len);
-                                if (!skb)
+                                                      buf1_len);
+                                if (!skb) {
                                         error = 1;
-                        } else if (rdesc_len) {
+                                        goto skip_data;
+                                }
+                        }
+
+                        if (buf2_len) {
                                 dma_sync_single_range_for_cpu(pdata->dev,
                                                         rdata->rx.buf.dma_base,
                                                         rdata->rx.buf.dma_off,
@@ -2179,13 +2202,14 @@ read_again:
                                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                                 rdata->rx.buf.pa.pages,
                                                 rdata->rx.buf.pa.pages_offset,
-                                                rdesc_len,
+                                                buf2_len,
                                                 rdata->rx.buf.dma_len);
                                 rdata->rx.buf.pa.pages = NULL;
                         }
                 }
 
-                if (incomplete || context_next)
+skip_data:
+                if (!last || context_next)
                         goto read_again;
 
                 if (!skb)
@@ -2243,7 +2267,7 @@ next_packet:
         }
 
         /* Check if we need to save state before leaving */
-        if (received && (incomplete || context_next)) {
+        if (received && (!last || context_next)) {
                 rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
                 rdata->state_saved = 1;
                 rdata->state.skb = skb;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index dad63623be6a..5d6c40d86775 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -98,11 +98,7 @@ static int aq_ndev_change_mtu(struct net_device *ndev, int new_mtu)
 
         if (err < 0)
                 goto err_exit;
-
-        if (netif_running(ndev)) {
-                aq_ndev_close(ndev);
-                aq_ndev_open(ndev);
-        }
+        ndev->mtu = new_mtu;
 
 err_exit:
         return err;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index ee78444bfb88..cdb02991f249 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -487,6 +487,9 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                 dx_buff->mss = skb_shinfo(skb)->gso_size;
                 dx_buff->is_txc = 1U;
 
+                dx_buff->is_ipv6 =
+                        (ip_hdr(skb)->version == 6) ? 1U : 0U;
+
                 dx = aq_ring_next_dx(ring, dx);
                 dx_buff = &ring->buff_ring[dx];
                 ++ret;
@@ -510,10 +513,22 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 dx_buff->is_ip_cso = (htons(ETH_P_IP) == skb->protocol) ?
                         1U : 0U;
-                dx_buff->is_tcp_cso =
-                        (ip_hdr(skb)->protocol == IPPROTO_TCP) ? 1U : 0U;
-                dx_buff->is_udp_cso =
-                        (ip_hdr(skb)->protocol == IPPROTO_UDP) ? 1U : 0U;
+
+                if (ip_hdr(skb)->version == 4) {
+                        dx_buff->is_tcp_cso =
+                                (ip_hdr(skb)->protocol == IPPROTO_TCP) ?
+                                        1U : 0U;
+                        dx_buff->is_udp_cso =
+                                (ip_hdr(skb)->protocol == IPPROTO_UDP) ?
+                                        1U : 0U;
+                } else if (ip_hdr(skb)->version == 6) {
+                        dx_buff->is_tcp_cso =
+                                (ipv6_hdr(skb)->nexthdr == NEXTHDR_TCP) ?
+                                        1U : 0U;
+                        dx_buff->is_udp_cso =
+                                (ipv6_hdr(skb)->nexthdr == NEXTHDR_UDP) ?
+                                        1U : 0U;
+                }
         }
 
         for (; nr_frags--; ++frag_count) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 0358e6072d45..3a8a4aa13687 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -101,6 +101,7 @@ int aq_ring_init(struct aq_ring_s *self)
         self->hw_head = 0;
         self->sw_head = 0;
         self->sw_tail = 0;
+        spin_lock_init(&self->header.lock);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 257254645068..eecd6d1c4d73 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -58,7 +58,8 @@ struct __packed aq_ring_buff_s {
                         u8 len_l2;
                         u8 len_l3;
                         u8 len_l4;
-                        u8 rsvd2;
+                        u8 is_ipv6:1;
+                        u8 rsvd2:7;
                         u32 len_pkt;
                 };
         };
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index a2b746a2dd50..4ee15ff06a44 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -433,6 +433,9 @@ static int hw_atl_a0_hw_ring_tx_xmit(struct aq_hw_s *self,
                                     buff->len_l3 +
                                     buff->len_l2);
                         is_gso = true;
+
+                        if (buff->is_ipv6)
+                                txd->ctl |= HW_ATL_A0_TXD_CTL_CMD_IPV6;
                 } else {
                         buff_pa_len = buff->len;
 
@@ -458,6 +461,7 @@ static int hw_atl_a0_hw_ring_tx_xmit(struct aq_hw_s *self,
                         if (unlikely(buff->is_eop)) {
                                 txd->ctl |= HW_ATL_A0_TXD_CTL_EOP;
                                 txd->ctl |= HW_ATL_A0_TXD_CTL_CMD_WB;
+                                is_gso = false;
                         }
                 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
index 1093ea18823a..0592a0330cf0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
@@ -137,6 +137,7 @@ static struct aq_hw_caps_s hw_atl_a0_hw_caps_ = {
         .tx_rings = HW_ATL_A0_TX_RINGS,
         .rx_rings = HW_ATL_A0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO,
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index cab2931dab9a..42150708191d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -471,6 +471,9 @@ static int hw_atl_b0_hw_ring_tx_xmit(struct aq_hw_s *self,
                                     buff->len_l3 +
                                     buff->len_l2);
                         is_gso = true;
+
+                        if (buff->is_ipv6)
+                                txd->ctl |= HW_ATL_B0_TXD_CTL_CMD_IPV6;
                 } else {
                         buff_pa_len = buff->len;
 
@@ -496,6 +499,7 @@ static int hw_atl_b0_hw_ring_tx_xmit(struct aq_hw_s *self,
                         if (unlikely(buff->is_eop)) {
                                 txd->ctl |= HW_ATL_B0_TXD_CTL_EOP;
                                 txd->ctl |= HW_ATL_B0_TXD_CTL_CMD_WB;
+                                is_gso = false;
                         }
                 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index 8bdee3ddd5a0..f3957e930340 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -188,6 +188,7 @@ static struct aq_hw_caps_s hw_atl_b0_hw_caps_ = {
         .tx_rings = HW_ATL_B0_TX_RINGS,
         .rx_rings = HW_ATL_B0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 0a23034bbe3f..352beff796ae 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -2277,7 +2277,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  GENERAL_ATTEN_OFFSET(LATCHED_ATTN_RBCP) | \
                                  GENERAL_ATTEN_OFFSET(LATCHED_ATTN_RSVD_GRC))
 
-#define HW_INTERRUT_ASSERT_SET_0 \
+#define HW_INTERRUPT_ASSERT_SET_0 \
                                 (AEU_INPUTS_ATTN_BITS_TSDM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TCM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TSEMI_HW_INTERRUPT | \
@@ -2290,7 +2290,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR)
-#define HW_INTERRUT_ASSERT_SET_1 \
+#define HW_INTERRUPT_ASSERT_SET_1 \
                                 (AEU_INPUTS_ATTN_BITS_QM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TIMERS_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_XSDM_HW_INTERRUPT | \
@@ -2318,7 +2318,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  AEU_INPUTS_ATTN_BITS_UPB_PARITY_ERROR | \
                                  AEU_INPUTS_ATTN_BITS_CSDM_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_CCM_PARITY_ERROR)
-#define HW_INTERRUT_ASSERT_SET_2 \
+#define HW_INTERRUPT_ASSERT_SET_2 \
                                 (AEU_INPUTS_ATTN_BITS_CSEMI_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_CDU_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_DMAE_HW_INTERRUPT | \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index ac76fc251d26..a851f95c307a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4166,14 +4166,14 @@ static void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
                 bnx2x_release_phy_lock(bp);
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_0) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_0) {
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_0);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_0);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set0 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_0));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_0));
                 bnx2x_panic();
         }
 }
@@ -4191,7 +4191,7 @@ static void bnx2x_attn_int_deasserted1(struct bnx2x *bp, u32 attn)
                         BNX2X_ERR("FATAL error from DORQ\n");
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_1) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_1) {
 
                 int port = BP_PORT(bp);
                 int reg_offset;
@@ -4200,11 +4200,11 @@ static void bnx2x_attn_int_deasserted1(struct bnx2x *bp, u32 attn)
                                      MISC_REG_AEU_ENABLE1_FUNC_0_OUT_1);
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_1);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_1);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set1 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_1));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_1));
                 bnx2x_panic();
         }
 }
@@ -4235,7 +4235,7 @@ static void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
                 }
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_2) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_2) {
 
                 int port = BP_PORT(bp);
                 int reg_offset;
@@ -4244,11 +4244,11 @@ static void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
                                      MISC_REG_AEU_ENABLE1_FUNC_0_OUT_2);
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_2);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_2);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set2 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_2));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_2));
                 bnx2x_panic();
         }
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 32de4589d16a..1f1e54ba0ecb 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1983,20 +1983,25 @@ static void bnxt_free_rx_skbs(struct bnxt *bp)
 
                 for (j = 0; j < max_idx; j++) {
                         struct bnxt_sw_rx_bd *rx_buf = &rxr->rx_buf_ring[j];
+                        dma_addr_t mapping = rx_buf->mapping;
                         void *data = rx_buf->data;
 
                         if (!data)
                                 continue;
 
-                        dma_unmap_single(&pdev->dev, rx_buf->mapping,
-                                         bp->rx_buf_use_size, bp->rx_dir);
-
                         rx_buf->data = NULL;
 
-                        if (BNXT_RX_PAGE_MODE(bp))
+                        if (BNXT_RX_PAGE_MODE(bp)) {
+                                mapping -= bp->rx_dma_offset;
+                                dma_unmap_page(&pdev->dev, mapping,
+                                               PAGE_SIZE, bp->rx_dir);
                                 __free_page(data);
-                        else
+                        } else {
+                                dma_unmap_single(&pdev->dev, mapping,
+                                                 bp->rx_buf_use_size,
+                                                 bp->rx_dir);
                                 kfree(data);
+                        }
                 }
 
                 for (j = 0; j < max_agg_idx; j++) {
@@ -2455,6 +2460,18 @@ static int bnxt_init_one_rx_ring(struct bnxt *bp, int ring_nr)
         return 0;
 }
 
+static void bnxt_init_cp_rings(struct bnxt *bp)
+{
+        int i;
+
+        for (i = 0; i < bp->cp_nr_rings; i++) {
+                struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+                struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
+
+                ring->fw_ring_id = INVALID_HW_RING_ID;
+        }
+}
+
 static int bnxt_init_rx_rings(struct bnxt *bp)
 {
         int i, rc = 0;
@@ -4732,7 +4749,7 @@ static int bnxt_set_tpa(struct bnxt *bp, bool set_tpa)
                 rc = bnxt_hwrm_vnic_set_tpa(bp, i, tpa_flags);
                 if (rc) {
                         netdev_err(bp->dev, "hwrm vnic set tpa failure rc for vnic %d: %x\n",
-                                   rc, i);
+                                   i, rc);
                         return rc;
                 }
         }
@@ -5006,6 +5023,7 @@ static int bnxt_shutdown_nic(struct bnxt *bp, bool irq_re_init)
 
 static int bnxt_init_nic(struct bnxt *bp, bool irq_re_init)
 {
+        bnxt_init_cp_rings(bp);
         bnxt_init_rx_rings(bp);
         bnxt_init_tx_rings(bp);
         bnxt_init_ring_grps(bp, irq_re_init);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 69015fa50f20..365895ed3c3e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3481,7 +3481,8 @@ static int bcmgenet_suspend(struct device *d)
 
         bcmgenet_netif_stop(dev);
 
-        phy_suspend(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_suspend(priv->phydev);
 
         netif_device_detach(dev);
 
@@ -3578,7 +3579,8 @@ static int bcmgenet_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        phy_resume(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_resume(priv->phydev);
 
         if (priv->eee.eee_enabled)
                 bcmgenet_eee_enable_set(dev, true);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index e87607621e62..2f9281936f0e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -220,20 +220,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
         udelay(60);
 }
 
-static void bcmgenet_internal_phy_setup(struct net_device *dev)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        u32 reg;
-
-        /* Power up PHY */
-        bcmgenet_phy_power_set(dev, true);
-        /* enable APD */
-        reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-        reg |= EXT_PWR_DN_EN_LD;
-        bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-        bcmgenet_mii_reset(dev);
-}
-
 static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
 {
         u32 reg;
@@ -281,7 +267,6 @@ int bcmgenet_mii_config(struct net_device *dev)
 
                 if (priv->internal_phy) {
                         phy_name = "internal PHY";
-                        bcmgenet_internal_phy_setup(dev);
                 } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
                         phy_name = "MoCA";
                         bcmgenet_moca_phy_setup(priv);
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 9e59663a6ead..0f6811860ad5 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1930,13 +1930,13 @@ static void
 bfa_ioc_send_enable(struct bfa_ioc *ioc)
 {
         struct bfi_ioc_ctrl_req enable_req;
-        struct timeval tv;
 
         bfi_h2i_set(enable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_ENABLE_REQ,
                     bfa_ioc_portid(ioc));
         enable_req.clscode = htons(ioc->clscode);
-        do_gettimeofday(&tv);
-        enable_req.tv_sec = ntohl(tv.tv_sec);
+        enable_req.rsvd = htons(0);
+        /* overflow in 2106 */
+        enable_req.tv_sec = ntohl(ktime_get_real_seconds());
         bfa_ioc_mbox_send(ioc, &enable_req, sizeof(struct bfi_ioc_ctrl_req));
 }
 
@@ -1947,6 +1947,10 @@ bfa_ioc_send_disable(struct bfa_ioc *ioc)
 
         bfi_h2i_set(disable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_DISABLE_REQ,
                     bfa_ioc_portid(ioc));
+        disable_req.clscode = htons(ioc->clscode);
+        disable_req.rsvd = htons(0);
+        /* overflow in 2106 */
+        disable_req.tv_sec = ntohl(ktime_get_real_seconds());
         bfa_ioc_mbox_send(ioc, &disable_req, sizeof(struct bfi_ioc_ctrl_req));
 }
 
diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index 05c1c1dd7751..cebfe3bd086e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -325,7 +325,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
                 return PTR_ERR(kern_buf);
 
         rc = sscanf(kern_buf, "%x:%x", &addr, &len);
-        if (rc < 2) {
+        if (rc < 2 || len > UINT_MAX >> 2) {
                 netdev_warn(bnad->netdev, "failed to read user buffer\n");
                 kfree(kern_buf);
                 return -EINVAL;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 64a1095e4d14..a0ca68ce3fbb 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -134,6 +134,7 @@ static void set_max_bgx_per_node(struct pci_dev *pdev)
         pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &sdevid);
         switch (sdevid) {
         case PCI_SUBSYS_DEVID_81XX_BGX:
+        case PCI_SUBSYS_DEVID_81XX_RGX:
                 max_bgx_per_node = MAX_BGX_PER_CN81XX;
                 break;
         case PCI_SUBSYS_DEVID_83XX_BGX:
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index c5080f2cead5..6b7fe6fdd13b 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -16,6 +16,7 @@
 /* Subsystem device IDs */
 #define PCI_SUBSYS_DEVID_88XX_BGX               0xA126
 #define PCI_SUBSYS_DEVID_81XX_BGX               0xA226
+#define PCI_SUBSYS_DEVID_81XX_RGX               0xA254
 #define PCI_SUBSYS_DEVID_83XX_BGX               0xA326
 
 #define    MAX_BGX_THUNDER                      8 /* Max 2 nodes, 4 per node */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 30e855004c57..02dd5246dfae 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -4939,8 +4939,9 @@ static int
 __be_cmd_set_logical_link_config(struct be_adapter *adapter,
                                  int link_state, int version, u8 domain)
 {
-        struct be_mcc_wrb *wrb;
         struct be_cmd_req_set_ll_link *req;
+        struct be_mcc_wrb *wrb;
+        u32 link_config = 0;
         int status;
 
         mutex_lock(&adapter->mcc_lock);
@@ -4962,10 +4963,12 @@ __be_cmd_set_logical_link_config(struct be_adapter *adapter,
 
         if (link_state == IFLA_VF_LINK_STATE_ENABLE ||
             link_state == IFLA_VF_LINK_STATE_AUTO)
-                req->link_config |= PLINK_ENABLE;
+                link_config |= PLINK_ENABLE;
 
         if (link_state == IFLA_VF_LINK_STATE_AUTO)
-                req->link_config |= PLINK_TRACK;
+                link_config |= PLINK_TRACK;
+
+        req->link_config = cpu_to_le32(link_config);
 
         status = be_mcc_notify_wait(adapter);
 err:
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 992ebe973d25..f819843e2bae 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -189,11 +189,9 @@ static int nps_enet_poll(struct napi_struct *napi, int budget)
 
         nps_enet_tx_handler(ndev);
         work_done = nps_enet_rx_handler(ndev);
-        if (work_done < budget) {
+        if ((work_done < budget) && napi_complete_done(napi, work_done)) {
                 u32 buf_int_enable_value = 0;
 
-                napi_complete_done(napi, work_done);
-
                 /* set tx_done and rx_rdy bits */
                 buf_int_enable_value |= NPS_ENET_ENABLE << RX_RDY_SHIFT;
                 buf_int_enable_value |= NPS_ENET_ENABLE << TX_DONE_SHIFT;
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 928b0df2b8e0..ade6b3e4ed13 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -28,8 +28,10 @@
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
+#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
+#include <linux/property.h>
 #include <net/ip.h>
 #include <net/ncsi.h>
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index 3239d27143b9..bdd8cdd732fb 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -82,9 +82,12 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status)
         else
                 *link_status = 0;
 
-        ret = mac_cb->dsaf_dev->misc_op->get_sfp_prsnt(mac_cb, &sfp_prsnt);
-        if (!ret)
-                *link_status = *link_status && sfp_prsnt;
+        if (mac_cb->media_type == HNAE_MEDIA_TYPE_FIBER) {
+                ret = mac_cb->dsaf_dev->misc_op->get_sfp_prsnt(mac_cb,
+                                                               &sfp_prsnt);
+                if (!ret)
+                        *link_status = *link_status && sfp_prsnt;
+        }
 
         mac_cb->link = *link_status;
 }
@@ -855,7 +858,7 @@ static int  hns_mac_get_info(struct hns_mac_cb *mac_cb)
                 of_node_put(np);
 
                 np = of_parse_phandle(to_of_node(mac_cb->fw_port),
-                                        "serdes-syscon", 0);
+                                      "serdes-syscon", 0);
                 syscon = syscon_node_to_regmap(np);
                 of_node_put(np);
                 if (IS_ERR_OR_NULL(syscon)) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 90dbda792614..403ea9db6dbd 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1519,6 +1519,7 @@ static void hns_dsaf_set_mac_key(
         mac_key->high.bits.mac_3 = addr[3];
         mac_key->low.bits.mac_4 = addr[4];
         mac_key->low.bits.mac_5 = addr[5];
+        mac_key->low.bits.port_vlan = 0;
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_VLAN_M,
                        DSAF_TBL_TCAM_KEY_VLAN_S, vlan_id);
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_PORT_M,
@@ -2924,10 +2925,11 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
         /* find the tcam entry index for promisc */
         entry_index = dsaf_promisc_tcam_entry(port);
 
+        memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
+        memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
+
         /* config key mask */
         if (enable) {
-                memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
-                memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
                 dsaf_set_field(tbl_tcam_data.low.bits.port_vlan,
                                DSAF_TBL_TCAM_KEY_PORT_M,
                                DSAF_TBL_TCAM_KEY_PORT_S, port);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index a2c22d084ce9..e13aa064a8e9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -461,6 +461,32 @@ int hns_mac_get_sfp_prsnt(struct hns_mac_cb *mac_cb, int *sfp_prsnt)
         return 0;
 }
 
+int hns_mac_get_sfp_prsnt_acpi(struct hns_mac_cb *mac_cb, int *sfp_prsnt)
+{
+        union acpi_object *obj;
+        union acpi_object obj_args, argv4;
+
+        obj_args.integer.type = ACPI_TYPE_INTEGER;
+        obj_args.integer.value = mac_cb->mac_id;
+
+        argv4.type = ACPI_TYPE_PACKAGE,
+        argv4.package.count = 1,
+        argv4.package.elements = &obj_args,
+
+        obj = acpi_evaluate_dsm(ACPI_HANDLE(mac_cb->dev),
+                                hns_dsaf_acpi_dsm_uuid, 0,
+                                HNS_OP_GET_SFP_STAT_FUNC, &argv4);
+
+        if (!obj || obj->type != ACPI_TYPE_INTEGER)
+                return -ENODEV;
+
+        *sfp_prsnt = obj->integer.value;
+
+        ACPI_FREE(obj);
+
+        return 0;
+}
+
 /**
  * hns_mac_config_sds_loopback - set loop back for serdes
  * @mac_cb: mac control block
@@ -592,7 +618,7 @@ struct dsaf_misc_op *hns_misc_op_get(struct dsaf_device *dsaf_dev)
                 misc_op->hns_dsaf_roce_srst = hns_dsaf_roce_srst_acpi;
 
                 misc_op->get_phy_if = hns_mac_get_phy_if_acpi;
-                misc_op->get_sfp_prsnt = hns_mac_get_sfp_prsnt;
+                misc_op->get_sfp_prsnt = hns_mac_get_sfp_prsnt_acpi;
 
                 misc_op->cfg_serdes_loopback = hns_mac_config_sds_loopback_acpi;
         } else {
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5f11b4dc95d2..b23d6545f835 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1257,6 +1257,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->tx_scrq[i]);
                         }
+                kfree(adapter->tx_scrq);
                 adapter->tx_scrq = NULL;
         }
 
@@ -1269,6 +1270,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->rx_scrq[i]);
                         }
+                kfree(adapter->rx_scrq);
                 adapter->rx_scrq = NULL;
         }
 }
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 2175cced402f..e9af89ad039c 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6274,8 +6274,8 @@ static int e1000e_pm_freeze(struct device *dev)
                 /* Quiesce the device without resetting the hardware */
                 e1000e_down(adapter, false);
                 e1000_free_irq(adapter);
-                e1000e_reset_interrupt_capability(adapter);
         }
+        e1000e_reset_interrupt_capability(adapter);
 
         /* Allow time for pending master requests to run */
         e1000e_disable_pcie_master(&adapter->hw);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e8a8351c8ea9..82a95cc2c8ee 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4438,8 +4438,12 @@ static void i40e_napi_enable_all(struct i40e_vsi *vsi)
         if (!vsi->netdev)
                 return;
 
-        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_enable(&vsi->q_vectors[q_idx]->napi);
+        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+                struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+                if (q_vector->rx.ring || q_vector->tx.ring)
+                        napi_enable(&q_vector->napi);
+        }
 }
 
 /**
@@ -4453,8 +4457,12 @@ static void i40e_napi_disable_all(struct i40e_vsi *vsi)
         if (!vsi->netdev)
                 return;
 
-        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_disable(&vsi->q_vectors[q_idx]->napi);
+        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+                struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+                if (q_vector->rx.ring || q_vector->tx.ring)
+                        napi_disable(&q_vector->napi);
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 9e757684816d..93949139e62c 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -613,7 +613,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         struct mtk_mac *mac = netdev_priv(dev);
         struct mtk_eth *eth = mac->hw;
         struct mtk_tx_dma *itxd, *txd;
-        struct mtk_tx_buf *tx_buf;
+        struct mtk_tx_buf *itx_buf, *tx_buf;
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
@@ -627,8 +627,8 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
         txd4 |= fport;
 
-        tx_buf = mtk_desc_to_tx_buf(ring, itxd);
-        memset(tx_buf, 0, sizeof(*tx_buf));
+        itx_buf = mtk_desc_to_tx_buf(ring, itxd);
+        memset(itx_buf, 0, sizeof(*itx_buf));
 
         if (gso)
                 txd4 |= TX_DMA_TSO;
@@ -647,9 +647,11 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                 return -ENOMEM;
 
         WRITE_ONCE(itxd->txd1, mapped_addr);
-        tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
-        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
-        dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));
+        itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+        itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+                          MTK_TX_FLAGS_FPORT1;
+        dma_unmap_addr_set(itx_buf, dma_addr0, mapped_addr);
+        dma_unmap_len_set(itx_buf, dma_len0, skb_headlen(skb));
 
         /* TX SG offload */
         txd = itxd;
@@ -685,11 +687,13 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                                                last_frag * TX_DMA_LS0));
                         WRITE_ONCE(txd->txd4, fport);
 
-                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
                         memset(tx_buf, 0, sizeof(*tx_buf));
-
+                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+                        tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+                                         MTK_TX_FLAGS_FPORT1;
+
                         dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
                         dma_unmap_len_set(tx_buf, dma_len0, frag_map_size);
                         frag_size -= frag_map_size;
@@ -698,7 +702,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         }
 
         /* store skb to cleanup */
-        tx_buf->skb = skb;
+        itx_buf->skb = skb;
 
         WRITE_ONCE(itxd->txd4, txd4);
         WRITE_ONCE(itxd->txd3, (TX_DMA_SWC | TX_DMA_PLEN0(skb_headlen(skb)) |
@@ -1012,17 +1016,16 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
 
         while ((cpu != dma) && budget) {
                 u32 next_cpu = desc->txd2;
-                int mac;
+                int mac = 0;
 
                 desc = mtk_qdma_phys_to_virt(ring, desc->txd2);
                 if ((desc->txd3 & TX_DMA_OWNER_CPU) == 0)
                         break;
 
-                mac = (desc->txd4 >> TX_DMA_FPORT_SHIFT) &
-                       TX_DMA_FPORT_MASK;
-                mac--;
-
                 tx_buf = mtk_desc_to_tx_buf(ring, desc);
+                if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+                        mac = 1;
+
                 skb = tx_buf->skb;
                 if (!skb) {
                         condition = 1;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index 99b1c8e9f16f..08285a96ff70 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -406,12 +406,18 @@ struct mtk_hw_stats {
         struct u64_stats_sync   syncp;
 };
 
-/* PDMA descriptor can point at 1-2 segments. This enum allows us to track how
- * memory was allocated so that it can be freed properly
- */
 enum mtk_tx_flags {
+        /* PDMA descriptor can point at 1-2 segments. This enum allows us to
+         * track how memory was allocated so that it can be freed properly.
+         */
         MTK_TX_FLAGS_SINGLE0    = 0x01,
         MTK_TX_FLAGS_PAGE0      = 0x02,
+
+        /* MTK_TX_FLAGS_FPORTx allows tracking which port the transmitted
+         * SKB out instead of looking up through hardware TX descriptor.
+         */
+        MTK_TX_FLAGS_FPORT0     = 0x04,
+        MTK_TX_FLAGS_FPORT1     = 0x08,
 };
 
 /* This enum allows us to identify how the clock is defined on the array of the
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index e8c105164931..0e0fa7030565 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2305,6 +2305,17 @@ static int sync_toggles(struct mlx4_dev *dev)
                 rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read));
                 if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) {
                         /* PCI might be offline */
+
+                        /* If device removal has been requested,
+                         * do not continue retrying.
+                         */
+                        if (dev->persist->interface_state &
+                            MLX4_INTERFACE_STATE_NOWAIT) {
+                                mlx4_warn(dev,
+                                          "communication channel is offline\n");
+                                return -EIO;
+                        }
+
                         msleep(100);
                         wr_toggle = swab32(readl(&priv->mfunc.comm->
                                            slave_write));
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 21377c315083..703205475524 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1940,6 +1940,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev)
                                (u32)(1 << COMM_CHAN_OFFLINE_OFFSET));
                 if (!offline_bit)
                         return 0;
+
+                /* If device removal has been requested,
+                 * do not continue retrying.
+                 */
+                if (dev->persist->interface_state &
+                    MLX4_INTERFACE_STATE_NOWAIT)
+                        break;
+
                 /* There are cases as part of AER/Reset flow that PF needs
                  * around 100 msec to load. We therefore sleep for 100 msec
                  * to allow other tasks to make use of that CPU during this
@@ -3955,6 +3963,9 @@ static void mlx4_remove_one(struct pci_dev *pdev)
         struct devlink *devlink = priv_to_devlink(priv);
         int active_vfs = 0;
 
+        if (mlx4_is_slave(dev))
+                persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT;
+
         mutex_lock(&persist->interface_state_mutex);
         persist->interface_state |= MLX4_INTERFACE_STATE_DELETION;
         mutex_unlock(&persist->interface_state_mutex);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index caa837e5e2b9..a380353a78c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -361,6 +361,8 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
         case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
         case MLX5_CMD_OP_ALLOC_Q_COUNTER:
         case MLX5_CMD_OP_QUERY_Q_COUNTER:
+        case MLX5_CMD_OP_SET_RATE_LIMIT:
+        case MLX5_CMD_OP_QUERY_RATE_LIMIT:
         case MLX5_CMD_OP_ALLOC_PD:
         case MLX5_CMD_OP_ALLOC_UAR:
         case MLX5_CMD_OP_CONFIG_INT_MODERATION:
@@ -497,6 +499,8 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
+        MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
+        MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(ALLOC_PD);
         MLX5_COMMAND_STR_CASE(DEALLOC_PD);
         MLX5_COMMAND_STR_CASE(ALLOC_UAR);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index f6a6ded204f6..dc52053128bc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -928,10 +928,6 @@ void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, struct mlx5e_priv *priv);
 int mlx5e_attach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 void mlx5e_detach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 u32 mlx5e_choose_lro_timeout(struct mlx5_core_dev *mdev, u32 wanted_timeout);
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
 
 int mlx5e_get_offload_stats(int attr_id, const struct net_device *dev,
                             void *sp);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8ef64c4db2c2..66c133757a5e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3100,8 +3100,8 @@ static int mlx5e_get_vf_stats(struct net_device *dev,
                                             vf_stats);
 }
 
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_add_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
@@ -3114,8 +3114,8 @@ void mlx5e_add_vxlan_port(struct net_device *netdev,
         mlx5e_vxlan_queue_work(priv, ti->sa_family, be16_to_cpu(ti->port), 1);
 }
 
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_del_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 2c864574a9d5..f621373bd7a5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -393,8 +393,6 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
         .ndo_get_phys_port_name  = mlx5e_rep_get_phys_port_name,
         .ndo_setup_tc            = mlx5e_rep_ndo_setup_tc,
         .ndo_get_stats64         = mlx5e_rep_get_stats,
-        .ndo_udp_tunnel_add      = mlx5e_add_vxlan_port,
-        .ndo_udp_tunnel_del      = mlx5e_del_vxlan_port,
         .ndo_has_offload_stats   = mlx5e_has_offload_stats,
         .ndo_get_offload_stats   = mlx5e_get_offload_stats,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 3d371688fbbb..bafcb349a50c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -601,6 +601,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
         if (lro_num_seg > 1) {
                 mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt);
                 skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg);
+                /* Subtract one since we already counted this as one
+                 * "regular" packet in mlx5e_complete_rx_cqe()
+                 */
+                rq->stats.packets += lro_num_seg - 1;
                 rq->stats.lro_packets++;
                 rq->stats.lro_bytes += cqe_bcnt;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 79481f4cf264..fade7233dac5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -133,6 +133,23 @@ err_create_ft:
         return rule;
 }
 
+static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(flow->rule)) {
+                counter = mlx5_flow_rule_counter(flow->rule);
+                mlx5_del_flow_rules(flow->rule);
+                mlx5_fc_destroy(priv->mdev, counter);
+        }
+
+        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
+                mlx5_destroy_flow_table(priv->fs.tc.t);
+                priv->fs.tc.t = NULL;
+        }
+}
+
 static struct mlx5_flow_handle *
 mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                       struct mlx5_flow_spec *spec,
@@ -149,7 +166,24 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 }
 
 static void mlx5e_detach_encap(struct mlx5e_priv *priv,
-                               struct mlx5e_tc_flow *flow) {
+                               struct mlx5e_tc_flow *flow);
+
+static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+
+        mlx5_eswitch_del_offloaded_rule(esw, flow->rule, flow->attr);
+
+        mlx5_eswitch_del_vlan_action(esw, flow->attr);
+
+        if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
+                mlx5e_detach_encap(priv, flow);
+}
+
+static void mlx5e_detach_encap(struct mlx5e_priv *priv,
+                               struct mlx5e_tc_flow *flow)
+{
         struct list_head *next = flow->encap.next;
 
         list_del(&flow->encap);
@@ -173,25 +207,10 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
 static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
                               struct mlx5e_tc_flow *flow)
 {
-        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        struct mlx5_fc *counter = NULL;
-
-        if (!IS_ERR(flow->rule)) {
-                counter = mlx5_flow_rule_counter(flow->rule);
-                mlx5_del_flow_rules(flow->rule);
-                mlx5_fc_destroy(priv->mdev, counter);
-        }
-
-        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
-                mlx5_eswitch_del_vlan_action(esw, flow->attr);
-                if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
-                        mlx5e_detach_encap(priv, flow);
-        }
-
-        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
-                mlx5_destroy_flow_table(priv->fs.tc.t);
-                priv->fs.tc.t = NULL;
-        }
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                mlx5e_tc_del_fdb_flow(priv, flow);
+        else
+                mlx5e_tc_del_nic_flow(priv, flow);
 }
 
 static void parse_vxlan_attr(struct mlx5_flow_spec *spec,
@@ -248,12 +267,15 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
                         skb_flow_dissector_target(f->dissector,
                                                   FLOW_DISSECTOR_KEY_ENC_PORTS,
                                                   f->mask);
+                struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+                struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+                struct mlx5e_priv *up_priv = netdev_priv(up_dev);
 
                 /* Full udp dst port must be given */
                 if (memchr_inv(&mask->dst, 0xff, sizeof(mask->dst)))
                         goto vxlan_match_offload_err;
 
-                if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->dst)) &&
+                if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->dst)) &&
                     MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap))
                         parse_vxlan_attr(spec, f);
                 else {
@@ -976,6 +998,8 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
                               struct mlx5_esw_flow_attr *attr)
 {
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+        struct mlx5e_priv *up_priv = netdev_priv(up_dev);
         unsigned short family = ip_tunnel_info_af(tun_info);
         struct ip_tunnel_key *key = &tun_info->key;
         struct mlx5_encap_entry *e;
@@ -996,7 +1020,7 @@ vxlan_encap_offload_err:
                 return -EOPNOTSUPP;
         }
 
-        if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->tp_dst)) &&
+        if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->tp_dst)) &&
             MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap)) {
                 tunnel_type = MLX5_HEADER_TYPE_VXLAN;
         } else {
@@ -1112,14 +1136,16 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 }
 
                 if (is_tcf_vlan(a)) {
-                        if (tcf_vlan_action(a) == VLAN_F_POP) {
+                        if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
-                        } else if (tcf_vlan_action(a) == VLAN_F_PUSH) {
+                        } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
                                 if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
                                         return -EOPNOTSUPP;
 
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
                                 attr->vlan = tcf_vlan_push_vid(a);
+                        } else { /* action is TCA_VLAN_ACT_MODIFY */
+                                return -EOPNOTSUPP;
                         }
                         continue;
                 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index f193128bac4b..57f5e2d7ebd1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -274,15 +274,18 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                         sq->stats.tso_bytes += skb->len - ihs;
                 }
 
+                sq->stats.packets += skb_shinfo(skb)->gso_segs;
                 num_bytes = skb->len + (skb_shinfo(skb)->gso_segs - 1) * ihs;
         } else {
                 bf = sq->bf_budget &&
                      !skb->xmit_more &&
                      !skb_shinfo(skb)->nr_frags;
                 ihs = mlx5e_get_inline_hdr_size(sq, skb, bf);
+                sq->stats.packets++;
                 num_bytes = max_t(unsigned int, skb->len, ETH_ZLEN);
         }
 
+        sq->stats.bytes += num_bytes;
         wi->num_bytes = num_bytes;
 
         ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
@@ -381,8 +384,6 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         if (bf)
                 sq->bf_budget--;
 
-        sq->stats.packets++;
-        sq->stats.bytes += num_bytes;
         return NETDEV_TX_OK;
 
 dma_unmap_wqe_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 5b78883d5654..ad329b1680b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -209,6 +209,7 @@ struct mlx5_esw_offload {
         struct mlx5_eswitch_rep *vport_reps;
         DECLARE_HASHTABLE(encap_tbl, 8);
         u8 inline_mode;
+        u64 num_flows;
 };
 
 struct mlx5_eswitch {
@@ -271,6 +272,11 @@ struct mlx5_flow_handle *
 mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                 struct mlx5_flow_spec *spec,
                                 struct mlx5_esw_flow_attr *attr);
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr);
+
 struct mlx5_flow_handle *
 mlx5_eswitch_create_vport_rx_rule(struct mlx5_eswitch *esw, int vport, u32 tirn);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 4f5b0d47d5f3..307ec6c5fd3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -93,10 +93,27 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                    spec, &flow_act, dest, i);
         if (IS_ERR(rule))
                 mlx5_fc_destroy(esw->dev, counter);
+        else
+                esw->offloads.num_flows++;
 
         return rule;
 }
 
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(rule)) {
+                counter = mlx5_flow_rule_counter(rule);
+                mlx5_del_flow_rules(rule);
+                mlx5_fc_destroy(esw->dev, counter);
+                esw->offloads.num_flows--;
+        }
+}
+
 static int esw_set_global_vlan_pop(struct mlx5_eswitch *esw, u8 val)
 {
         struct mlx5_eswitch_rep *rep;
@@ -908,6 +925,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
             MLX5_CAP_INLINE_MODE_VPORT_CONTEXT)
                 return -EOPNOTSUPP;
 
+        if (esw->offloads.num_flows > 0) {
+                esw_warn(dev, "Can't set inline mode when flows are configured\n");
+                return -EOPNOTSUPP;
+        }
+
         err = esw_inline_mode_from_devlink(mode, &mlx5_mode);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 55957246c0e8..b5d5519542e8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -294,7 +294,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
                                          struct netdev_notifier_changeupper_info *info)
 {
         struct net_device *upper = info->upper_dev, *ndev_tmp;
-        struct netdev_lag_upper_info *lag_upper_info;
+        struct netdev_lag_upper_info *lag_upper_info = NULL;
         bool is_bonded;
         int bond_status = 0;
         int num_slaves = 0;
@@ -303,7 +303,8 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
         if (!netif_is_lag_master(upper))
                 return 0;
 
-        lag_upper_info = info->upper_info;
+        if (info->linking)
+                lag_upper_info = info->upper_info;
 
         /* The event may still be of interest if the slave does not belong to
          * us, but is enslaved to a master which has one or more of our netdevs
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index e2bd600d19de..60154a175bd3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -87,7 +87,7 @@ static struct mlx5_profile profile[] = {
         [2] = {
                 .mask           = MLX5_PROF_MASK_QP_SIZE |
                                   MLX5_PROF_MASK_MR_CACHE,
-                .log_max_qp     = 17,
+                .log_max_qp     = 18,
                 .mr_cache[0]    = {
                         .size   = 500,
                         .limit  = 250
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 06c9f4100cb9..6ad44be08b33 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -25,6 +25,7 @@
 #include <linux/of_irq.h>
 #include <linux/crc32.h>
 #include <linux/crc32c.h>
+#include <linux/circ_buf.h>
 
 #include "moxart_ether.h"
 
@@ -278,6 +279,13 @@ rx_next:
         return rx;
 }
 
+static int moxart_tx_queue_space(struct net_device *ndev)
+{
+        struct moxart_mac_priv_t *priv = netdev_priv(ndev);
+
+        return CIRC_SPACE(priv->tx_head, priv->tx_tail, TX_DESC_NUM);
+}
+
 static void moxart_tx_finished(struct net_device *ndev)
 {
         struct moxart_mac_priv_t *priv = netdev_priv(ndev);
@@ -297,6 +305,9 @@ static void moxart_tx_finished(struct net_device *ndev)
                 tx_tail = TX_NEXT(tx_tail);
         }
         priv->tx_tail = tx_tail;
+        if (netif_queue_stopped(ndev) &&
+            moxart_tx_queue_space(ndev) >= TX_WAKE_THRESHOLD)
+                netif_wake_queue(ndev);
 }
 
 static irqreturn_t moxart_mac_interrupt(int irq, void *dev_id)
@@ -324,13 +335,18 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct moxart_mac_priv_t *priv = netdev_priv(ndev);
         void *desc;
         unsigned int len;
-        unsigned int tx_head = priv->tx_head;
+        unsigned int tx_head;
         u32 txdes1;
         int ret = NETDEV_TX_BUSY;
 
+        spin_lock_irq(&priv->txlock);
+
+        tx_head = priv->tx_head;
         desc = priv->tx_desc_base + (TX_REG_DESC_SIZE * tx_head);
 
-        spin_lock_irq(&priv->txlock);
+        if (moxart_tx_queue_space(ndev) == 1)
+                netif_stop_queue(ndev);
+
         if (moxart_desc_read(desc + TX_REG_OFFSET_DESC0) & TX_DESC0_DMA_OWN) {
                 net_dbg_ratelimited("no TX space for packet\n");
                 priv->stats.tx_dropped++;
diff --git a/drivers/net/ethernet/moxa/moxart_ether.h b/drivers/net/ethernet/moxa/moxart_ether.h
index 93a9563ac7c6..afc32ec998c0 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.h
+++ b/drivers/net/ethernet/moxa/moxart_ether.h
@@ -59,6 +59,7 @@
 #define TX_NEXT(N)              (((N) + 1) & (TX_DESC_NUM_MASK))
 #define TX_BUF_SIZE             1600
 #define TX_BUF_SIZE_MAX         (TX_DESC1_BUF_SIZE_MASK+1)
+#define TX_WAKE_THRESHOLD       16
 
 #define RX_DESC_NUM             64
 #define RX_DESC_NUM_MASK        (RX_DESC_NUM-1)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 9179a99563af..a41377e26c07 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev)
 {
         struct nfp_net *nn = netdev_priv(netdev);
 
+        unregister_netdev(nn->netdev);
+
         if (nn->xdp_prog)
                 bpf_prog_put(nn->xdp_prog);
         if (nn->bpf_offload_xdp)
                 nfp_net_xdp_offload(nn, NULL);
-        unregister_netdev(nn->netdev);
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 5bd36a4a8fcd..a6e2bbe629bd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -583,6 +583,13 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
                    p_params->ets_cbs,
                    p_ets->pri_tc_tbl[0], p_params->max_ets_tc);
 
+        if (p_params->ets_enabled && !p_params->max_ets_tc) {
+                p_params->max_ets_tc = QED_MAX_PFC_PRIORITIES;
+                DP_VERBOSE(p_hwfn, QED_MSG_DCB,
+                           "ETS params: max_ets_tc is forced to %d\n",
+                p_params->max_ets_tc);
+        }
+
         /* 8 bit tsa and bw data corresponding to each of the 8 TC's are
          * encoded in a type u32 array of size 2.
          */
@@ -1001,6 +1008,8 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
         u8 pfc_map = 0;
         int i;
 
+        *pfc &= ~DCBX_PFC_ERROR_MASK;
+
         if (p_params->pfc.willing)
                 *pfc |= DCBX_PFC_WILLING_MASK;
         else
@@ -1255,7 +1264,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
         if (!dcbx_info)
                 return NULL;
 
@@ -2073,6 +2082,8 @@ static int qed_dcbnl_ieee_setpfc(struct qed_dev *cdev, struct ieee_pfc *pfc)
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++)
                 dcbx_set.config.params.pfc.prio[i] = !!(pfc->pfc_en & BIT(i));
 
+        dcbx_set.config.params.pfc.max_tc = pfc->pfc_cap;
+
         ptt = qed_ptt_acquire(hwfn);
         if (!ptt)
                 return -EINVAL;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 54248775f227..f68c4db656ed 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1127,12 +1127,70 @@ static struct mdiobb_ops bb_ops = {
         .get_mdio_data = sh_get_mdio,
 };
 
+/* free Tx skb function */
+static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        struct sh_eth_txdesc *txdesc;
+        int free_num = 0;
+        int entry;
+        bool sent;
+
+        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
+                entry = mdp->dirty_tx % mdp->num_tx_ring;
+                txdesc = &mdp->tx_ring[entry];
+                sent = !(txdesc->status & cpu_to_le32(TD_TACT));
+                if (sent_only && !sent)
+                        break;
+                /* TACT bit must be checked before all the following reads */
+                dma_rmb();
+                netif_info(mdp, tx_done, ndev,
+                           "tx entry %d status 0x%08x\n",
+                           entry, le32_to_cpu(txdesc->status));
+                /* Free the original skb. */
+                if (mdp->tx_skbuff[entry]) {
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
+                                         le32_to_cpu(txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
+                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
+                        mdp->tx_skbuff[entry] = NULL;
+                        free_num++;
+                }
+                txdesc->status = cpu_to_le32(TD_TFP);
+                if (entry >= mdp->num_tx_ring - 1)
+                        txdesc->status |= cpu_to_le32(TD_TDLE);
+
+                if (sent) {
+                        ndev->stats.tx_packets++;
+                        ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
+                }
+        }
+        return free_num;
+}
+
 /* free skb and descriptor buffer */
 static void sh_eth_ring_free(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         int ringsize, i;
 
+        if (mdp->rx_ring) {
+                for (i = 0; i < mdp->num_rx_ring; i++) {
+                        if (mdp->rx_skbuff[i]) {
+                                struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
+
+                                dma_unmap_single(&ndev->dev,
+                                                 le32_to_cpu(rxdesc->addr),
+                                                 ALIGN(mdp->rx_buf_sz, 32),
+                                                 DMA_FROM_DEVICE);
+                        }
+                }
+                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
+                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
+                                  mdp->rx_desc_dma);
+                mdp->rx_ring = NULL;
+        }
+
         /* Free Rx skb ringbuffer */
         if (mdp->rx_skbuff) {
                 for (i = 0; i < mdp->num_rx_ring; i++)
@@ -1141,27 +1199,18 @@ static void sh_eth_ring_free(struct net_device *ndev)
         kfree(mdp->rx_skbuff);
         mdp->rx_skbuff = NULL;
 
-        /* Free Tx skb ringbuffer */
-        if (mdp->tx_skbuff) {
-                for (i = 0; i < mdp->num_tx_ring; i++)
-                        dev_kfree_skb(mdp->tx_skbuff[i]);
-        }
-        kfree(mdp->tx_skbuff);
-        mdp->tx_skbuff = NULL;
-
-        if (mdp->rx_ring) {
-                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
-                                  mdp->rx_desc_dma);
-                mdp->rx_ring = NULL;
-        }
-
         if (mdp->tx_ring) {
+                sh_eth_tx_free(ndev, false);
+
                 ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
                 dma_free_coherent(NULL, ringsize, mdp->tx_ring,
                                   mdp->tx_desc_dma);
                 mdp->tx_ring = NULL;
         }
+
+        /* Free Tx skb ringbuffer */
+        kfree(mdp->tx_skbuff);
+        mdp->tx_skbuff = NULL;
 }
 
 /* format skb and descriptor buffer */
@@ -1409,43 +1458,6 @@ static void sh_eth_dev_exit(struct net_device *ndev)
         update_mac_address(ndev);
 }
 
-/* free Tx skb function */
-static int sh_eth_txfree(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        struct sh_eth_txdesc *txdesc;
-        int free_num = 0;
-        int entry;
-
-        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
-                entry = mdp->dirty_tx % mdp->num_tx_ring;
-                txdesc = &mdp->tx_ring[entry];
-                if (txdesc->status & cpu_to_le32(TD_TACT))
-                        break;
-                /* TACT bit must be checked before all the following reads */
-                dma_rmb();
-                netif_info(mdp, tx_done, ndev,
-                           "tx entry %d status 0x%08x\n",
-                           entry, le32_to_cpu(txdesc->status));
-                /* Free the original skb. */
-                if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
-                                         le32_to_cpu(txdesc->len) >> 16,
-                                         DMA_TO_DEVICE);
-                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
-                        mdp->tx_skbuff[entry] = NULL;
-                        free_num++;
-                }
-                txdesc->status = cpu_to_le32(TD_TFP);
-                if (entry >= mdp->num_tx_ring - 1)
-                        txdesc->status |= cpu_to_le32(TD_TDLE);
-
-                ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
-        }
-        return free_num;
-}
-
 /* Packet receive function */
 static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 {
@@ -1690,7 +1702,7 @@ static void sh_eth_error(struct net_device *ndev, u32 intr_status)
                            intr_status, mdp->cur_tx, mdp->dirty_tx,
                            (u32)ndev->state, edtrr);
                 /* dirty buffer free */
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
 
                 /* SH7712 BUG */
                 if (edtrr ^ sh_eth_get_edtrr_trns(mdp)) {
@@ -1751,7 +1763,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                 /* Clear Tx interrupts */
                 sh_eth_write(ndev, intr_status & cd->tx_check, EESR);
 
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
                 netif_wake_queue(ndev);
         }
 
@@ -2412,7 +2424,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         spin_lock_irqsave(&mdp->lock, flags);
         if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) {
-                if (!sh_eth_txfree(ndev)) {
+                if (!sh_eth_tx_free(ndev, true)) {
                         netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n");
                         netif_stop_queue(ndev);
                         spin_unlock_irqrestore(&mdp->lock, flags);
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 7cd76b6b5cb9..2ae852454780 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -2216,18 +2216,15 @@ static int ofdpa_port_stp_update(struct ofdpa_port *ofdpa_port,
 {
         bool want[OFDPA_CTRL_MAX] = { 0, };
         bool prev_ctrls[OFDPA_CTRL_MAX];
-        u8 uninitialized_var(prev_state);
+        u8 prev_state;
         int err;
         int i;
 
-        if (switchdev_trans_ph_prepare(trans)) {
-                memcpy(prev_ctrls, ofdpa_port->ctrls, sizeof(prev_ctrls));
-                prev_state = ofdpa_port->stp_state;
-        }
-
-        if (ofdpa_port->stp_state == state)
+        prev_state = ofdpa_port->stp_state;
+        if (prev_state == state)
                 return 0;
 
+        memcpy(prev_ctrls, ofdpa_port->ctrls, sizeof(prev_ctrls));
         ofdpa_port->stp_state = state;
 
         switch (state) {
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 334bcc6df6b2..b9cb697b2818 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1371,6 +1371,13 @@ static unsigned int efx_wanted_parallelism(struct efx_nic *efx)
                 free_cpumask_var(thread_mask);
         }
 
+        if (count > EFX_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EFX_MAX_RX_QUEUES);
+                count = EFX_MAX_RX_QUEUES;
+        }
+
         /* If RSS is requested for the PF *and* VFs then we can't write RSS
          * table entries that are inaccessible to VFs
          */
@@ -2404,7 +2411,7 @@ static void efx_udp_tunnel_del(struct net_device *dev, struct udp_tunnel_info *t
         tnl.type = (u16)efx_tunnel_type;
         tnl.port = ti->port;
 
-        if (efx->type->udp_tnl_add_port)
+        if (efx->type->udp_tnl_del_port)
                 (void)efx->type->udp_tnl_del_port(efx, tnl);
 }
 
diff --git a/drivers/net/ethernet/sfc/falcon/efx.c b/drivers/net/ethernet/sfc/falcon/efx.c
index f5e5cd1659a1..29614da91cbf 100644
--- a/drivers/net/ethernet/sfc/falcon/efx.c
+++ b/drivers/net/ethernet/sfc/falcon/efx.c
@@ -1354,6 +1354,13 @@ static unsigned int ef4_wanted_parallelism(struct ef4_nic *efx)
                 free_cpumask_var(thread_mask);
         }
 
+        if (count > EF4_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EF4_MAX_RX_QUEUES);
+                count = EF4_MAX_RX_QUEUES;
+        }
+
         return count;
 }
 
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 296c8efd0038..9e631952b86f 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -74,15 +74,21 @@ config TI_CPSW
           will be called cpsw.
 
 config TI_CPTS
-        tristate "TI Common Platform Time Sync (CPTS) Support"
+        bool "TI Common Platform Time Sync (CPTS) Support"
         depends on TI_CPSW || TI_KEYSTONE_NETCP
-        imply PTP_1588_CLOCK
+        depends on PTP_1588_CLOCK
         ---help---
           This driver supports the Common Platform Time Sync unit of
           the CPSW Ethernet Switch and Keystone 2 1g/10g Switch Subsystem.
           The unit can time stamp PTP UDP/IPv4 and Layer 2 packets, and the
           driver offers a PTP Hardware Clock.
 
+config TI_CPTS_MOD
+        tristate
+        depends on TI_CPTS
+        default y if TI_CPSW=y || TI_KEYSTONE_NETCP=y
+        default m
+
 config TI_KEYSTONE_NETCP
         tristate "TI Keystone NETCP Core Support"
         select TI_CPSW_ALE
diff --git a/drivers/net/ethernet/ti/Makefile b/drivers/net/ethernet/ti/Makefile
index 1e7c10bf8713..10e6b0ce51ba 100644
--- a/drivers/net/ethernet/ti/Makefile
+++ b/drivers/net/ethernet/ti/Makefile
@@ -12,7 +12,7 @@ obj-$(CONFIG_TI_DAVINCI_MDIO) += davinci_mdio.o
 obj-$(CONFIG_TI_DAVINCI_CPDMA) += davinci_cpdma.o
 obj-$(CONFIG_TI_CPSW_PHY_SEL) += cpsw-phy-sel.o
 obj-$(CONFIG_TI_CPSW_ALE) += cpsw_ale.o
-obj-$(CONFIG_TI_CPTS) += cpts.o
+obj-$(CONFIG_TI_CPTS_MOD) += cpts.o
 obj-$(CONFIG_TI_CPSW) += ti_cpsw.o
 ti_cpsw-y := cpsw.o
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 9f3d9c67e3fe..fa674a8bda0c 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1267,6 +1267,7 @@ static void soft_reset_slave(struct cpsw_slave *slave)
 static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
         u32 slave_port;
+        struct phy_device *phy;
         struct cpsw_common *cpsw = priv->cpsw;
 
         soft_reset_slave(slave);
@@ -1300,27 +1301,28 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
                                    1 << slave_port, 0, 0, ALE_MCAST_FWD_2);
 
         if (slave->data->phy_node) {
-                slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node,
+                phy = of_phy_connect(priv->ndev, slave->data->phy_node,
                                  &cpsw_adjust_link, 0, slave->data->phy_if);
-                if (!slave->phy) {
+                if (!phy) {
                         dev_err(priv->dev, "phy \"%s\" not found on slave %d\n",
                                 slave->data->phy_node->full_name,
                                 slave->slave_num);
                         return;
                 }
         } else {
-                slave->phy = phy_connect(priv->ndev, slave->data->phy_id,
+                phy = phy_connect(priv->ndev, slave->data->phy_id,
                                  &cpsw_adjust_link, slave->data->phy_if);
-                if (IS_ERR(slave->phy)) {
+                if (IS_ERR(phy)) {
                         dev_err(priv->dev,
                                 "phy \"%s\" not found on slave %d, err %ld\n",
                                 slave->data->phy_id, slave->slave_num,
-                                PTR_ERR(slave->phy));
-                        slave->phy = NULL;
+                                PTR_ERR(phy));
                         return;
                 }
         }
 
+        slave->phy = phy;
+
         phy_attached_info(slave->phy);
 
         phy_start(slave->phy);
@@ -1817,6 +1819,8 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
         }
 
         cpsw_intr_enable(cpsw);
+        netif_trans_update(ndev);
+        netif_tx_wake_all_queues(ndev);
 }
 
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index b75d9cdcfb0c..ae48c809bac9 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -45,6 +45,8 @@ MODULE_DESCRIPTION("FUJITSU Extended Socket Network Device Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
+#define ACPI_MOTHERBOARD_RESOURCE_HID "PNP0C02"
+
 static int fjes_request_irq(struct fjes_adapter *);
 static void fjes_free_irq(struct fjes_adapter *);
 
@@ -78,7 +80,7 @@ static void fjes_rx_irq(struct fjes_adapter *, int);
 static int fjes_poll(struct napi_struct *, int);
 
 static const struct acpi_device_id fjes_acpi_ids[] = {
-        {"PNP0C02", 0},
+        {ACPI_MOTHERBOARD_RESOURCE_HID, 0},
         {"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, fjes_acpi_ids);
@@ -115,18 +117,17 @@ static struct resource fjes_resource[] = {
         },
 };
 
-static int fjes_acpi_add(struct acpi_device *device)
+static bool is_extended_socket_device(struct acpi_device *device)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
         char str_buf[sizeof(FJES_ACPI_SYMBOL) + 1];
-        struct platform_device *plat_dev;
         union acpi_object *str;
         acpi_status status;
         int result;
 
         status = acpi_evaluate_object(device->handle, "_STR", NULL, &buffer);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                return false;
 
         str = buffer.pointer;
         result = utf16s_to_utf8s((wchar_t *)str->string.pointer,
@@ -136,10 +137,42 @@ static int fjes_acpi_add(struct acpi_device *device)
 
         if (strncmp(FJES_ACPI_SYMBOL, str_buf, strlen(FJES_ACPI_SYMBOL)) != 0) {
                 kfree(buffer.pointer);
-                return -ENODEV;
+                return false;
         }
         kfree(buffer.pointer);
 
+        return true;
+}
+
+static int acpi_check_extended_socket_status(struct acpi_device *device)
+{
+        unsigned long long sta;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_STA", NULL, &sta);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        if (!((sta & ACPI_STA_DEVICE_PRESENT) &&
+              (sta & ACPI_STA_DEVICE_ENABLED) &&
+              (sta & ACPI_STA_DEVICE_UI) &&
+              (sta & ACPI_STA_DEVICE_FUNCTIONING)))
+                return -ENODEV;
+
+        return 0;
+}
+
+static int fjes_acpi_add(struct acpi_device *device)
+{
+        struct platform_device *plat_dev;
+        acpi_status status;
+
+        if (!is_extended_socket_device(device))
+                return -ENODEV;
+
+        if (acpi_check_extended_socket_status(device))
+                return -ENODEV;
+
         status = acpi_walk_resources(device->handle, METHOD_NAME__CRS,
                                      fjes_get_acpi_resource, fjes_resource);
         if (ACPI_FAILURE(status))
@@ -1316,7 +1349,7 @@ static void fjes_netdev_setup(struct net_device *netdev)
         netdev->min_mtu = fjes_support_mtu[0];
         netdev->max_mtu = fjes_support_mtu[3];
         netdev->flags |= IFF_BROADCAST;
-        netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
 }
 
 static void fjes_irq_watch_task(struct work_struct *work)
@@ -1473,11 +1506,44 @@ static void fjes_watch_unshare_task(struct work_struct *work)
         }
 }
 
+static acpi_status
+acpi_find_extended_socket_device(acpi_handle obj_handle, u32 level,
+                                 void *context, void **return_value)
+{
+        struct acpi_device *device;
+        bool *found = context;
+        int result;
+
+        result = acpi_bus_get_device(obj_handle, &device);
+        if (result)
+                return AE_OK;
+
+        if (strcmp(acpi_device_hid(device), ACPI_MOTHERBOARD_RESOURCE_HID))
+                return AE_OK;
+
+        if (!is_extended_socket_device(device))
+                return AE_OK;
+
+        if (acpi_check_extended_socket_status(device))
+                return AE_OK;
+
+        *found = true;
+        return AE_CTRL_TERMINATE;
+}
+
 /* fjes_init_module - Driver Registration Routine */
 static int __init fjes_init_module(void)
 {
+        bool found = false;
         int result;
 
+        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+                            acpi_find_extended_socket_device, NULL, &found,
+                            NULL);
+
+        if (!found)
+                return -ENODEV;
+
         pr_info("%s - version %s - %s\n",
                 fjes_driver_string, fjes_driver_version, fjes_copyright);
 
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 4c1d8cca247b..8dd0b8770328 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1231,8 +1231,11 @@ void netvsc_channel_cb(void *context)
                 return;
 
         net_device = net_device_to_netvsc_device(ndev);
-        if (unlikely(net_device->destroy) &&
-            netvsc_channel_idle(net_device, q_idx))
+        if (unlikely(!net_device))
+                return;
+
+        if (unlikely(net_device->destroy &&
+                     netvsc_channel_idle(net_device, q_idx)))
                 return;
 
         /* commit_rd_index() -> hv_signal_on_read() needs this. */
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index ffedad2a360a..15b920086251 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -418,8 +418,9 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr
                 memset(rd, 0, sizeof(*rd));
                 rd->hw = hwmap + i;
                 rd->buf = kmalloc(len, GFP_KERNEL|GFP_DMA);
-                if (rd->buf == NULL ||
-                    !(busaddr = pci_map_single(pdev, rd->buf, len, dir))) {
+                if (rd->buf)
+                        busaddr = pci_map_single(pdev, rd->buf, len, dir);
+                if (rd->buf == NULL || pci_dma_mapping_error(pdev, busaddr)) {
                         if (rd->buf) {
                                 net_err_ratelimited("%s: failed to create PCI-MAP for %p\n",
                                                     __func__, rd->buf);
@@ -430,8 +431,7 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr
                                 rd = r->rd + j;
                                 busaddr = rd_get_addr(rd);
                                 rd_set_addr_status(rd, 0, 0);
-                                if (busaddr)
-                                        pci_unmap_single(pdev, busaddr, len, dir);
+                                pci_unmap_single(pdev, busaddr, len, dir);
                                 kfree(rd->buf);
                                 rd->buf = NULL;
                         }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index e2460a57e4b1..ed0d10f54f26 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1438,8 +1438,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
                 skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->rx_queue, skb);
                 schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT);
-        } else {
-                netif_rx_ni(skb);
         }
 
         return true;
diff --git a/drivers/net/phy/mdio-boardinfo.c b/drivers/net/phy/mdio-boardinfo.c
index 6b988f77da08..61941e29daae 100644
--- a/drivers/net/phy/mdio-boardinfo.c
+++ b/drivers/net/phy/mdio-boardinfo.c
@@ -84,3 +84,4 @@ int mdiobus_register_board_info(const struct mdio_board_info *info,
 
         return 0;
 }
+EXPORT_SYMBOL(mdiobus_register_board_info);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6742070ca676..1326d99771c1 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -798,9 +798,6 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -940,9 +937,6 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -952,6 +946,7 @@ static struct phy_driver ksphy_driver[] = {
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
         .config_init    = ksz9021_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
@@ -971,6 +966,7 @@ static struct phy_driver ksphy_driver[] = {
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
         .config_init    = ksz9031_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = ksz9031_read_status,
@@ -989,9 +985,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
         .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -1003,9 +996,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -1017,9 +1007,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
         .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 } };
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1be69d8bc909..a2bfc82e95d7 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -681,7 +681,7 @@ void phy_stop_machine(struct phy_device *phydev)
         cancel_delayed_work_sync(&phydev->state_queue);
 
         mutex_lock(&phydev->lock);
-        if (phydev->state > PHY_UP)
+        if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
                 phydev->state = PHY_UP;
         mutex_unlock(&phydev->lock);
 }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 1b52520715ae..f8c81f12d988 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -990,7 +990,7 @@ static void team_port_disable(struct team *team,
 #define TEAM_ENC_FEATURES       (NETIF_F_HW_CSUM | NETIF_F_SG | \
                                  NETIF_F_RXCSUM | NETIF_F_ALL_TSO)
 
-static void ___team_compute_features(struct team *team)
+static void __team_compute_features(struct team *team)
 {
         struct team_port *port;
         u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
@@ -1023,16 +1023,10 @@ static void ___team_compute_features(struct team *team)
                 team->dev->priv_flags |= IFF_XMIT_DST_RELEASE;
 }
 
-static void __team_compute_features(struct team *team)
-{
-        ___team_compute_features(team);
-        netdev_change_features(team->dev);
-}
-
 static void team_compute_features(struct team *team)
 {
         mutex_lock(&team->lock);
-        ___team_compute_features(team);
+        __team_compute_features(team);
         mutex_unlock(&team->lock);
         netdev_change_features(team->dev);
 }
@@ -1641,6 +1635,7 @@ static void team_uninit(struct net_device *dev)
         team_notify_peers_fini(team);
         team_queue_override_fini(team);
         mutex_unlock(&team->lock);
+        netdev_change_features(dev);
 }
 
 static void team_destructor(struct net_device *dev)
@@ -1928,6 +1923,10 @@ static int team_add_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_add(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
@@ -1939,6 +1938,10 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_del(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 34cc3c590aa5..cc88cd7856f5 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1931,6 +1931,8 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                 return -EINVAL;
 
         tun->set_features = features;
+        tun->dev->wanted_features &= ~TUN_USER_FEATURES;
+        tun->dev->wanted_features |= features;
         netdev_update_features(tun->dev);
 
         return 0;
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f5552aaaa77a..f3ae88fdf332 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -532,6 +532,7 @@ static const struct driver_info wwan_info = {
 #define LENOVO_VENDOR_ID        0x17ef
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
+#define MICROSOFT_VENDOR_ID     0x045e
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -761,6 +762,20 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* Microsoft Surface 2 dock (based on Realtek RTL8152) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x07ab, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
+/* Microsoft Surface 3 dock (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x07c6, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index 8a40202c0a17..c4f1c363e24b 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         tx_overhead = 0x40;
 
         len = skb->len;
-        if (skb_headroom(skb) < tx_overhead) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
+        if (skb_cow_head(skb, tx_overhead)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, tx_overhead);
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index e221bfcee76b..947bea81d924 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 {
         int len = skb->len;
 
-        if (skb_headroom(skb) < 2) {
-                struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
+        if (skb_cow_head(skb, 2)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
         skb_push(skb, 2);
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 876f02f4945e..2a2c3edb6bad 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
         }
 
         /* We now decide whether we can put our special header into the sk_buff */
-        if (skb_cloned(skb) || skb_headroom(skb) < 2) {
-                /* no such luck - we make our own */
-                struct sk_buff *copied_skb;
-                copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
-                dev_kfree_skb_irq(skb);
-                skb = copied_skb;
-                if (!copied_skb) {
-                        kaweth->stats.tx_errors++;
-                        netif_start_queue(net);
-                        spin_unlock_irq(&kaweth->device_lock);
-                        return NETDEV_TX_OK;
-                }
+        if (skb_cow_head(skb, 2)) {
+                kaweth->stats.tx_errors++;
+                netif_start_queue(net);
+                spin_unlock_irq(&kaweth->device_lock);
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
         }
 
         private_header = (__le16 *)__skb_push(skb, 2);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 9889a70ff4f6..636f48f19d1e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2607,14 +2607,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (lan78xx_linearize(skb) < 0)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 805674550683..2474618404f5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -580,6 +580,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* Motorola Mapphone devices with MDM6600 */
+                USB_VENDOR_AND_INTERFACE_INFO(0x22b8, USB_CLASS_VENDOR_SPEC, 0xfb, 0xff),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -904,7 +908,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
@@ -925,6 +929,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b1, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 986243c932cc..07f788c49d57 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "8"
+#define NET_VERSION             "9"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -501,6 +501,8 @@ enum rtl_register_content {
 #define RTL8153_RMS             RTL8153_MAX_PACKET
 #define RTL8152_TX_TIMEOUT      (5 * HZ)
 #define RTL8152_NAPI_WEIGHT     64
+#define rx_reserved_size(x)     ((x) + VLAN_ETH_HLEN + CRC_SIZE + \
+                                 sizeof(struct rx_desc) + RX_ALIGN)
 
 /* rtl8152 flags */
 enum rtl8152_flags {
@@ -515,6 +517,7 @@ enum rtl8152_flags {
 
 /* Define these values to match your device */
 #define VENDOR_ID_REALTEK               0x0bda
+#define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
 #define VENDOR_ID_NVIDIA                0x0955
@@ -1292,6 +1295,7 @@ static void intr_callback(struct urb *urb)
                 }
         } else {
                 if (netif_carrier_ok(tp->netdev)) {
+                        netif_stop_queue(tp->netdev);
                         set_bit(RTL8152_LINK_CHG, &tp->flags);
                         schedule_delayed_work(&tp->schedule, 0);
                 }
@@ -1362,6 +1366,7 @@ static int alloc_all_mem(struct r8152 *tp)
         spin_lock_init(&tp->rx_lock);
         spin_lock_init(&tp->tx_lock);
         INIT_LIST_HEAD(&tp->tx_free);
+        INIT_LIST_HEAD(&tp->rx_done);
         skb_queue_head_init(&tp->tx_queue);
         skb_queue_head_init(&tp->rx_queue);
 
@@ -2252,8 +2257,7 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
 
 static void r8153_set_rx_early_size(struct r8152 *tp)
 {
-        u32 mtu = tp->netdev->mtu;
-        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 8;
+        u32 ocp_data = (agg_buf_sz - rx_reserved_size(tp->netdev->mtu)) / 4;
 
         ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, ocp_data);
 }
@@ -2898,7 +2902,8 @@ static void r8153_first_init(struct r8152 *tp)
 
         rtl_rx_vlan_en(tp, tp->netdev->features & NETIF_F_HW_VLAN_CTAG_RX);
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_MTPS, MTPS_JUMBO);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0);
@@ -2950,7 +2955,8 @@ static void r8153_enter_oob(struct r8152 *tp)
                 usleep_range(1000, 2000);
         }
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TEREDO_CFG);
         ocp_data &= ~TEREDO_WAKE_MASK;
@@ -3165,6 +3171,9 @@ static void set_carrier(struct r8152 *tp)
                         napi_enable(&tp->napi);
                         netif_wake_queue(netdev);
                         netif_info(tp, link, netdev, "carrier on\n");
+                } else if (netif_queue_stopped(netdev) &&
+                           skb_queue_len(&tp->tx_queue) < tp->tx_qlen) {
+                        netif_wake_queue(netdev);
                 }
         } else {
                 if (netif_carrier_ok(netdev)) {
@@ -3698,8 +3707,18 @@ static int rtl8152_resume(struct usb_interface *intf)
                         tp->rtl_ops.autosuspend_en(tp, false);
                         napi_disable(&tp->napi);
                         set_bit(WORK_ENABLE, &tp->flags);
-                        if (netif_carrier_ok(tp->netdev))
-                                rtl_start_rx(tp);
+
+                        if (netif_carrier_ok(tp->netdev)) {
+                                if (rtl8152_get_speed(tp) & LINK_STATUS) {
+                                        rtl_start_rx(tp);
+                                } else {
+                                        netif_carrier_off(tp->netdev);
+                                        tp->rtl_ops.disable(tp);
+                                        netif_info(tp, link, tp->netdev,
+                                                   "linking down\n");
+                                }
+                        }
+
                         napi_enable(&tp->napi);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
                         smp_mb__after_atomic();
@@ -4200,8 +4219,14 @@ static int rtl8152_change_mtu(struct net_device *dev, int new_mtu)
 
         dev->mtu = new_mtu;
 
-        if (netif_running(dev) && netif_carrier_ok(dev))
-                r8153_set_rx_early_size(tp);
+        if (netif_running(dev)) {
+                u32 rms = new_mtu + VLAN_ETH_HLEN + CRC_SIZE;
+
+                ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, rms);
+
+                if (netif_carrier_ok(dev))
+                        r8153_set_rx_early_size(tp);
+        }
 
         mutex_unlock(&tp->control);
 
@@ -4497,6 +4522,8 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 static struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8152)},
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6)},
         {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x304f)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x3062)},
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 0b17b40d7a4f..190de9a90f73 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2203,13 +2203,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
-                struct sk_buff *skb2 =
-                        skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 831aa33d078a..5f19fb0f025d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2001,13 +2001,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
         /* We do not advertise SG, so skbs should be already linearized */
         BUG_ON(skb_shinfo(skb)->nr_frags);
 
-        if (skb_headroom(skb) < overhead) {
-                struct sk_buff *skb2 = skb_copy_expand(skb,
-                        overhead, 0, flags);
+        /* Make writable and expand header space by overhead if required */
+        if (skb_cow_head(skb, overhead)) {
+                /* Must deallocate here as returning NULL to indicate error
+                 * means the skb won't be deallocated in the caller.
+                 */
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (csum) {
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 4a1e9c489f1f..aadfe1d1c37e 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 
         len = skb->len;
 
-        if (skb_headroom(skb) < SR_TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, SR_TX_OVERHEAD);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3de65ea6531a..453244805c52 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1929,7 +1929,7 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                    " value=0x%04x index=0x%04x size=%d\n",
                    cmd, reqtype, value, index, size);
 
-        if (data) {
+        if (size) {
                 buf = kmalloc(size, GFP_KERNEL);
                 if (!buf)
                         goto out;
@@ -1938,8 +1938,13 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
         err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
                               USB_CTRL_GET_TIMEOUT);
-        if (err > 0 && err <= size)
-                memcpy(data, buf, err);
+        if (err > 0 && err <= size) {
+        if (data)
+            memcpy(data, buf, err);
+        else
+            netdev_dbg(dev->net,
+                "Huh? Data requested but thrown away.\n");
+    }
         kfree(buf);
 out:
         return err;
@@ -1960,7 +1965,13 @@ static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                 buf = kmemdup(data, size, GFP_KERNEL);
                 if (!buf)
                         goto out;
-        }
+        } else {
+        if (size) {
+            WARN_ON_ONCE(1);
+            err = -EINVAL;
+            goto out;
+        }
+    }
 
         err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ea9890d61967..f36584616e7d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2230,14 +2230,8 @@ static bool virtnet_validate_features(struct virtio_device *vdev)
 #define MIN_MTU ETH_MIN_MTU
 #define MAX_MTU ETH_MAX_MTU
 
-static int virtnet_probe(struct virtio_device *vdev)
+static int virtnet_validate(struct virtio_device *vdev)
 {
-        int i, err;
-        struct net_device *dev;
-        struct virtnet_info *vi;
-        u16 max_queue_pairs;
-        int mtu;
-
         if (!vdev->config->get) {
                 dev_err(&vdev->dev, "%s failure: config access disabled\n",
                         __func__);
@@ -2247,6 +2241,25 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (!virtnet_validate_features(vdev))
                 return -EINVAL;
 
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_MTU)) {
+                int mtu = virtio_cread16(vdev,
+                                         offsetof(struct virtio_net_config,
+                                                  mtu));
+                if (mtu < MIN_MTU)
+                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
+        }
+
+        return 0;
+}
+
+static int virtnet_probe(struct virtio_device *vdev)
+{
+        int i, err;
+        struct net_device *dev;
+        struct virtnet_info *vi;
+        u16 max_queue_pairs;
+        int mtu;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
@@ -2362,11 +2375,20 @@ static int virtnet_probe(struct virtio_device *vdev)
                                      offsetof(struct virtio_net_config,
                                               mtu));
                 if (mtu < dev->min_mtu) {
-                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
-                } else {
-                        dev->mtu = mtu;
-                        dev->max_mtu = mtu;
+                        /* Should never trigger: MTU was previously validated
+                         * in virtnet_validate.
+                         */
+                        dev_err(&vdev->dev, "device MTU appears to have changed "
+                                "it is now %d < %d", mtu, dev->min_mtu);
+                        goto free_stats;
                 }
+
+                dev->mtu = mtu;
+                dev->max_mtu = mtu;
+
+                /* TODO: size buffers correctly in this case. */
+                if (dev->mtu > ETH_DATA_LEN)
+                        vi->big_packets = true;
         }
 
         if (vi->any_header_sg)
@@ -2544,6 +2566,7 @@ static struct virtio_driver virtio_net_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtnet_validate,
         .probe =        virtnet_probe,
         .remove =       virtnet_remove,
         .config_changed = virtnet_config_changed,
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index fea687f35b5a..7d909c8183e9 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -462,8 +462,10 @@ static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
         }
 
         if (rt6_local) {
-                if (rt6_local->rt6i_idev)
+                if (rt6_local->rt6i_idev) {
                         in6_dev_put(rt6_local->rt6i_idev);
+                        rt6_local->rt6i_idev = NULL;
+                }
 
                 dst = &rt6_local->dst;
                 dev_put(dst->dev);
@@ -1126,7 +1128,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
                 goto nla_put_failure;
 
         /* rule only needs to appear once */
-        nlh->nlmsg_flags &= NLM_F_EXCL;
+        nlh->nlmsg_flags |= NLM_F_EXCL;
 
         frh = nlmsg_data(nlh);
         memset(frh, 0, sizeof(*frh));
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 33fb26833cd0..d9f37ee4bfdd 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -51,7 +51,7 @@ const struct ath10k_hw_regs qca6174_regs = {
         .rtc_soc_base_address                   = 0x00000800,
         .rtc_wmac_base_address                  = 0x00001000,
         .soc_core_base_address                  = 0x0003a000,
-        .wlan_mac_base_address                  = 0x00020000,
+        .wlan_mac_base_address                  = 0x00010000,
         .ce_wrapper_base_address                = 0x00034000,
         .ce0_base_address                       = 0x00034400,
         .ce1_base_address                       = 0x00034800,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index de19c7c92bc6..85d949e03f79 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2238,14 +2238,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
         struct brcmf_p2p_info *p2p = &cfg->p2p;
         struct brcmf_cfg80211_vif *vif;
+        enum nl80211_iftype iftype;
         bool wait_for_disable = false;
         int err;
 
         brcmf_dbg(TRACE, "delete P2P vif\n");
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
+        iftype = vif->wdev.iftype;
         brcmf_cfg80211_arm_vif_event(cfg, vif);
-        switch (vif->wdev.iftype) {
+        switch (iftype) {
         case NL80211_IFTYPE_P2P_CLIENT:
                 if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
                         wait_for_disable = true;
@@ -2275,7 +2277,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                                             BRCMF_P2P_DISABLE_TIMEOUT);
 
         err = 0;
-        if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
                 brcmf_vif_clear_mgmt_ies(vif);
                 err = brcmf_p2p_release_p2p_if(vif);
         }
@@ -2291,7 +2293,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         brcmf_remove_interface(vif->ifp, true);
 
         brcmf_cfg80211_arm_vif_event(cfg, NULL);
-        if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE)
                 p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
 
         return err;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index a260cd503200..077bfd8f4c0c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 
         if (ret)
                 return ret;
+        if (count == 0)
+                return 0;
 
         iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
                                (count - 1), NULL);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 99132ea16ede..c5734e1a02d2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -216,7 +216,8 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
                         qmask |= BIT(vif->hw_queue[ac]);
         }
 
-        if (vif->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC)
                 qmask |= BIT(vif->cab_queue);
 
         return qmask;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index d37b1695c64e..486dcceed17a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2319,7 +2319,7 @@ iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
-        /* Called when we need to transmit (a) frame(s) from agg queue */
+        /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
 
         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
                                           tids, more_data, true);
@@ -2338,7 +2338,8 @@ static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 
-                if (tid_data->state != IWL_AGG_ON &&
+                if (!iwl_mvm_is_dqa_supported(mvm) &&
+                    tid_data->state != IWL_AGG_ON &&
                     tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA)
                         continue;
 
@@ -2400,7 +2401,7 @@ void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
                 return;
 
         rcu_read_lock();
-        sta = mvm->fw_id_to_mac_id[notif->sta_id];
+        sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
                 rcu_read_unlock();
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index bd1dcc863d8f..9d28db7f56aa 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1806,7 +1806,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                         iwl_mvm_get_wd_timeout(mvm, vif, false, false);
                 int queue;
 
-                if (vif->type == NL80211_IFTYPE_AP)
+                if (vif->type == NL80211_IFTYPE_AP ||
+                    vif->type == NL80211_IFTYPE_ADHOC)
                         queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
                 else if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                         queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
@@ -1837,7 +1838,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
          * enabled-cab_queue to the mask)
          */
         if (iwl_mvm_is_dqa_supported(mvm) &&
-            vif->type == NL80211_IFTYPE_AP) {
+            (vif->type == NL80211_IFTYPE_AP ||
+             vif->type == NL80211_IFTYPE_ADHOC)) {
                 struct iwl_trans_txq_scd_cfg cfg = {
                         .fifo = IWL_MVM_TX_FIFO_MCAST,
                         .sta_id = mvmvif->bcast_sta.sta_id,
@@ -1862,7 +1864,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (vif->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC)
                 iwl_mvm_disable_txq(mvm, vif->cab_queue, vif->cab_queue,
                                     IWL_MAX_TID_COUNT, 0);
 
@@ -3135,7 +3138,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg)
+                                       bool single_sta_queue)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {
@@ -3155,14 +3158,14 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
         for_each_set_bit(tid, &_tids, IWL_MAX_TID_COUNT)
                 cmd.awake_acs |= BIT(tid_to_ucode_ac[tid]);
 
-        /* If we're releasing frames from aggregation queues then check if the
-         * all queues combined that we're releasing frames from have
+        /* If we're releasing frames from aggregation or dqa queues then check
+         * if all the queues that we're releasing frames from, combined, have:
          *  - more frames than the service period, in which case more_data
          *    needs to be set
          *  - fewer than 'cnt' frames, in which case we need to adjust the
          *    firmware command (but do that unconditionally)
          */
-        if (agg) {
+        if (single_sta_queue) {
                 int remaining = cnt;
                 int sleep_tx_count;
 
@@ -3172,7 +3175,8 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                         u16 n_queued;
 
                         tid_data = &mvmsta->tid_data[tid];
-                        if (WARN(tid_data->state != IWL_AGG_ON &&
+                        if (WARN(!iwl_mvm_is_dqa_supported(mvm) &&
+                                 tid_data->state != IWL_AGG_ON &&
                                  tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA,
                                  "TID %d state is %d\n",
                                  tid, tid_data->state)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 4be34f902278..1927ce607798 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -547,7 +547,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg);
+                                       bool single_sta_queue);
 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                       bool drain);
 void iwl_mvm_sta_modify_disable_tx(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dd2b4a300819..1ba0a6f55503 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -7,7 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016        Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -34,6 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -505,6 +506,7 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
 
         switch (info->control.vif->type) {
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
                 /*
                  * Handle legacy hostapd as well, where station may be added
                  * only after assoc. Take care of the case where we send a
@@ -516,7 +518,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                 if (info->hw_queue == info->control.vif->cab_queue)
                         return info->hw_queue;
 
-                WARN_ONCE(1, "fc=0x%02x", le16_to_cpu(fc));
+                WARN_ONCE(info->control.vif->type != NL80211_IFTYPE_ADHOC,
+                          "fc=0x%02x", le16_to_cpu(fc));
                 return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
         case NL80211_IFTYPE_P2P_DEVICE:
                 if (ieee80211_is_mgmt(fc))
@@ -583,7 +586,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                         iwl_mvm_vif_from_mac80211(info.control.vif);
 
                 if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
-                    info.control.vif->type == NL80211_IFTYPE_AP) {
+                    info.control.vif->type == NL80211_IFTYPE_AP ||
+                    info.control.vif->type == NL80211_IFTYPE_ADHOC) {
                         sta_id = mvmvif->bcast_sta.sta_id;
                         queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info,
                                                            hdr->frame_control);
@@ -628,8 +632,10 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
          * values.
          * Note that we don't need to make sure it isn't agg'd, since we're
          * TXing non-sta
+         * For DQA mode - we shouldn't increase it though
          */
-        atomic_inc(&mvm->pending_frames[sta_id]);
+        if (!iwl_mvm_is_dqa_supported(mvm))
+                atomic_inc(&mvm->pending_frames[sta_id]);
 
         return 0;
 }
@@ -1005,11 +1011,8 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         spin_unlock(&mvmsta->lock);
 
-        /* Increase pending frames count if this isn't AMPDU */
-        if ((iwl_mvm_is_dqa_supported(mvm) &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_ON &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_STARTING) ||
-            (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu))
+        /* Increase pending frames count if this isn't AMPDU or DQA queue */
+        if (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu)
                 atomic_inc(&mvm->pending_frames[mvmsta->sta_id]);
 
         return 0;
@@ -1079,12 +1082,13 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
         lockdep_assert_held(&mvmsta->lock);
 
         if ((tid_data->state == IWL_AGG_ON ||
-             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA) &&
+             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA ||
+             iwl_mvm_is_dqa_supported(mvm)) &&
             iwl_mvm_tid_queued(tid_data) == 0) {
                 /*
-                 * Now that this aggregation queue is empty tell mac80211 so it
-                 * knows we no longer have frames buffered for the station on
-                 * this TID (for the TIM bitmap calculation.)
+                 * Now that this aggregation or DQA queue is empty tell
+                 * mac80211 so it knows we no longer have frames buffered for
+                 * the station on this TID (for the TIM bitmap calculation.)
                  */
                 ieee80211_sta_set_buffered(sta, tid, false);
         }
@@ -1257,7 +1261,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         u8 skb_freed = 0;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
-        bool txq_agg = false; /* Is this TXQ aggregated */
 
         __skb_queue_head_init(&skbs);
 
@@ -1283,6 +1286,10 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         info->flags |= IEEE80211_TX_STAT_ACK;
                         break;
                 case TX_STATUS_FAIL_DEST_PS:
+                        /* In DQA, the FW should have stopped the queue and not
+                         * return this status
+                         */
+                        WARN_ON(iwl_mvm_is_dqa_supported(mvm));
                         info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
                         break;
                 default:
@@ -1387,15 +1394,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         bool send_eosp_ndp = false;
 
                         spin_lock_bh(&mvmsta->lock);
-                        if (iwl_mvm_is_dqa_supported(mvm)) {
-                                enum iwl_mvm_agg_state state;
-
-                                state = mvmsta->tid_data[tid].state;
-                                txq_agg = (state == IWL_AGG_ON ||
-                                        state == IWL_EMPTYING_HW_QUEUE_DELBA);
-                        } else {
-                                txq_agg = txq_id >= mvm->first_agg_queue;
-                        }
 
                         if (!is_ndp) {
                                 tid_data->next_reclaimed = next_reclaimed;
@@ -1452,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If the txq is not an AMPDU queue, there is no chance we freed
          * several skbs. Check that out...
          */
-        if (txq_agg)
+        if (iwl_mvm_is_dqa_supported(mvm) || txq_id >= mvm->first_agg_queue)
                 goto out;
 
         /* We can't free more than one frame at once on a shared queue */
-        WARN_ON(!iwl_mvm_is_dqa_supported(mvm) && (skb_freed > 1));
+        WARN_ON(skb_freed > 1);
 
         /* If we have still frames for this STA nothing to do here */
         if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index 5ebca1d0cfc7..b62e03d11c2e 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -57,8 +57,8 @@ MODULE_PARM_DESC(mfg_mode, "manufacturing mode enable:1, disable:0");
  * In case of any errors during inittialization, this function also ensures
  * proper cleanup before exiting.
  */
-static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
-                            void **padapter)
+static int mwifiex_register(void *card, struct device *dev,
+                            struct mwifiex_if_ops *if_ops, void **padapter)
 {
         struct mwifiex_adapter *adapter;
         int i;
@@ -68,6 +68,7 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
                 return -ENOMEM;
 
         *padapter = adapter;
+        adapter->dev = dev;
         adapter->card = card;
 
         /* Save interface specific operations in adapter */
@@ -1568,12 +1569,11 @@ mwifiex_add_card(void *card, struct completion *fw_done,
 {
         struct mwifiex_adapter *adapter;
 
-        if (mwifiex_register(card, if_ops, (void **)&adapter)) {
+        if (mwifiex_register(card, dev, if_ops, (void **)&adapter)) {
                 pr_err("%s: software init failed\n", __func__);
                 goto err_init_sw;
         }
 
-        adapter->dev = dev;
         mwifiex_probe_of(adapter);
 
         adapter->iface_type = iface_type;
@@ -1718,6 +1718,9 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter)
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
+        if (adapter->irq_wakeup >= 0)
+                device_init_wakeup(adapter->dev, false);
+
         /* Unregister device */
         mwifiex_dbg(adapter, INFO,
                     "info: unregister device\n");
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index a0d918094889..b8c990d10d6e 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -2739,6 +2739,21 @@ static void mwifiex_pcie_device_dump(struct mwifiex_adapter *adapter)
         schedule_work(&card->work);
 }
 
+static void mwifiex_pcie_free_buffers(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        if (reg->sleep_cookie)
+                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+
+        mwifiex_pcie_delete_cmdrsp_buf(adapter);
+        mwifiex_pcie_delete_evtbd_ring(adapter);
+        mwifiex_pcie_delete_rxbd_ring(adapter);
+        mwifiex_pcie_delete_txbd_ring(adapter);
+        card->cmdrsp_buf = NULL;
+}
+
 /*
  * This function initializes the PCI-E host memory space, WCB rings, etc.
  *
@@ -2850,13 +2865,6 @@ err_enable_dev:
 
 /*
  * This function cleans up the allocated card buffers.
- *
- * The following are freed by this function -
- *      - TXBD ring buffers
- *      - RXBD ring buffers
- *      - Event BD ring buffers
- *      - Command response ring buffer
- *      - Sleep cookie buffer
  */
 static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
 {
@@ -2875,6 +2883,8 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
                                     "Failed to write driver not-ready signature\n");
         }
 
+        mwifiex_pcie_free_buffers(adapter);
+
         if (pdev) {
                 pci_iounmap(pdev, card->pci_mmap);
                 pci_iounmap(pdev, card->pci_mmap1);
@@ -3126,10 +3136,7 @@ err_cre_txbd:
         pci_iounmap(pdev, card->pci_mmap1);
 }
 
-/* This function cleans up the PCI-E host memory space.
- * Some code is extracted from mwifiex_unregister_dev()
- *
- */
+/* This function cleans up the PCI-E host memory space. */
 static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
@@ -3140,14 +3147,7 @@ static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 
         adapter->seq_num = 0;
 
-        if (reg->sleep_cookie)
-                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
-
-        mwifiex_pcie_delete_cmdrsp_buf(adapter);
-        mwifiex_pcie_delete_evtbd_ring(adapter);
-        mwifiex_pcie_delete_rxbd_ring(adapter);
-        mwifiex_pcie_delete_txbd_ring(adapter);
-        card->cmdrsp_buf = NULL;
+        mwifiex_pcie_free_buffers(adapter);
 }
 
 static struct mwifiex_if_ops pcie_ops = {
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index caea350f05aa..bdc379178e87 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -1742,12 +1742,14 @@ void rtl_c2hcmd_enqueue(struct ieee80211_hw *hw, u8 tag, u8 len, u8 *val)
         unsigned long flags;
         struct rtl_c2hcmd *c2hcmd;
 
-        c2hcmd = kmalloc(sizeof(*c2hcmd), GFP_KERNEL);
+        c2hcmd = kmalloc(sizeof(*c2hcmd),
+                         in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 
         if (!c2hcmd)
                 goto label_err;
 
-        c2hcmd->val = kmalloc(len, GFP_KERNEL);
+        c2hcmd->val = kmalloc(len,
+                              in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 
         if (!c2hcmd->val)
                 goto label_err2;
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 23d4a1728cdf..351bac8f6503 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -934,8 +934,14 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, NULL);
         if (rc < 0)
                 goto out_unlock;
+        nvdimm_bus_unlock(&nvdimm_bus->dev);
+
         if (copy_to_user(p, buf, buf_len))
                 rc = -EFAULT;
+
+        vfree(buf);
+        return rc;
+
  out_unlock:
         nvdimm_bus_unlock(&nvdimm_bus->dev);
  out:
diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
index b3323c0697f6..ca6d572c48fc 100644
--- a/drivers/nvdimm/claim.c
+++ b/drivers/nvdimm/claim.c
@@ -243,7 +243,15 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
         }
 
         if (unlikely(is_bad_pmem(&nsio->bb, sector, sz_align))) {
-                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)) {
+                /*
+                 * FIXME: nsio_rw_bytes() may be called from atomic
+                 * context in the btt case and nvdimm_clear_poison()
+                 * takes a sleeping lock. Until the locking can be
+                 * reworked this capability requires that the namespace
+                 * is not claimed by btt.
+                 */
+                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)
+                                && (!ndns->claim || !is_nd_btt(ndns->claim))) {
                         long cleared;
 
                         cleared = nvdimm_clear_poison(&ndns->dev, offset, size);
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 0eedc49e0d47..8b721321be5b 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(nvdimm_create);
 
 int alias_dpa_busy(struct device *dev, void *data)
 {
-        resource_size_t map_end, blk_start, new, busy;
+        resource_size_t map_end, blk_start, new;
         struct blk_alloc_info *info = data;
         struct nd_mapping *nd_mapping;
         struct nd_region *nd_region;
@@ -436,29 +436,19 @@ int alias_dpa_busy(struct device *dev, void *data)
  retry:
         /*
          * Find the free dpa from the end of the last pmem allocation to
-         * the end of the interleave-set mapping that is not already
-         * covered by a blk allocation.
+         * the end of the interleave-set mapping.
          */
-        busy = 0;
         for_each_dpa_resource(ndd, res) {
+                if (strncmp(res->name, "pmem", 4) != 0)
+                        continue;
                 if ((res->start >= blk_start && res->start < map_end)
                                 || (res->end >= blk_start
                                         && res->end <= map_end)) {
-                        if (strncmp(res->name, "pmem", 4) == 0) {
-                                new = max(blk_start, min(map_end + 1,
-                                                        res->end + 1));
-                                if (new != blk_start) {
-                                        blk_start = new;
-                                        goto retry;
-                                }
-                        } else
-                                busy += min(map_end, res->end)
-                                        - max(nd_mapping->start, res->start) + 1;
-                } else if (nd_mapping->start > res->start
-                                && map_end < res->end) {
-                        /* total eclipse of the PMEM region mapping */
-                        busy += nd_mapping->size;
-                        break;
+                        new = max(blk_start, min(map_end + 1, res->end + 1));
+                        if (new != blk_start) {
+                                blk_start = new;
+                                goto retry;
+                        }
                 }
         }
 
@@ -470,52 +460,11 @@ int alias_dpa_busy(struct device *dev, void *data)
                 return 1;
         }
 
-        info->available -= blk_start - nd_mapping->start + busy;
+        info->available -= blk_start - nd_mapping->start;
 
         return 0;
 }
 
-static int blk_dpa_busy(struct device *dev, void *data)
-{
-        struct blk_alloc_info *info = data;
-        struct nd_mapping *nd_mapping;
-        struct nd_region *nd_region;
-        resource_size_t map_end;
-        int i;
-
-        if (!is_nd_pmem(dev))
-                return 0;
-
-        nd_region = to_nd_region(dev);
-        for (i = 0; i < nd_region->ndr_mappings; i++) {
-                nd_mapping  = &nd_region->mapping[i];
-                if (nd_mapping->nvdimm == info->nd_mapping->nvdimm)
-                        break;
-        }
-
-        if (i >= nd_region->ndr_mappings)
-                return 0;
-
-        map_end = nd_mapping->start + nd_mapping->size - 1;
-        if (info->res->start >= nd_mapping->start
-                        && info->res->start < map_end) {
-                if (info->res->end <= map_end) {
-                        info->busy = 0;
-                        return 1;
-                } else {
-                        info->busy -= info->res->end - map_end;
-                        return 0;
-                }
-        } else if (info->res->end >= nd_mapping->start
-                        && info->res->end <= map_end) {
-                info->busy -= nd_mapping->start - info->res->start;
-                return 0;
-        } else {
-                info->busy -= nd_mapping->size;
-                return 0;
-        }
-}
-
 /**
  * nd_blk_available_dpa - account the unused dpa of BLK region
  * @nd_mapping: container of dpa-resource-root + labels
@@ -545,11 +494,7 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region)
         for_each_dpa_resource(ndd, res) {
                 if (strncmp(res->name, "blk", 3) != 0)
                         continue;
-
-                info.res = res;
-                info.busy = resource_size(res);
-                device_for_each_child(&nvdimm_bus->dev, &info, blk_dpa_busy);
-                info.available -= info.busy;
+                info.available -= resource_size(res);
         }
 
         return info.available;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9b3b57fef446..eeb409c287b8 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -270,7 +270,7 @@ static inline int nvme_setup_discard(struct nvme_ns *ns, struct request *req,
         memset(cmnd, 0, sizeof(*cmnd));
         cmnd->dsm.opcode = nvme_cmd_dsm;
         cmnd->dsm.nsid = cpu_to_le32(ns->ns_id);
-        cmnd->dsm.nr = segments - 1;
+        cmnd->dsm.nr = cpu_to_le32(segments - 1);
         cmnd->dsm.attributes = cpu_to_le32(NVME_DSMGMT_AD);
 
         req->special_vec.bv_page = virt_to_page(range);
@@ -1316,6 +1316,14 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                                 table->entries[state] = target;
 
                         /*
+                         * Don't allow transitions to the deepest state
+                         * if it's quirked off.
+                         */
+                        if (state == ctrl->npss &&
+                            (ctrl->quirks & NVME_QUIRK_NO_DEEPEST_PS))
+                                continue;
+
+                        /*
                          * Is this state a useful non-operational state for
                          * higher-power states to autonomously transition to?
                          */
@@ -1387,16 +1395,15 @@ struct nvme_core_quirk_entry {
 };
 
 static const struct nvme_core_quirk_entry core_quirks[] = {
-        /*
-         * Seen on a Samsung "SM951 NVMe SAMSUNG 256GB": using APST causes
-         * the controller to go out to lunch.  It dies when the watchdog
-         * timer reads CSTS and gets 0xffffffff.
-         */
         {
-                .vid = 0x144d,
-                .fr = "BXW75D0Q",
+                /*
+                 * This Toshiba device seems to die using any APST states.  See:
+                 * https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678184/comments/11
+                 */
+                .vid = 0x1179,
+                .mn = "THNSF5256GPUK TOSHIBA",
                 .quirks = NVME_QUIRK_NO_APST,
-        },
+        }
 };
 
 /* match is null-terminated but idstr is space-padded. */
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 9690beb15e69..d996ca73d3be 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2023,7 +2023,7 @@ nvme_fc_configure_admin_queue(struct nvme_fc_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 2aa20e3e5675..ab2d6ec7eb5c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -83,6 +83,11 @@ enum nvme_quirks {
          * APST should not be used.
          */
         NVME_QUIRK_NO_APST                      = (1 << 4),
+
+        /*
+         * The deepest sleep state should not be used.
+         */
+        NVME_QUIRK_NO_DEEPEST_PS                = (1 << 5),
 };
 
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 26a5fd05fe88..5d309535abbd 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -19,6 +19,7 @@
 #include <linux/blk-mq-pci.h>
 #include <linux/cpu.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/genhd.h>
@@ -1943,10 +1944,31 @@ static int nvme_dev_map(struct nvme_dev *dev)
         return -ENODEV;
 }
 
+static unsigned long check_dell_samsung_bug(struct pci_dev *pdev)
+{
+        if (pdev->vendor == 0x144d && pdev->device == 0xa802) {
+                /*
+                 * Several Samsung devices seem to drop off the PCIe bus
+                 * randomly when APST is on and uses the deepest sleep state.
+                 * This has been observed on a Samsung "SM951 NVMe SAMSUNG
+                 * 256GB", a "PM951 NVMe SAMSUNG 512GB", and a "Samsung SSD
+                 * 950 PRO 256GB", but it seems to be restricted to two Dell
+                 * laptops.
+                 */
+                if (dmi_match(DMI_SYS_VENDOR, "Dell Inc.") &&
+                    (dmi_match(DMI_PRODUCT_NAME, "XPS 15 9550") ||
+                     dmi_match(DMI_PRODUCT_NAME, "Precision 5510")))
+                        return NVME_QUIRK_NO_DEEPEST_PS;
+        }
+
+        return 0;
+}
+
 static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         int node, result = -ENOMEM;
         struct nvme_dev *dev;
+        unsigned long quirks = id->driver_data;
 
         node = dev_to_node(&pdev->dev);
         if (node == NUMA_NO_NODE)
@@ -1978,8 +2000,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto put_pci;
 
+        quirks |= check_dell_samsung_bug(pdev);
+
         result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
-                        id->driver_data);
+                        quirks);
         if (result)
                 goto release_pools;
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 779f516e7a4e..16f84eb0b95e 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -343,8 +343,6 @@ static int __nvme_rdma_init_request(struct nvme_rdma_ctrl *ctrl,
         struct ib_device *ibdev = dev->dev;
         int ret;
 
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         ret = nvme_rdma_alloc_qe(ibdev, &req->sqe, sizeof(struct nvme_command),
                         DMA_TO_DEVICE);
         if (ret)
@@ -652,8 +650,22 @@ out_free_queues:
 
 static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
         int i, ret;
 
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret)
+                return ret;
+
+        ctrl->queue_count = nr_io_queues + 1;
+        if (ctrl->queue_count < 2)
+                return 0;
+
+        dev_info(ctrl->ctrl.device,
+                "creating %d I/O queues.\n", nr_io_queues);
+
         for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvme_rdma_init_queue(ctrl, i,
                                            ctrl->ctrl.opts->queue_size);
@@ -1594,7 +1606,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
@@ -1791,20 +1803,8 @@ static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
 
 static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret)
-                return ret;
-
-        ctrl->queue_count = opts->nr_io_queues + 1;
-        if (ctrl->queue_count < 2)
-                return 0;
-
-        dev_info(ctrl->ctrl.device,
-                "creating %d I/O queues.\n", opts->nr_io_queues);
-
         ret = nvme_rdma_init_io_queues(ctrl);
         if (ret)
                 return ret;
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a7bcff45f437..76450b0c55f1 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -100,7 +100,7 @@ static u16 nvmet_get_smart_log(struct nvmet_req *req,
         u16 status;
 
         WARN_ON(req == NULL || slog == NULL);
-        if (req->cmd->get_log_page.nsid == 0xFFFFFFFF)
+        if (req->cmd->get_log_page.nsid == cpu_to_le32(0xFFFFFFFF))
                 status = nvmet_get_smart_log_all(req, slog);
         else
                 status = nvmet_get_smart_log_nsid(req, slog);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 11b0a0a5f661..798653b329b2 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -425,6 +425,13 @@ void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
         ctrl->sqs[qid] = sq;
 }
 
+static void nvmet_confirm_sq(struct percpu_ref *ref)
+{
+        struct nvmet_sq *sq = container_of(ref, struct nvmet_sq, ref);
+
+        complete(&sq->confirm_done);
+}
+
 void nvmet_sq_destroy(struct nvmet_sq *sq)
 {
         /*
@@ -433,7 +440,8 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)
          */
         if (sq->ctrl && sq->ctrl->sqs && sq->ctrl->sqs[0] == sq)
                 nvmet_async_events_free(sq->ctrl);
-        percpu_ref_kill(&sq->ref);
+        percpu_ref_kill_and_confirm(&sq->ref, nvmet_confirm_sq);
+        wait_for_completion(&sq->confirm_done);
         wait_for_completion(&sq->free_done);
         percpu_ref_exit(&sq->ref);
 
@@ -461,6 +469,7 @@ int nvmet_sq_init(struct nvmet_sq *sq)
                 return ret;
         }
         init_completion(&sq->free_done);
+        init_completion(&sq->confirm_done);
 
         return 0;
 }
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 4195115c7e54..6b0baa9caab9 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -180,7 +180,7 @@ static void nvmet_execute_write_zeroes(struct nvmet_req *req)
 
         sector = le64_to_cpu(write_zeroes->slba) <<
                 (req->ns->blksize_shift - 9);
-        nr_sector = (((sector_t)le32_to_cpu(write_zeroes->length)) <<
+        nr_sector = (((sector_t)le16_to_cpu(write_zeroes->length)) <<
                 (req->ns->blksize_shift - 9)) + 1;
 
         if (__blkdev_issue_zeroout(req->ns->bdev, sector, nr_sector,
@@ -230,7 +230,7 @@ int nvmet_parse_io_cmd(struct nvmet_req *req)
                 return 0;
         case nvme_cmd_dsm:
                 req->execute = nvmet_execute_dsm;
-                req->data_len = le32_to_cpu(cmd->dsm.nr + 1) *
+                req->data_len = (le32_to_cpu(cmd->dsm.nr) + 1) *
                         sizeof(struct nvme_dsm_range);
                 return 0;
         case nvme_cmd_write_zeroes:
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d1f06e7768ff..c7b0b6a52708 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -223,8 +223,6 @@ static void nvme_loop_submit_async_event(struct nvme_ctrl *arg, int aer_idx)
 static int nvme_loop_init_iod(struct nvme_loop_ctrl *ctrl,
                 struct nvme_loop_iod *iod, unsigned int queue_idx)
 {
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         iod->req.cmd = &iod->cmd;
         iod->req.rsp = &iod->rsp;
         iod->queue = &ctrl->queues[queue_idx];
@@ -288,9 +286,9 @@ static struct blk_mq_ops nvme_loop_admin_mq_ops = {
 
 static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
+        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
         blk_cleanup_queue(ctrl->ctrl.admin_q);
         blk_mq_free_tag_set(&ctrl->admin_tag_set);
-        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
 }
 
 static void nvme_loop_free_ctrl(struct nvme_ctrl *nctrl)
@@ -314,6 +312,43 @@ free_ctrl:
         kfree(ctrl);
 }
 
+static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        int i;
+
+        for (i = 1; i < ctrl->queue_count; i++)
+                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+}
+
+static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
+        int ret, i;
+
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret || !nr_io_queues)
+                return ret;
+
+        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues);
+
+        for (i = 1; i <= nr_io_queues; i++) {
+                ctrl->queues[i].ctrl = ctrl;
+                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
+                if (ret)
+                        goto out_destroy_queues;
+
+                ctrl->queue_count++;
+        }
+
+        return 0;
+
+out_destroy_queues:
+        nvme_loop_destroy_io_queues(ctrl);
+        return ret;
+}
+
 static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
         int error;
@@ -357,7 +392,7 @@ static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
@@ -385,17 +420,13 @@ out_free_sq:
 
 static void nvme_loop_shutdown_ctrl(struct nvme_loop_ctrl *ctrl)
 {
-        int i;
-
         nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
                 blk_mq_tagset_busy_iter(&ctrl->tag_set,
                                         nvme_cancel_request, &ctrl->ctrl);
-
-                for (i = 1; i < ctrl->queue_count; i++)
-                        nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+                nvme_loop_destroy_io_queues(ctrl);
         }
 
         if (ctrl->ctrl.state == NVME_CTRL_LIVE)
@@ -467,19 +498,14 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
         if (ret)
                 goto out_disable;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_free_queues;
-
-                ctrl->queue_count++;
-        }
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
+                goto out_destroy_admin;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
-                        goto out_free_queues;
+                        goto out_destroy_io;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -492,9 +518,9 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
 
         return;
 
-out_free_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+out_destroy_io:
+        nvme_loop_destroy_io_queues(ctrl);
+out_destroy_admin:
         nvme_loop_destroy_admin_queue(ctrl);
 out_disable:
         dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
@@ -533,25 +559,12 @@ static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
 
 static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret, i;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret || !opts->nr_io_queues)
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
                 return ret;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                opts->nr_io_queues);
-
-        for (i = 1; i <= opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_destroy_queues;
-
-                ctrl->queue_count++;
-        }
-
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
         ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
@@ -575,7 +588,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
                 goto out_free_tagset;
         }
 
-        for (i = 1; i <= opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
                         goto out_cleanup_connect_q;
@@ -588,8 +601,7 @@ out_cleanup_connect_q:
 out_free_tagset:
         blk_mq_free_tag_set(&ctrl->tag_set);
 out_destroy_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+        nvme_loop_destroy_io_queues(ctrl);
         return ret;
 }
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 1370eee0a3c0..f7ff15f17ca9 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -73,6 +73,7 @@ struct nvmet_sq {
         u16                     qid;
         u16                     size;
         struct completion       free_done;
+        struct completion       confirm_done;
 };
 
 /**
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 9aa1da3778b3..ecc4fe862561 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -703,11 +703,6 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
 {
         u16 status;
 
-        cmd->queue = queue;
-        cmd->n_rdma = 0;
-        cmd->req.port = queue->port;
-
-
         ib_dma_sync_single_for_cpu(queue->dev->device,
                 cmd->cmd->sge[0].addr, cmd->cmd->sge[0].length,
                 DMA_FROM_DEVICE);
@@ -760,9 +755,12 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 
         cmd->queue = queue;
         rsp = nvmet_rdma_get_rsp(queue);
+        rsp->queue = queue;
         rsp->cmd = cmd;
         rsp->flags = 0;
         rsp->req.cmd = cmd->nvme_cmd;
+        rsp->req.port = queue->port;
+        rsp->n_rdma = 0;
 
         if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) {
                 unsigned long flags;
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index bc090daa850a..5dc53d420ca8 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -939,8 +939,10 @@ parport_register_dev_model(struct parport *port, const char *name,
          * pardevice fields. -arca
          */
         port->ops->init_state(par_dev, par_dev->state);
-        port->proc_device = par_dev;
-        parport_device_proc_register(par_dev);
+        if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
+                port->proc_device = par_dev;
+                parport_device_proc_register(par_dev);
+        }
 
         return par_dev;
 
diff --git a/drivers/pci/dwc/Kconfig b/drivers/pci/dwc/Kconfig
index dfb8a69afc28..d2d2ba5b8a68 100644
--- a/drivers/pci/dwc/Kconfig
+++ b/drivers/pci/dwc/Kconfig
@@ -89,6 +89,7 @@ config PCI_HISI
         depends on PCI_MSI_IRQ_DOMAIN
         select PCIEPORTBUS
         select PCIE_DW_HOST
+        select PCI_HOST_COMMON
         help
           Say Y here if you want PCIe controller support on HiSilicon
           Hip05 and Hip06 SoCs
diff --git a/drivers/pci/dwc/pcie-artpec6.c b/drivers/pci/dwc/pcie-artpec6.c
index fcd3ef845883..6d23683c0892 100644
--- a/drivers/pci/dwc/pcie-artpec6.c
+++ b/drivers/pci/dwc/pcie-artpec6.c
@@ -234,6 +234,9 @@ static int artpec6_add_pcie_port(struct artpec6_pcie *artpec6_pcie,
         return 0;
 }
 
+static const struct dw_pcie_ops dw_pcie_ops = {
+};
+
 static int artpec6_pcie_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -252,6 +255,7 @@ static int artpec6_pcie_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pci->dev = dev;
+        pci->ops = &dw_pcie_ops;
 
         artpec6_pcie->pci = pci;
 
diff --git a/drivers/pci/dwc/pcie-designware-plat.c b/drivers/pci/dwc/pcie-designware-plat.c
index b6c832ba39dd..f20d494922ab 100644
--- a/drivers/pci/dwc/pcie-designware-plat.c
+++ b/drivers/pci/dwc/pcie-designware-plat.c
@@ -86,6 +86,9 @@ static int dw_plat_add_pcie_port(struct pcie_port *pp,
         return 0;
 }
 
+static const struct dw_pcie_ops dw_pcie_ops = {
+};
+
 static int dw_plat_pcie_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -103,6 +106,7 @@ static int dw_plat_pcie_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pci->dev = dev;
+        pci->ops = &dw_pcie_ops;
 
         dw_plat_pcie->pci = pci;
 
diff --git a/drivers/pci/dwc/pcie-hisi.c b/drivers/pci/dwc/pcie-hisi.c
index fd66a3199db7..cf9d6a9d9fd4 100644
--- a/drivers/pci/dwc/pcie-hisi.c
+++ b/drivers/pci/dwc/pcie-hisi.c
@@ -380,9 +380,13 @@ struct pci_ecam_ops hisi_pcie_platform_ops = {
 
 static const struct of_device_id hisi_pcie_almost_ecam_of_match[] = {
         {
-                .compatible = "hisilicon,pcie-almost-ecam",
+                .compatible =  "hisilicon,hip06-pcie-ecam",
                 .data       = (void *) &hisi_pcie_platform_ops,
         },
+        {
+                .compatible =  "hisilicon,hip07-pcie-ecam",
+                .data       = (void *) &hisi_pcie_platform_ops,
+        },
         {},
 };
 
diff --git a/drivers/pci/host/pci-thunder-pem.c b/drivers/pci/host/pci-thunder-pem.c
index 52b5bdccf5f0..6e031b522529 100644
--- a/drivers/pci/host/pci-thunder-pem.c
+++ b/drivers/pci/host/pci-thunder-pem.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 - 2016 Cavium, Inc.
  */
 
+#include <linux/bitfield.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/of_address.h>
@@ -334,6 +335,49 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,
 
 #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)
 
+#define PEM_RES_BASE            0x87e0c0000000UL
+#define PEM_NODE_MASK           GENMASK(45, 44)
+#define PEM_INDX_MASK           GENMASK(26, 24)
+#define PEM_MIN_DOM_IN_NODE     4
+#define PEM_MAX_DOM_IN_NODE     10
+
+static void thunder_pem_reserve_range(struct device *dev, int seg,
+                                      struct resource *r)
+{
+        resource_size_t start = r->start, end = r->end;
+        struct resource *res;
+        const char *regionid;
+
+        regionid = kasprintf(GFP_KERNEL, "PEM RC:%d", seg);
+        if (!regionid)
+                return;
+
+        res = request_mem_region(start, end - start + 1, regionid);
+        if (res)
+                res->flags &= ~IORESOURCE_BUSY;
+        else
+                kfree(regionid);
+
+        dev_info(dev, "%pR %s reserved\n", r,
+                 res ? "has been" : "could not be");
+}
+
+static void thunder_pem_legacy_fw(struct acpi_pci_root *root,
+                                 struct resource *res_pem)
+{
+        int node = acpi_get_node(root->device->handle);
+        int index;
+
+        if (node == NUMA_NO_NODE)
+                node = 0;
+
+        index = root->segment - PEM_MIN_DOM_IN_NODE;
+        index -= node * PEM_MAX_DOM_IN_NODE;
+        res_pem->start = PEM_RES_BASE | FIELD_PREP(PEM_NODE_MASK, node) |
+                                        FIELD_PREP(PEM_INDX_MASK, index);
+        res_pem->flags = IORESOURCE_MEM;
+}
+
 static int thunder_pem_acpi_init(struct pci_config_window *cfg)
 {
         struct device *dev = cfg->parent;
@@ -346,10 +390,24 @@ static int thunder_pem_acpi_init(struct pci_config_window *cfg)
         if (!res_pem)
                 return -ENOMEM;
 
-        ret = acpi_get_rc_resources(dev, "THRX0002", root->segment, res_pem);
+        ret = acpi_get_rc_resources(dev, "CAVA02B", root->segment, res_pem);
+
+        /*
+         * If we fail to gather resources it means that we run with old
+         * FW where we need to calculate PEM-specific resources manually.
+         */
         if (ret) {
-                dev_err(dev, "can't get rc base address\n");
-                return ret;
+                thunder_pem_legacy_fw(root, res_pem);
+                /*
+                 * Reserve 64K size PEM specific resources. The full 16M range
+                 * size is required for thunder_pem_init() call.
+                 */
+                res_pem->end = res_pem->start + SZ_64K - 1;
+                thunder_pem_reserve_range(dev, root->segment, res_pem);
+                res_pem->end = res_pem->start + SZ_16M - 1;
+
+                /* Reserve PCI configuration space as well. */
+                thunder_pem_reserve_range(dev, root->segment, &cfg->res);
         }
 
         return thunder_pem_init(dev, cfg, res_pem);
diff --git a/drivers/pci/host/pcie-iproc-bcma.c b/drivers/pci/host/pcie-iproc-bcma.c
index bd4c9ec25edc..384c27e664fe 100644
--- a/drivers/pci/host/pcie-iproc-bcma.c
+++ b/drivers/pci/host/pcie-iproc-bcma.c
@@ -44,8 +44,7 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 {
         struct device *dev = &bdev->dev;
         struct iproc_pcie *pcie;
-        LIST_HEAD(res);
-        struct resource res_mem;
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -63,22 +62,23 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 
         pcie->base_addr = bdev->addr;
 
-        res_mem.start = bdev->addr_s[0];
-        res_mem.end = bdev->addr_s[0] + SZ_128M - 1;
-        res_mem.name = "PCIe MEM space";
-        res_mem.flags = IORESOURCE_MEM;
-        pci_add_resource(&res, &res_mem);
+        pcie->mem.start = bdev->addr_s[0];
+        pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1;
+        pcie->mem.name = "PCIe MEM space";
+        pcie->mem.flags = IORESOURCE_MEM;
+        pci_add_resource(&resources, &pcie->mem);
 
         pcie->map_irq = iproc_pcie_bcma_map_irq;
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         bcma_set_drvdata(bdev, pcie);
-        return ret;
+        return 0;
 }
 
 static void iproc_pcie_bcma_remove(struct bcma_device *bdev)
diff --git a/drivers/pci/host/pcie-iproc-platform.c b/drivers/pci/host/pcie-iproc-platform.c
index f4909bb0b2ad..8c6a327ca6cd 100644
--- a/drivers/pci/host/pcie-iproc-platform.c
+++ b/drivers/pci/host/pcie-iproc-platform.c
@@ -51,7 +51,7 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
         struct device_node *np = dev->of_node;
         struct resource reg;
         resource_size_t iobase = 0;
-        LIST_HEAD(res);
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -96,10 +96,10 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->phy = NULL;
         }
 
-        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &res, &iobase);
+        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &resources,
+                                               &iobase);
         if (ret) {
-                dev_err(dev,
-                        "unable to get PCI host bridge resources\n");
+                dev_err(dev, "unable to get PCI host bridge resources\n");
                 return ret;
         }
 
@@ -112,14 +112,15 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->map_irq = of_irq_parse_and_map_pci;
         }
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         platform_set_drvdata(pdev, pcie);
-        return ret;
+        return 0;
 }
 
 static int iproc_pcie_pltfm_remove(struct platform_device *pdev)
diff --git a/drivers/pci/host/pcie-iproc.h b/drivers/pci/host/pcie-iproc.h
index 04fed8e907f1..0bbe2ea44f3e 100644
--- a/drivers/pci/host/pcie-iproc.h
+++ b/drivers/pci/host/pcie-iproc.h
@@ -90,6 +90,7 @@ struct iproc_pcie {
 #ifdef CONFIG_ARM
         struct pci_sys_data sysdata;
 #endif
+        struct resource mem;
         struct pci_bus *root_bus;
         struct phy *phy;
         int (*map_irq)(const struct pci_dev *, u8, u8);
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index dc5277ad1b5a..005cadb7a3f8 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -449,6 +449,7 @@ config PHY_QCOM_UFS
 config PHY_QCOM_USB_HS
         tristate "Qualcomm USB HS PHY module"
         depends on USB_ULPI_BUS
+        depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
         select GENERIC_PHY
         help
           Support for the USB high-speed ULPI compliant phy on Qualcomm
@@ -510,12 +511,4 @@ config PHY_MESON8B_USB2
           and GXBB SoCs.
           If unsure, say N.
 
-config PHY_NSP_USB3
-        tristate "Broadcom NorthStar plus USB3 PHY driver"
-        depends on OF && (ARCH_BCM_NSP || COMPILE_TEST)
-        select GENERIC_PHY
-        default ARCH_BCM_NSP
-        help
-          Enable this to support the Broadcom Northstar plus USB3 PHY.
-          If unsure, say N.
 endmenu
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index e7b0feb1e125..dd8f3b5d2918 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -62,4 +62,3 @@ obj-$(CONFIG_PHY_CYGNUS_PCIE)		+= phy-bcm-cygnus-pcie.o
 obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_PHY_NS2_PCIE)              += phy-bcm-ns2-pcie.o
 obj-$(CONFIG_PHY_MESON8B_USB2)          += phy-meson8b-usb2.o
-obj-$(CONFIG_PHY_NSP_USB3)              += phy-bcm-nsp-usb3.o
diff --git a/drivers/phy/phy-bcm-nsp-usb3.c b/drivers/phy/phy-bcm-nsp-usb3.c
deleted file mode 100644
index 49024eaa5545..000000000000
--- a/drivers/phy/phy-bcm-nsp-usb3.c
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright (C) 2016 Broadcom
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/delay.h>
-#include <linux/io.h>
-#include <linux/kernel.h>
-#include <linux/mfd/syscon.h>
-#include <linux/mdio.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <linux/phy/phy.h>
-#include <linux/regmap.h>
-
-#define NSP_USB3_RST_CTRL_OFFSET        0x3f8
-
-/* mdio reg access */
-#define NSP_USB3_PHY_BASE_ADDR_REG      0x1f
-
-#define NSP_USB3_PHY_PLL30_BLOCK        0x8000
-#define NSP_USB3_PLL_CONTROL            0x01
-#define NSP_USB3_PLLA_CONTROL0          0x0a
-#define NSP_USB3_PLLA_CONTROL1          0x0b
-
-#define NSP_USB3_PHY_TX_PMD_BLOCK       0x8040
-#define NSP_USB3_TX_PMD_CONTROL1        0x01
-
-#define NSP_USB3_PHY_PIPE_BLOCK         0x8060
-#define NSP_USB3_LFPS_CMP               0x02
-#define NSP_USB3_LFPS_DEGLITCH          0x03
-
-struct nsp_usb3_phy {
-        struct regmap *usb3_ctrl;
-        struct phy *phy;
-        struct mdio_device *mdiodev;
-};
-
-static int nsp_usb3_phy_init(struct phy *phy)
-{
-        struct nsp_usb3_phy *iphy = phy_get_drvdata(phy);
-        struct mii_bus *bus = iphy->mdiodev->bus;
-        int addr = iphy->mdiodev->addr;
-        u32 data;
-        int rc;
-
-        rc = regmap_read(iphy->usb3_ctrl, 0, &data);
-        if (rc)
-                return rc;
-        data |= 1;
-        rc = regmap_write(iphy->usb3_ctrl, 0, data);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 1);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PLL30_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x1000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL0, 0x6400);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0xc000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0x8000);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 0);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x9000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PIPE_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_CMP, 0xf30d);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_DEGLITCH, 0x6302);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_TX_PMD_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_TX_PMD_CONTROL1, 0x1003);
-
-        return rc;
-}
-
-static struct phy_ops nsp_usb3_phy_ops = {
-        .init   = nsp_usb3_phy_init,
-        .owner  = THIS_MODULE,
-};
-
-static int nsp_usb3_phy_probe(struct mdio_device *mdiodev)
-{
-        struct device *dev = &mdiodev->dev;
-        struct phy_provider *provider;
-        struct nsp_usb3_phy *iphy;
-
-        iphy = devm_kzalloc(dev, sizeof(*iphy), GFP_KERNEL);
-        if (!iphy)
-                return -ENOMEM;
-        iphy->mdiodev = mdiodev;
-
-        iphy->usb3_ctrl = syscon_regmap_lookup_by_phandle(dev->of_node,
-                                                 "usb3-ctrl-syscon");
-        if (IS_ERR(iphy->usb3_ctrl))
-                return PTR_ERR(iphy->usb3_ctrl);
-
-        iphy->phy = devm_phy_create(dev, dev->of_node, &nsp_usb3_phy_ops);
-        if (IS_ERR(iphy->phy)) {
-                dev_err(dev, "failed to create PHY\n");
-                return PTR_ERR(iphy->phy);
-        }
-
-        phy_set_drvdata(iphy->phy, iphy);
-
-        provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-        if (IS_ERR(provider)) {
-                dev_err(dev, "could not register PHY provider\n");
-                return PTR_ERR(provider);
-        }
-
-        return 0;
-}
-
-static const struct of_device_id nsp_usb3_phy_of_match[] = {
-        {.compatible = "brcm,nsp-usb3-phy",},
-        { /* sentinel */ }
-};
-
-static struct mdio_driver nsp_usb3_phy_driver = {
-        .mdiodrv = {
-                .driver = {
-                        .name = "nsp-usb3-phy",
-                        .of_match_table = nsp_usb3_phy_of_match,
-                },
-        },
-        .probe = nsp_usb3_phy_probe,
-};
-
-mdio_module_driver(nsp_usb3_phy_driver);
-
-MODULE_DESCRIPTION("Broadcom NSP USB3 PHY driver");
-MODULE_LICENSE("GPL v2");
-MODULE_AUTHOR("Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com");
diff --git a/drivers/phy/phy-exynos-pcie.c b/drivers/phy/phy-exynos-pcie.c
index 4f60b83641d5..60baf25d98e2 100644
--- a/drivers/phy/phy-exynos-pcie.c
+++ b/drivers/phy/phy-exynos-pcie.c
@@ -254,8 +254,8 @@ static int exynos_pcie_phy_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         exynos_phy->blk_base = devm_ioremap_resource(dev, res);
-        if (IS_ERR(exynos_phy->phy_base))
-                return PTR_ERR(exynos_phy->phy_base);
+        if (IS_ERR(exynos_phy->blk_base))
+                return PTR_ERR(exynos_phy->blk_base);
 
         exynos_phy->drv_data = drv_data;
 
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index d69046537b75..32822b0d9cd0 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -2010,29 +2010,57 @@ out_err:
         return ERR_PTR(ret);
 }
 
-static int pinctrl_create_and_start(struct pinctrl_dev *pctldev)
+static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev)
 {
         pctldev->p = create_pinctrl(pctldev->dev, pctldev);
-        if (!IS_ERR(pctldev->p)) {
-                kref_get(&pctldev->p->users);
-                pctldev->hog_default =
-                        pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
-                if (IS_ERR(pctldev->hog_default)) {
-                        dev_dbg(pctldev->dev,
-                                "failed to lookup the default state\n");
-                } else {
-                        if (pinctrl_select_state(pctldev->p,
-                                                pctldev->hog_default))
-                                dev_err(pctldev->dev,
-                                        "failed to select default state\n");
-                }
+        if (PTR_ERR(pctldev->p) == -ENODEV) {
+                dev_dbg(pctldev->dev, "no hogs found\n");
 
-                pctldev->hog_sleep =
-                        pinctrl_lookup_state(pctldev->p,
-                                                    PINCTRL_STATE_SLEEP);
-                if (IS_ERR(pctldev->hog_sleep))
-                        dev_dbg(pctldev->dev,
-                                "failed to lookup the sleep state\n");
+                return 0;
+        }
+
+        if (IS_ERR(pctldev->p)) {
+                dev_err(pctldev->dev, "error claiming hogs: %li\n",
+                        PTR_ERR(pctldev->p));
+
+                return PTR_ERR(pctldev->p);
+        }
+
+        kref_get(&pctldev->p->users);
+        pctldev->hog_default =
+                pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
+        if (IS_ERR(pctldev->hog_default)) {
+                dev_dbg(pctldev->dev,
+                        "failed to lookup the default state\n");
+        } else {
+                if (pinctrl_select_state(pctldev->p,
+                                         pctldev->hog_default))
+                        dev_err(pctldev->dev,
+                                "failed to select default state\n");
+        }
+
+        pctldev->hog_sleep =
+                pinctrl_lookup_state(pctldev->p,
+                                     PINCTRL_STATE_SLEEP);
+        if (IS_ERR(pctldev->hog_sleep))
+                dev_dbg(pctldev->dev,
+                        "failed to lookup the sleep state\n");
+
+        return 0;
+}
+
+int pinctrl_enable(struct pinctrl_dev *pctldev)
+{
+        int error;
+
+        error = pinctrl_claim_hogs(pctldev);
+        if (error) {
+                dev_err(pctldev->dev, "could not claim hogs: %i\n",
+                        error);
+                mutex_destroy(&pctldev->mutex);
+                kfree(pctldev);
+
+                return error;
         }
 
         mutex_lock(&pinctrldev_list_mutex);
@@ -2043,6 +2071,7 @@ static int pinctrl_create_and_start(struct pinctrl_dev *pctldev)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(pinctrl_enable);
 
 /**
  * pinctrl_register() - register a pin controller device
@@ -2065,25 +2094,30 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
         if (IS_ERR(pctldev))
                 return pctldev;
 
-        error = pinctrl_create_and_start(pctldev);
-        if (error) {
-                mutex_destroy(&pctldev->mutex);
-                kfree(pctldev);
-
+        error = pinctrl_enable(pctldev);
+        if (error)
                 return ERR_PTR(error);
-        }
 
         return pctldev;
 
 }
 EXPORT_SYMBOL_GPL(pinctrl_register);
 
+/**
+ * pinctrl_register_and_init() - register and init pin controller device
+ * @pctldesc: descriptor for this pin controller
+ * @dev: parent device for this pin controller
+ * @driver_data: private pin controller data for this pin controller
+ * @pctldev: pin controller device
+ *
+ * Note that pinctrl_enable() still needs to be manually called after
+ * this once the driver is ready.
+ */
 int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
                               struct device *dev, void *driver_data,
                               struct pinctrl_dev **pctldev)
 {
         struct pinctrl_dev *p;
-        int error;
 
         p = pinctrl_init_controller(pctldesc, dev, driver_data);
         if (IS_ERR(p))
@@ -2097,15 +2131,6 @@ int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
          */
         *pctldev = p;
 
-        error = pinctrl_create_and_start(p);
-        if (error) {
-                mutex_destroy(&p->mutex);
-                kfree(p);
-                *pctldev = NULL;
-
-                return error;
-        }
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(pinctrl_register_and_init);
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index a7ace9e1ad81..74bd90dfd7b1 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -790,7 +790,7 @@ int imx_pinctrl_probe(struct platform_device *pdev,
 
         dev_info(&pdev->dev, "initialized IMX pinctrl driver\n");
 
-        return 0;
+        return pinctrl_enable(ipctl->pctl);
 
 free:
         imx_free_resources(ipctl);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index f80134e3e0b6..9ff790174906 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -13,6 +13,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1524,10 +1525,31 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
+/*
+ * Certain machines seem to hardcode Linux IRQ numbers in their ACPI
+ * tables. Since we leave GPIOs that are not capable of generating
+ * interrupts out of the irqdomain the numbering will be different and
+ * cause devices using the hardcoded IRQ numbers fail. In order not to
+ * break such machines we will only mask pins from irqdomain if the machine
+ * is not listed below.
+ */
+static const struct dmi_system_id chv_no_valid_mask[] = {
+        {
+                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
+                .ident = "Acer Chromebook (CYAN)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
+                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                },
+        }
+};
+
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 {
         const struct chv_gpio_pinrange *range;
         struct gpio_chip *chip = &pctrl->chip;
+        bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
 
         *chip = chv_gpio_chip;
@@ -1536,7 +1558,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         chip->label = dev_name(pctrl->dev);
         chip->parent = pctrl->dev;
         chip->base = -1;
-        chip->irq_need_valid_mask = true;
+        chip->irq_need_valid_mask = need_valid_mask;
 
         ret = devm_gpiochip_add_data(pctrl->dev, chip, pctrl);
         if (ret) {
@@ -1567,7 +1589,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 intsel &= CHV_PADCTRL0_INTSEL_MASK;
                 intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
 
-                if (intsel >= pctrl->community->nirqs)
+                if (need_valid_mask && intsel >= pctrl->community->nirqs)
                         clear_bit(i, chip->irq_valid_mask);
         }
 
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 7671424d46cb..31a3a98d067c 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -667,11 +667,11 @@ static const char * const uart_ao_b_groups[] = {
 };
 
 static const char * const i2c_ao_groups[] = {
-        "i2c_sdk_ao", "i2c_sda_ao",
+        "i2c_sck_ao", "i2c_sda_ao",
 };
 
 static const char * const i2c_slave_ao_groups[] = {
-        "i2c_slave_sdk_ao", "i2c_slave_sda_ao",
+        "i2c_slave_sck_ao", "i2c_slave_sda_ao",
 };
 
 static const char * const remote_input_ao_groups[] = {
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 8b2d45e85bae..9c267dcda094 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1781,7 +1781,7 @@ static int pcs_probe(struct platform_device *pdev)
         dev_info(pcs->dev, "%i pins at pa %p size %u\n",
                  pcs->desc.npins, pcs->base, pcs->size);
 
-        return 0;
+        return pinctrl_enable(pcs->pctl);
 
 free:
         pcs_free_resources(pcs);
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 676efcc032d2..3ae8066bc127 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1285,6 +1285,22 @@ static void st_gpio_irq_unmask(struct irq_data *d)
         writel(BIT(d->hwirq), bank->base + REG_PIO_SET_PMASK);
 }
 
+static int st_gpio_irq_request_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        st_gpio_direction_input(gc, d->hwirq);
+
+        return gpiochip_lock_as_irq(gc, d->hwirq);
+}
+
+static void st_gpio_irq_release_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        gpiochip_unlock_as_irq(gc, d->hwirq);
+}
+
 static int st_gpio_irq_set_type(struct irq_data *d, unsigned type)
 {
         struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1438,12 +1454,14 @@ static struct gpio_chip st_gpio_template = {
 };
 
 static struct irq_chip st_gpio_irqchip = {
-        .name           = "GPIO",
-        .irq_disable    = st_gpio_irq_mask,
-        .irq_mask       = st_gpio_irq_mask,
-        .irq_unmask     = st_gpio_irq_unmask,
-        .irq_set_type   = st_gpio_irq_set_type,
-        .flags          = IRQCHIP_SKIP_SET_WAKE,
+        .name                   = "GPIO",
+        .irq_request_resources  = st_gpio_irq_request_resources,
+        .irq_release_resources  = st_gpio_irq_release_resources,
+        .irq_disable            = st_gpio_irq_mask,
+        .irq_mask               = st_gpio_irq_mask,
+        .irq_unmask             = st_gpio_irq_unmask,
+        .irq_set_type           = st_gpio_irq_set_type,
+        .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
 static int st_gpiolib_register_bank(struct st_pinctrl *info,
diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
index b68ae424cee2..743d1f458205 100644
--- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
+++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
@@ -405,6 +405,36 @@ static const struct msm_pingroup ipq4019_groups[] = {
         PINGROUP(67, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(68, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(69, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(73, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(74, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(75, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(76, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(77, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(78, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(79, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(80, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(81, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(82, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(83, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(84, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(85, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(86, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(87, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(88, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(89, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(90, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(91, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(92, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(93, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(94, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 };
 
 static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index c978be5eb9eb..273badd92561 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -609,10 +609,6 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
 
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
-        val = readl(pctrl->regs + g->intr_status_reg);
-        val &= ~BIT(g->intr_status_bit);
-        writel(val, pctrl->regs + g->intr_status_reg);
-
         val = readl(pctrl->regs + g->intr_cfg_reg);
         val |= BIT(g->intr_enable_bit);
         writel(val, pctrl->regs + g->intr_cfg_reg);
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index f9b49967f512..63e51b56a22a 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -1468,82 +1468,82 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
 
 /* pin banks of exynos5433 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks0[] __initconst = {
-        EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
-        EXYNOS_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
-        EXYNOS_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
 };
 
 /* pin banks of exynos5433 pin-controller - AUD */
 static const struct samsung_pin_bank_data exynos5433_pin_banks1[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
 /* pin banks of exynos5433 pin-controller - CPIF */
 static const struct samsung_pin_bank_data exynos5433_pin_banks2[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - eSE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks3[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FINGER */
 static const struct samsung_pin_bank_data exynos5433_pin_banks4[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FSYS */
 static const struct samsung_pin_bank_data exynos5433_pin_banks5[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
-        EXYNOS_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
-        EXYNOS_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
 };
 
 /* pin banks of exynos5433 pin-controller - IMEM */
 static const struct samsung_pin_bank_data exynos5433_pin_banks6[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - NFC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks7[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - PERIC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks8[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
-        EXYNOS_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
-        EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
-        EXYNOS_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
-        EXYNOS_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
-        EXYNOS_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
-        EXYNOS_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
-        EXYNOS_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
-        EXYNOS_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
 };
 
 /* pin banks of exynos5433 pin-controller - TOUCH */
 static const struct samsung_pin_bank_data exynos5433_pin_banks9[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
 };
 
 /*
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.h b/drivers/pinctrl/samsung/pinctrl-exynos.h
index a473092fb8d2..cd046eb7d705 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.h
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.h
@@ -79,17 +79,6 @@
                 .name           = id                    \
         }
 
-#define EXYNOS_PIN_BANK_EINTW_EXT(pins, reg, id, offs, pctl_idx) \
-        {                                               \
-                .type           = &bank_type_alive,     \
-                .pctl_offset    = reg,                  \
-                .nr_pins        = pins,                 \
-                .eint_type      = EINT_TYPE_WKUP,       \
-                .eint_offset    = offs,                 \
-                .name           = id,                   \
-                .pctl_res_idx   = pctl_idx,             \
-        }                                               \
-
 #define EXYNOS5433_PIN_BANK_EINTG(pins, reg, id, offs)          \
         {                                                       \
                 .type           = &exynos5433_bank_type_off,    \
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index f9ddba7decc1..d7aa22cff480 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -988,9 +988,16 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
 
         for (i = 0; i < ctrl->nr_ext_resources + 1; i++) {
                 res = platform_get_resource(pdev, IORESOURCE_MEM, i);
-                virt_base[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(virt_base[i]))
-                        return ERR_CAST(virt_base[i]);
+                if (!res) {
+                        dev_err(&pdev->dev, "failed to get mem%d resource\n", i);
+                        return ERR_PTR(-EINVAL);
+                }
+                virt_base[i] = devm_ioremap(&pdev->dev, res->start,
+                                                resource_size(res));
+                if (!virt_base[i]) {
+                        dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                        return ERR_PTR(-EIO);
+                }
         }
 
         bank = d->pin_banks;
diff --git a/drivers/pinctrl/sh-pfc/pinctrl.c b/drivers/pinctrl/sh-pfc/pinctrl.c
index 08150a321be6..a70157f0acf4 100644
--- a/drivers/pinctrl/sh-pfc/pinctrl.c
+++ b/drivers/pinctrl/sh-pfc/pinctrl.c
@@ -816,6 +816,13 @@ int sh_pfc_register_pinctrl(struct sh_pfc *pfc)
         pmx->pctl_desc.pins = pmx->pins;
         pmx->pctl_desc.npins = pfc->info->nr_pins;
 
-        return devm_pinctrl_register_and_init(pfc->dev, &pmx->pctl_desc, pmx,
-                                              &pmx->pctl);
+        ret = devm_pinctrl_register_and_init(pfc->dev, &pmx->pctl_desc, pmx,
+                                             &pmx->pctl);
+        if (ret) {
+                dev_err(pfc->dev, "could not register: %i\n", ret);
+
+                return ret;
+        }
+
+        return pinctrl_enable(pmx->pctl);
 }
diff --git a/drivers/pinctrl/ti/Kconfig b/drivers/pinctrl/ti/Kconfig
index 815a88673d38..542077069391 100644
--- a/drivers/pinctrl/ti/Kconfig
+++ b/drivers/pinctrl/ti/Kconfig
@@ -1,6 +1,6 @@
 config PINCTRL_TI_IODELAY
         tristate "TI IODelay Module pinconf driver"
-        depends on OF
+        depends on OF && (SOC_DRA7XX || COMPILE_TEST)
         select GENERIC_PINCTRL_GROUPS
         select GENERIC_PINMUX_FUNCTIONS
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
index 717e3404900c..362c50918c13 100644
--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
@@ -893,6 +893,8 @@ static int ti_iodelay_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, iod);
 
+        return pinctrl_enable(iod->pctl);
+
 exit_out:
         of_node_put(np);
         return ret;
diff --git a/drivers/ptp/ptp_kvm.c b/drivers/ptp/ptp_kvm.c
index 09b4df74291e..bb865695d7a6 100644
--- a/drivers/ptp/ptp_kvm.c
+++ b/drivers/ptp/ptp_kvm.c
@@ -193,10 +193,7 @@ static int __init ptp_kvm_init(void)
 
         kvm_ptp_clock.ptp_clock = ptp_clock_register(&kvm_ptp_clock.caps, NULL);
 
-        if (IS_ERR(kvm_ptp_clock.ptp_clock))
-                return PTR_ERR(kvm_ptp_clock.ptp_clock);
-
-        return 0;
+        return PTR_ERR_OR_ZERO(kvm_ptp_clock.ptp_clock);
 }
 
 module_init(ptp_kvm_init);
diff --git a/drivers/pwm/pwm-lpss-pci.c b/drivers/pwm/pwm-lpss-pci.c
index 053088b9b66e..c1527cb645be 100644
--- a/drivers/pwm/pwm-lpss-pci.c
+++ b/drivers/pwm/pwm-lpss-pci.c
@@ -36,6 +36,14 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
+};
+
+/* Tangier */
+static const struct pwm_lpss_boardinfo pwm_lpss_tng_info = {
+        .clk_rate = 19200000,
+        .npwm = 4,
+        .base_unit_bits = 22,
 };
 
 static int pwm_lpss_probe_pci(struct pci_dev *pdev,
@@ -97,7 +105,7 @@ static const struct pci_device_id pwm_lpss_pci_ids[] = {
         { PCI_VDEVICE(INTEL, 0x0ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x0f08), (unsigned long)&pwm_lpss_byt_info},
         { PCI_VDEVICE(INTEL, 0x0f09), (unsigned long)&pwm_lpss_byt_info},
-        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_bxt_info},
+        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_tng_info},
         { PCI_VDEVICE(INTEL, 0x1ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x2288), (unsigned long)&pwm_lpss_bsw_info},
         { PCI_VDEVICE(INTEL, 0x2289), (unsigned long)&pwm_lpss_bsw_info},
diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c
index b22b6fdadb9a..5d6ed1507d29 100644
--- a/drivers/pwm/pwm-lpss-platform.c
+++ b/drivers/pwm/pwm-lpss-platform.c
@@ -37,6 +37,7 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
 };
 
 static int pwm_lpss_probe_platform(struct platform_device *pdev)
diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 689d2c1cbead..8db0d40ccacd 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -57,7 +57,7 @@ static inline void pwm_lpss_write(const struct pwm_device *pwm, u32 value)
         writel(value, lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM);
 }
 
-static int pwm_lpss_update(struct pwm_device *pwm)
+static int pwm_lpss_wait_for_update(struct pwm_device *pwm)
 {
         struct pwm_lpss_chip *lpwm = to_lpwm(pwm->chip);
         const void __iomem *addr = lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM;
@@ -65,8 +65,6 @@ static int pwm_lpss_update(struct pwm_device *pwm)
         u32 val;
         int err;
 
-        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
-
         /*
          * PWM Configuration register has SW_UPDATE bit that is set when a new
          * configuration is written to the register. The bit is automatically
@@ -122,6 +120,12 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
         pwm_lpss_write(pwm, ctrl);
 }
 
+static inline void pwm_lpss_cond_enable(struct pwm_device *pwm, bool cond)
+{
+        if (cond)
+                pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+}
+
 static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                           struct pwm_state *state)
 {
@@ -137,18 +141,21 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                                 return ret;
                         }
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        ret = pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == false);
+                        ret = pwm_lpss_wait_for_update(pwm);
                         if (ret) {
                                 pm_runtime_put(chip->dev);
                                 return ret;
                         }
-                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == true);
                 } else {
                         ret = pwm_lpss_is_updating(pwm);
                         if (ret)
                                 return ret;
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        return pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        return pwm_lpss_wait_for_update(pwm);
                 }
         } else if (pwm_is_enabled(pwm)) {
                 pwm_lpss_write(pwm, pwm_lpss_read(pwm) & ~PWM_ENABLE);
diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h
index c94cd7c2695d..98306bb02cfe 100644
--- a/drivers/pwm/pwm-lpss.h
+++ b/drivers/pwm/pwm-lpss.h
@@ -22,6 +22,7 @@ struct pwm_lpss_boardinfo {
         unsigned long clk_rate;
         unsigned int npwm;
         unsigned long base_unit_bits;
+        bool bypass;
 };
 
 struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index ef89df1f7336..744d56197286 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -191,6 +191,28 @@ static int rockchip_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         return 0;
 }
 
+static int rockchip_pwm_enable(struct pwm_chip *chip,
+                         struct pwm_device *pwm,
+                         bool enable,
+                         enum pwm_polarity polarity)
+{
+        struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
+        int ret;
+
+        if (enable) {
+                ret = clk_enable(pc->clk);
+                if (ret)
+                        return ret;
+        }
+
+        pc->data->set_enable(chip, pwm, enable, polarity);
+
+        if (!enable)
+                clk_disable(pc->clk);
+
+        return 0;
+}
+
 static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                               struct pwm_state *state)
 {
@@ -207,22 +229,26 @@ static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                 return ret;
 
         if (state->polarity != curstate.polarity && enabled) {
-                pc->data->set_enable(chip, pwm, false, state->polarity);
+                ret = rockchip_pwm_enable(chip, pwm, false, state->polarity);
+                if (ret)
+                        goto out;
                 enabled = false;
         }
 
         ret = rockchip_pwm_config(chip, pwm, state->duty_cycle, state->period);
         if (ret) {
                 if (enabled != curstate.enabled)
-                        pc->data->set_enable(chip, pwm, !enabled,
-                                             state->polarity);
-
+                        rockchip_pwm_enable(chip, pwm, !enabled,
+                                      state->polarity);
                 goto out;
         }
 
-        if (state->enabled != enabled)
-                pc->data->set_enable(chip, pwm, state->enabled,
-                                     state->polarity);
+        if (state->enabled != enabled) {
+                ret = rockchip_pwm_enable(chip, pwm, state->enabled,
+                                    state->polarity);
+                if (ret)
+                        goto out;
+        }
 
         /*
          * Update the state with the real hardware, which can differ a bit
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 9d19b9a62011..315a4be8dc1e 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -37,8 +37,8 @@
 #include "tsi721.h"
 
 #ifdef DEBUG
-u32 dbg_level;
-module_param(dbg_level, uint, S_IWUSR | S_IRUGO);
+u32 tsi_dbg_level;
+module_param_named(dbg_level, tsi_dbg_level, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(dbg_level, "Debugging output level (default 0 = none)");
 #endif
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 5941437cbdd1..957eadc58150 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -40,11 +40,11 @@ enum {
 };
 
 #ifdef DEBUG
-extern u32 dbg_level;
+extern u32 tsi_dbg_level;
 
 #define tsi_debug(level, dev, fmt, arg...)                              \
         do {                                                            \
-                if (DBG_##level & dbg_level)                            \
+                if (DBG_##level & tsi_dbg_level)                                \
                         dev_dbg(dev, "%s: " fmt "\n", __func__, ##arg); \
         } while (0)
 #else
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index 65f86bc24c07..1dc43fc5f65f 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -76,7 +76,7 @@ config QCOM_ADSP_PIL
         depends on OF && ARCH_QCOM
         depends on REMOTEPROC
         depends on QCOM_SMEM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
@@ -93,7 +93,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on REMOTEPROC
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -104,7 +104,7 @@ config QCOM_Q6V5_PIL
 config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         depends on QCOM_SMEM
         depends on REMOTEPROC
         select QCOM_MDT_LOADER
diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index f1e5e65388bb..cd739d2fa160 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -275,7 +275,7 @@ int reset_control_status(struct reset_control *rstc)
 }
 EXPORT_SYMBOL_GPL(reset_control_status);
 
-static struct reset_control *__reset_control_get(
+static struct reset_control *__reset_control_get_internal(
                                 struct reset_controller_dev *rcdev,
                                 unsigned int index, bool shared)
 {
@@ -308,7 +308,7 @@ static struct reset_control *__reset_control_get(
         return rstc;
 }
 
-static void __reset_control_put(struct reset_control *rstc)
+static void __reset_control_put_internal(struct reset_control *rstc)
 {
         lockdep_assert_held(&reset_list_mutex);
 
@@ -377,7 +377,7 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
         }
 
         /* reset_list_mutex also protects the rcdev's reset_control list */
-        rstc = __reset_control_get(rcdev, rstc_id, shared);
+        rstc = __reset_control_get_internal(rcdev, rstc_id, shared);
 
         mutex_unlock(&reset_list_mutex);
 
@@ -385,6 +385,17 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
 }
 EXPORT_SYMBOL_GPL(__of_reset_control_get);
 
+struct reset_control *__reset_control_get(struct device *dev, const char *id,
+                                          int index, bool shared, bool optional)
+{
+        if (dev->of_node)
+                return __of_reset_control_get(dev->of_node, id, index, shared,
+                                              optional);
+
+        return optional ? NULL : ERR_PTR(-EINVAL);
+}
+EXPORT_SYMBOL_GPL(__reset_control_get);
+
 /**
  * reset_control_put - free the reset controller
  * @rstc: reset controller
@@ -396,7 +407,7 @@ void reset_control_put(struct reset_control *rstc)
                 return;
 
         mutex_lock(&reset_list_mutex);
-        __reset_control_put(rstc);
+        __reset_control_put_internal(rstc);
         mutex_unlock(&reset_list_mutex);
 }
 EXPORT_SYMBOL_GPL(reset_control_put);
@@ -417,8 +428,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev,
         if (!ptr)
                 return ERR_PTR(-ENOMEM);
 
-        rstc = __of_reset_control_get(dev ? dev->of_node : NULL,
-                                      id, index, shared, optional);
+        rstc = __reset_control_get(dev, id, index, shared, optional);
         if (!IS_ERR(rstc)) {
                 *ptr = rstc;
                 devres_add(dev, ptr);
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 40f1136f5568..058db724b5a2 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -572,6 +572,12 @@ int pkey_sec2protkey(u16 cardnr, u16 domain,
                 rc = -EIO;
                 goto out;
         }
+        if (prepcblk->ccp_rscode != 0) {
+                DEBUG_WARN(
+                        "pkey_sec2protkey unwrap secure key warning, card response %d/%d\n",
+                        (int) prepcblk->ccp_rtcode,
+                        (int) prepcblk->ccp_rscode);
+        }
 
         /* process response cprb param block */
         prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
@@ -761,9 +767,10 @@ out:
 }
 
 /*
- * Fetch just the mkvp value via query_crypto_facility from adapter.
+ * Fetch the current and old mkvp values via
+ * query_crypto_facility from adapter.
  */
-static int fetch_mkvp(u16 cardnr, u16 domain, u64 *mkvp)
+static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int rc, found = 0;
         size_t rlen, vlen;
@@ -779,9 +786,10 @@ static int fetch_mkvp(u16 cardnr, u16 domain, u64 *mkvp)
         rc = query_crypto_facility(cardnr, domain, "STATICSA",
                                    rarray, &rlen, varray, &vlen);
         if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
-                if (rarray[64] == '2') {
+                if (rarray[8*8] == '2') {
                         /* current master key state is valid */
-                        *mkvp = *((u64 *)(varray + 184));
+                        mkvp[0] = *((u64 *)(varray + 184));
+                        mkvp[1] = *((u64 *)(varray + 172));
                         found = 1;
                 }
         }
@@ -796,14 +804,14 @@ struct mkvp_info {
         struct list_head list;
         u16 cardnr;
         u16 domain;
-        u64 mkvp;
+        u64 mkvp[2];
 };
 
 /* a list with mkvp_info entries */
 static LIST_HEAD(mkvp_list);
 static DEFINE_SPINLOCK(mkvp_list_lock);
 
-static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
+static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int rc = -ENOENT;
         struct mkvp_info *ptr;
@@ -812,7 +820,7 @@ static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
         list_for_each_entry(ptr, &mkvp_list, list) {
                 if (ptr->cardnr == cardnr &&
                     ptr->domain == domain) {
-                        *mkvp = ptr->mkvp;
+                        memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
                         rc = 0;
                         break;
                 }
@@ -822,7 +830,7 @@ static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
         return rc;
 }
 
-static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
+static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int found = 0;
         struct mkvp_info *ptr;
@@ -831,7 +839,7 @@ static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
         list_for_each_entry(ptr, &mkvp_list, list) {
                 if (ptr->cardnr == cardnr &&
                     ptr->domain == domain) {
-                        ptr->mkvp = mkvp;
+                        memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
                         found = 1;
                         break;
                 }
@@ -844,7 +852,7 @@ static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
                 }
                 ptr->cardnr = cardnr;
                 ptr->domain = domain;
-                ptr->mkvp = mkvp;
+                memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
                 list_add(&ptr->list, &mkvp_list);
         }
         spin_unlock_bh(&mkvp_list_lock);
@@ -888,8 +896,8 @@ int pkey_findcard(const struct pkey_seckey *seckey,
         struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
         struct zcrypt_device_matrix *device_matrix;
         u16 card, dom;
-        u64 mkvp;
-        int i, rc;
+        u64 mkvp[2];
+        int i, rc, oi = -1;
 
         /* mkvp must not be zero */
         if (t->mkvp == 0)
@@ -910,14 +918,14 @@ int pkey_findcard(const struct pkey_seckey *seckey,
                     device_matrix->device[i].functions & 0x04) {
                         /* an enabled CCA Coprocessor card */
                         /* try cached mkvp */
-                        if (mkvp_cache_fetch(card, dom, &mkvp) == 0 &&
-                            t->mkvp == mkvp) {
+                        if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
+                            t->mkvp == mkvp[0]) {
                                 if (!verify)
                                         break;
                                 /* verify: fetch mkvp from adapter */
-                                if (fetch_mkvp(card, dom, &mkvp) == 0) {
+                                if (fetch_mkvp(card, dom, mkvp) == 0) {
                                         mkvp_cache_update(card, dom, mkvp);
-                                        if (t->mkvp == mkvp)
+                                        if (t->mkvp == mkvp[0])
                                                 break;
                                 }
                         }
@@ -936,14 +944,21 @@ int pkey_findcard(const struct pkey_seckey *seckey,
                         card = AP_QID_CARD(device_matrix->device[i].qid);
                         dom = AP_QID_QUEUE(device_matrix->device[i].qid);
                         /* fresh fetch mkvp from adapter */
-                        if (fetch_mkvp(card, dom, &mkvp) == 0) {
+                        if (fetch_mkvp(card, dom, mkvp) == 0) {
                                 mkvp_cache_update(card, dom, mkvp);
-                                if (t->mkvp == mkvp)
+                                if (t->mkvp == mkvp[0])
                                         break;
+                                if (t->mkvp == mkvp[1] && oi < 0)
+                                        oi = i;
                         }
                 }
+                if (i >= MAX_ZDEV_ENTRIES && oi >= 0) {
+                        /* old mkvp matched, use this card then */
+                        card = AP_QID_CARD(device_matrix->device[oi].qid);
+                        dom = AP_QID_QUEUE(device_matrix->device[oi].qid);
+                }
         }
-        if (i < MAX_ZDEV_ENTRIES) {
+        if (i < MAX_ZDEV_ENTRIES || oi >= 0) {
                 if (pcardnr)
                         *pcardnr = card;
                 if (pdomain)
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index e7addea8741b..d9561e39c3b2 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -961,7 +961,8 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
 int qeth_bridgeport_setrole(struct qeth_card *card, enum qeth_sbp_roles role);
 int qeth_bridgeport_an_set(struct qeth_card *card, int enable);
 int qeth_get_priority_queue(struct qeth_card *, struct sk_buff *, int, int);
-int qeth_get_elements_no(struct qeth_card *, struct sk_buff *, int);
+int qeth_get_elements_no(struct qeth_card *card, struct sk_buff *skb,
+                         int extra_elems, int data_offset);
 int qeth_get_elements_for_frags(struct sk_buff *);
 int qeth_do_send_packet_fast(struct qeth_card *, struct qeth_qdio_out_q *,
                         struct sk_buff *, struct qeth_hdr *, int, int, int);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 315d8a2db7c0..9a5f99ccb122 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3837,6 +3837,7 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
  * @card:                       qeth card structure, to check max. elems.
  * @skb:                        SKB address
  * @extra_elems:                extra elems needed, to check against max.
+ * @data_offset:                range starts at skb->data + data_offset
  *
  * Returns the number of pages, and thus QDIO buffer elements, needed to cover
  * skb data, including linear part and fragments. Checks if the result plus
@@ -3844,10 +3845,10 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
  * Note: extra_elems is not included in the returned result.
  */
 int qeth_get_elements_no(struct qeth_card *card,
-                     struct sk_buff *skb, int extra_elems)
+                     struct sk_buff *skb, int extra_elems, int data_offset)
 {
         int elements = qeth_get_elements_for_range(
-                                (addr_t)skb->data,
+                                (addr_t)skb->data + data_offset,
                                 (addr_t)skb->data + skb_headlen(skb)) +
                         qeth_get_elements_for_frags(skb);
 
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index bea483307618..af4e6a639fec 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -849,7 +849,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * chaining we can not send long frag lists
          */
         if ((card->info.type != QETH_CARD_TYPE_IQD) &&
-            !qeth_get_elements_no(card, new_skb, 0)) {
+            !qeth_get_elements_no(card, new_skb, 0, 0)) {
                 int lin_rc = skb_linearize(new_skb);
 
                 if (card->options.performance_stats) {
@@ -894,7 +894,8 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-        elements = qeth_get_elements_no(card, new_skb, elements_needed);
+        elements = qeth_get_elements_no(card, new_skb, elements_needed,
+                                        (data_offset > 0) ? data_offset : 0);
         if (!elements) {
                 if (data_offset >= 0)
                         kmem_cache_free(qeth_core_header_cache, hdr);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 06d0addcc058..653f0fb76573 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2609,17 +2609,13 @@ static void qeth_l3_fill_af_iucv_hdr(struct qeth_card *card,
         char daddr[16];
         struct af_iucv_trans_hdr *iucv_hdr;
 
-        skb_pull(skb, 14);
-        card->dev->header_ops->create(skb, card->dev, 0,
-                                      card->dev->dev_addr, card->dev->dev_addr,
-                                      card->dev->addr_len);
-        skb_pull(skb, 14);
-        iucv_hdr = (struct af_iucv_trans_hdr *)skb->data;
         memset(hdr, 0, sizeof(struct qeth_hdr));
         hdr->hdr.l3.id = QETH_HEADER_TYPE_LAYER3;
         hdr->hdr.l3.ext_flags = 0;
-        hdr->hdr.l3.length = skb->len;
+        hdr->hdr.l3.length = skb->len - ETH_HLEN;
         hdr->hdr.l3.flags = QETH_HDR_IPV6 | QETH_CAST_UNICAST;
+
+        iucv_hdr = (struct af_iucv_trans_hdr *) (skb->data + ETH_HLEN);
         memset(daddr, 0, sizeof(daddr));
         daddr[0] = 0xfe;
         daddr[1] = 0x80;
@@ -2823,10 +2819,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if ((card->info.type == QETH_CARD_TYPE_IQD) &&
             !skb_is_nonlinear(skb)) {
                 new_skb = skb;
-                if (new_skb->protocol == ETH_P_AF_IUCV)
-                        data_offset = 0;
-                else
-                        data_offset = ETH_HLEN;
+                data_offset = ETH_HLEN;
                 hdr = kmem_cache_alloc(qeth_core_header_cache, GFP_ATOMIC);
                 if (!hdr)
                         goto tx_drop;
@@ -2867,7 +2860,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         if ((card->info.type != QETH_CARD_TYPE_IQD) &&
             ((use_tso && !qeth_l3_get_elements_no_tso(card, new_skb, 1)) ||
-             (!use_tso && !qeth_get_elements_no(card, new_skb, 0)))) {
+             (!use_tso && !qeth_get_elements_no(card, new_skb, 0, 0)))) {
                 int lin_rc = skb_linearize(new_skb);
 
                 if (card->options.performance_stats) {
@@ -2909,7 +2902,8 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         elements = use_tso ?
                    qeth_l3_get_elements_no_tso(card, new_skb, hdr_elements) :
-                   qeth_get_elements_no(card, new_skb, hdr_elements);
+                   qeth_get_elements_no(card, new_skb, hdr_elements,
+                                        (data_offset > 0) ? data_offset : 0);
         if (!elements) {
                 if (data_offset >= 0)
                         kmem_cache_free(qeth_core_header_cache, hdr);
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 4bf55b5d78be..3c52867dfe28 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1253,20 +1253,6 @@ config SCSI_LPFC_DEBUG_FS
           This makes debugging information from the lpfc driver
           available via the debugfs filesystem.
 
-config LPFC_NVME_INITIATOR
-        bool "Emulex LightPulse Fibre Channel NVME Initiator Support"
-        depends on SCSI_LPFC && NVME_FC
-        ---help---
-          This enables NVME Initiator support in the Emulex lpfc driver.
-
-config LPFC_NVME_TARGET
-        bool "Emulex LightPulse Fibre Channel NVME Initiator Support"
-        depends on SCSI_LPFC && NVME_TARGET_FC
-        ---help---
-          This enables NVME Target support in the Emulex lpfc driver.
-          Target enablement must still be enabled on a per adapter
-          basis by module parameters.
-
 config SCSI_SIM710
         tristate "Simple 53c710 SCSI support (Compaq, NCR machines)"
         depends on (EISA || MCA) && SCSI
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d036a806f31c..d281492009fb 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1690,9 +1690,6 @@ struct aac_dev
 #define aac_adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4) \
         (dev)->a_ops.adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4)
 
-#define aac_adapter_check_health(dev) \
-        (dev)->a_ops.adapter_check_health(dev)
-
 #define aac_adapter_restart(dev, bled, reset_type) \
         ((dev)->a_ops.adapter_restart(dev, bled, reset_type))
 
@@ -2615,6 +2612,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
         return capacity;
 }
 
+static inline int aac_adapter_check_health(struct aac_dev *dev)
+{
+        if (unlikely(pci_channel_offline(dev->pdev)))
+                return -1;
+
+        return (dev)->a_ops.adapter_check_health(dev);
+}
+
 /* SCp.phase values */
 #define AAC_OWNER_MIDLEVEL      0x101
 #define AAC_OWNER_LOWLEVEL      0x102
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index a3ad04293487..1f4918355fdb 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1873,7 +1873,8 @@ int aac_check_health(struct aac_dev * aac)
         spin_unlock_irqrestore(&aac->fib_lock, flagv);
 
         if (BlinkLED < 0) {
-                printk(KERN_ERR "%s: Host adapter dead %d\n", aac->name, BlinkLED);
+                printk(KERN_ERR "%s: Host adapter is dead (or got a PCI error) %d\n",
+                                aac->name, BlinkLED);
                 goto out;
         }
 
@@ -2056,7 +2057,6 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
 {
         struct hw_fib **hw_fib_p;
         struct fib **fib_p;
-        int rcode = 1;
 
         hw_fib_p = hw_fib_pool;
         fib_p = fib_pool;
@@ -2074,11 +2074,11 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
                 }
         }
 
+        /*
+         * Get the actual number of allocated fibs
+         */
         num = hw_fib_p - hw_fib_pool;
-        if (!num)
-                rcode = 0;
-
-        return rcode;
+        return num;
 }
 
 static void wakeup_fibctx_threads(struct aac_dev *dev,
@@ -2186,7 +2186,6 @@ static void aac_process_events(struct aac_dev *dev)
         struct fib *fib;
         unsigned long flags;
         spinlock_t *t_lock;
-        unsigned int rcode;
 
         t_lock = dev->queues->queue[HostNormCmdQueue].lock;
         spin_lock_irqsave(t_lock, flags);
@@ -2269,8 +2268,8 @@ static void aac_process_events(struct aac_dev *dev)
                  * Fill up fib pointer pools with actual fibs
                  * and hw_fibs
                  */
-                rcode = fillup_pools(dev, hw_fib_pool, fib_pool, num);
-                if (!rcode)
+                num = fillup_pools(dev, hw_fib_pool, fib_pool, num);
+                if (!num)
                         goto free_mem;
 
                 /*
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 48e200102221..c01b47e5b55a 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -113,7 +113,7 @@ struct alua_queue_data {
 #define ALUA_POLICY_SWITCH_ALL          1
 
 static void alua_rtpg_work(struct work_struct *work);
-static void alua_rtpg_queue(struct alua_port_group *pg,
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force);
 static void alua_check(struct scsi_device *sdev, bool force);
@@ -862,7 +862,13 @@ static void alua_rtpg_work(struct work_struct *work)
         kref_put(&pg->kref, release_port_group);
 }
 
-static void alua_rtpg_queue(struct alua_port_group *pg,
+/**
+ * alua_rtpg_queue() - cause RTPG to be submitted asynchronously
+ *
+ * Returns true if and only if alua_rtpg_work() will be called asynchronously.
+ * That function is responsible for calling @qdata->fn().
+ */
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force)
 {
@@ -870,8 +876,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
         unsigned long flags;
         struct workqueue_struct *alua_wq = kaluad_wq;
 
-        if (!pg)
-                return;
+        if (WARN_ON_ONCE(!pg) || scsi_device_get(sdev))
+                return false;
 
         spin_lock_irqsave(&pg->lock, flags);
         if (qdata) {
@@ -884,14 +890,12 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 kref_get(&pg->kref);
                 pg->rtpg_sdev = sdev;
-                scsi_device_get(sdev);
                 start_queue = 1;
         } else if (!(pg->flags & ALUA_PG_RUN_RTPG) && force) {
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 /* Do not queue if the worker is already running */
                 if (!(pg->flags & ALUA_PG_RUNNING)) {
                         kref_get(&pg->kref);
-                        sdev = NULL;
                         start_queue = 1;
                 }
         }
@@ -900,13 +904,17 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 alua_wq = kaluad_sync_wq;
         spin_unlock_irqrestore(&pg->lock, flags);
 
-        if (start_queue &&
-            !queue_delayed_work(alua_wq, &pg->rtpg_work,
-                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                if (sdev)
-                        scsi_device_put(sdev);
-                kref_put(&pg->kref, release_port_group);
+        if (start_queue) {
+                if (queue_delayed_work(alua_wq, &pg->rtpg_work,
+                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS)))
+                        sdev = NULL;
+                else
+                        kref_put(&pg->kref, release_port_group);
         }
+        if (sdev)
+                scsi_device_put(sdev);
+
+        return true;
 }
 
 /*
@@ -1007,11 +1015,13 @@ static int alua_activate(struct scsi_device *sdev,
                 mutex_unlock(&h->init_mutex);
                 goto out;
         }
-        fn = NULL;
         rcu_read_unlock();
         mutex_unlock(&h->init_mutex);
 
-        alua_rtpg_queue(pg, sdev, qdata, true);
+        if (alua_rtpg_queue(pg, sdev, qdata, true))
+                fn = NULL;
+        else
+                err = SCSI_DH_DEV_OFFLINED;
         kref_put(&pg->kref, release_port_group);
 out:
         if (fn)
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 524a0c755ed7..9d659aaace15 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2956,7 +2956,7 @@ static int hpsa_send_reset(struct ctlr_info *h, unsigned char *scsi3addr,
         /* fill_cmd can't fail here, no data buffer to map. */
         (void) fill_cmd(c, reset_type, h, NULL, 0, 0,
                         scsi3addr, TYPE_MSG);
-        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, DEFAULT_TIMEOUT);
+        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
         if (rc) {
                 dev_warn(&h->pdev->dev, "Failed to send reset command\n");
                 goto out;
@@ -3714,7 +3714,7 @@ exit_failed:
  *  # (integer code indicating one of several NOT READY states
  *     describing why a volume is to be kept offline)
  */
-static int hpsa_volume_offline(struct ctlr_info *h,
+static unsigned char hpsa_volume_offline(struct ctlr_info *h,
                                         unsigned char scsi3addr[])
 {
         struct CommandList *c;
@@ -3735,7 +3735,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
                                         DEFAULT_TIMEOUT);
         if (rc) {
                 cmd_free(h, c);
-                return 0;
+                return HPSA_VPD_LV_STATUS_UNSUPPORTED;
         }
         sense = c->err_info->SenseInfo;
         if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo))
@@ -3746,19 +3746,13 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         cmd_status = c->err_info->CommandStatus;
         scsi_status = c->err_info->ScsiStatus;
         cmd_free(h, c);
-        /* Is the volume 'not ready'? */
-        if (cmd_status != CMD_TARGET_STATUS ||
-                scsi_status != SAM_STAT_CHECK_CONDITION ||
-                sense_key != NOT_READY ||
-                asc != ASC_LUN_NOT_READY)  {
-                return 0;
-        }
 
         /* Determine the reason for not ready state */
         ldstat = hpsa_get_volume_status(h, scsi3addr);
 
         /* Keep volume offline in certain cases: */
         switch (ldstat) {
+        case HPSA_LV_FAILED:
         case HPSA_LV_UNDERGOING_ERASE:
         case HPSA_LV_NOT_AVAILABLE:
         case HPSA_LV_UNDERGOING_RPI:
@@ -3780,7 +3774,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         default:
                 break;
         }
-        return 0;
+        return HPSA_LV_OK;
 }
 
 /*
@@ -3853,10 +3847,10 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         /* Do an inquiry to the device to see what it is. */
         if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
                 (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
-                /* Inquiry failed (msg printed already) */
                 dev_err(&h->pdev->dev,
-                        "hpsa_update_device_info: inquiry failed\n");
-                rc = -EIO;
+                        "%s: inquiry failed, device will be skipped.\n",
+                        __func__);
+                rc = HPSA_INQUIRY_FAILED;
                 goto bail_out;
         }
 
@@ -3885,15 +3879,20 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         if ((this_device->devtype == TYPE_DISK ||
                 this_device->devtype == TYPE_ZBC) &&
                 is_logical_dev_addr_mode(scsi3addr)) {
-                int volume_offline;
+                unsigned char volume_offline;
 
                 hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level);
                 if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC)
                         hpsa_get_ioaccel_status(h, scsi3addr, this_device);
                 volume_offline = hpsa_volume_offline(h, scsi3addr);
-                if (volume_offline < 0 || volume_offline > 0xff)
-                        volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED;
-                this_device->volume_offline = volume_offline & 0xff;
+                this_device->volume_offline = volume_offline;
+                if (volume_offline == HPSA_LV_FAILED) {
+                        rc = HPSA_LV_FAILED;
+                        dev_err(&h->pdev->dev,
+                                "%s: LV failed, device will be skipped.\n",
+                                __func__);
+                        goto bail_out;
+                }
         } else {
                 this_device->raid_level = RAID_UNKNOWN;
                 this_device->offload_config = 0;
@@ -4379,8 +4378,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
                         goto out;
                 }
                 if (rc) {
-                        dev_warn(&h->pdev->dev,
-                                "Inquiry failed, skipping device.\n");
+                        h->drv_req_rescan = 1;
                         continue;
                 }
 
@@ -5558,7 +5556,7 @@ static void hpsa_scan_complete(struct ctlr_info *h)
 
         spin_lock_irqsave(&h->scan_lock, flags);
         h->scan_finished = 1;
-        wake_up_all(&h->scan_wait_queue);
+        wake_up(&h->scan_wait_queue);
         spin_unlock_irqrestore(&h->scan_lock, flags);
 }
 
@@ -5576,11 +5574,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
         if (unlikely(lockup_detected(h)))
                 return hpsa_scan_complete(h);
 
+        /*
+         * If a scan is already waiting to run, no need to add another
+         */
+        spin_lock_irqsave(&h->scan_lock, flags);
+        if (h->scan_waiting) {
+                spin_unlock_irqrestore(&h->scan_lock, flags);
+                return;
+        }
+
+        spin_unlock_irqrestore(&h->scan_lock, flags);
+
         /* wait until any scan already in progress is finished. */
         while (1) {
                 spin_lock_irqsave(&h->scan_lock, flags);
                 if (h->scan_finished)
                         break;
+                h->scan_waiting = 1;
                 spin_unlock_irqrestore(&h->scan_lock, flags);
                 wait_event(h->scan_wait_queue, h->scan_finished);
                 /* Note: We don't need to worry about a race between this
@@ -5590,6 +5600,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
                  */
         }
         h->scan_finished = 0; /* mark scan as in progress */
+        h->scan_waiting = 0;
         spin_unlock_irqrestore(&h->scan_lock, flags);
 
         if (unlikely(lockup_detected(h)))
@@ -8792,6 +8803,7 @@ reinit_after_soft_reset:
         init_waitqueue_head(&h->event_sync_wait_queue);
         mutex_init(&h->reset_mutex);
         h->scan_finished = 1; /* no scan currently in progress */
+        h->scan_waiting = 0;
 
         pci_set_drvdata(pdev, h);
         h->ndevices = 0;
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index bf6cdc106654..6f04f2ad4125 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -201,6 +201,7 @@ struct ctlr_info {
         dma_addr_t              errinfo_pool_dhandle;
         unsigned long           *cmd_pool_bits;
         int                     scan_finished;
+        u8                      scan_waiting : 1;
         spinlock_t              scan_lock;
         wait_queue_head_t       scan_wait_queue;
 
diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
index a584cdf07058..5961705eef76 100644
--- a/drivers/scsi/hpsa_cmd.h
+++ b/drivers/scsi/hpsa_cmd.h
@@ -156,6 +156,7 @@
 #define CFGTBL_BusType_Fibre2G  0x00000200l
 
 /* VPD Inquiry types */
+#define HPSA_INQUIRY_FAILED             0x02
 #define HPSA_VPD_SUPPORTED_PAGES        0x00
 #define HPSA_VPD_LV_DEVICE_ID           0x83
 #define HPSA_VPD_LV_DEVICE_GEOMETRY     0xC1
@@ -166,6 +167,7 @@
 /* Logical volume states */
 #define HPSA_VPD_LV_STATUS_UNSUPPORTED                  0xff
 #define HPSA_LV_OK                                      0x0
+#define HPSA_LV_FAILED                                  0x01
 #define HPSA_LV_NOT_AVAILABLE                           0x0b
 #define HPSA_LV_UNDERGOING_ERASE                        0x0F
 #define HPSA_LV_UNDERGOING_RPI                          0x12
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b29afafc2885..5d5e272fd815 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6293,7 +6293,12 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg,
                 break;
         case IPR_IOASC_MED_DO_NOT_REALLOC: /* prevent retries */
         case IPR_IOASA_IR_DUAL_IOA_DISABLED:
-                scsi_cmd->result |= (DID_PASSTHROUGH << 16);
+                /*
+                 * exception: do not set DID_PASSTHROUGH on CHECK CONDITION
+                 * so SCSI mid-layer and upper layers handle it accordingly.
+                 */
+                if (scsi_cmd->result != SAM_STAT_CHECK_CONDITION)
+                        scsi_cmd->result |= (DID_PASSTHROUGH << 16);
                 break;
         case IPR_IOASC_BUS_WAS_RESET:
         case IPR_IOASC_BUS_WAS_RESET_BY_OTHER:
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 763f012fdeca..87f5e694dbed 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -221,7 +221,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                 task->num_scatter = qc->n_elem;
         } else {
                 for_each_sg(qc->sg, sg, qc->n_elem, si)
-                        xfer += sg->length;
+                        xfer += sg_dma_len(sg);
 
                 task->total_xfer_len = xfer;
                 task->num_scatter = si;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5c3be3e6f5e2..22819afbaef5 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -3315,9 +3315,9 @@ LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
- * Supported values are [1,3]. Default value is 3
+ * Supported values are [1,3]. Default value is 1
  */
-LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_BOTH,
+LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_FCP,
             LPFC_ENABLE_FCP, LPFC_ENABLE_BOTH,
             "Define fc4 type to register with fabric.");
 
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
index c05f56c3023f..7b7d314af0e0 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.h
+++ b/drivers/scsi/lpfc/lpfc_debugfs.h
@@ -44,14 +44,6 @@
 /* hbqinfo output buffer size */
 #define LPFC_HBQINFO_SIZE 8192
 
-enum {
-        DUMP_FCP,
-        DUMP_NVME,
-        DUMP_MBX,
-        DUMP_ELS,
-        DUMP_NVMELS,
-};
-
 /* nvmestat output buffer size */
 #define LPFC_NVMESTAT_SIZE 8192
 #define LPFC_NVMEKTIME_SIZE 8192
@@ -283,8 +275,22 @@ struct lpfc_idiag {
         struct lpfc_idiag_offset offset;
         void *ptr_private;
 };
+
+#else
+
+#define lpfc_nvmeio_data(phba, fmt, arg...) \
+        no_printk(fmt, ##arg)
+
 #endif
 
+enum {
+        DUMP_FCP,
+        DUMP_NVME,
+        DUMP_MBX,
+        DUMP_ELS,
+        DUMP_NVMELS,
+};
+
 /* Mask for discovery_trace */
 #define LPFC_DISC_TRC_ELS_CMD           0x1     /* Trace ELS commands */
 #define LPFC_DISC_TRC_ELS_RSP           0x2     /* Trace ELS response */
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index d9c61d030034..a5ca37e45fb6 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7968,7 +7968,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                         did, vport->port_state, ndlp->nlp_flag);
 
                 phba->fc_stat.elsRcvPRLI++;
-                if (vport->port_state < LPFC_DISC_AUTH) {
+                if ((vport->port_state < LPFC_DISC_AUTH) &&
+                    (vport->fc_flag & FC_FABRIC)) {
                         rjt_err = LSRJT_UNABLE_TPC;
                         rjt_exp = LSEXP_NOTHING_MORE;
                         break;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 2697d49da4d7..6cc561b04211 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -5891,10 +5891,17 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 /* Check to see if it matches any module parameter */
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
                                 phba->nvmet_support = 1; /* a match */
+#else
+                                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                                "6021 Can't enable NVME Target."
+                                                " NVME_TARGET_FC infrastructure"
+                                                " is not in kernel\n");
+#endif
                         }
                 }
         }
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 0a4c19081409..0024de1c6c1f 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -2149,7 +2149,7 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
         /* localport is allocated from the stack, but the registration
          * call allocates heap memory as well as the private area.
          */
-#ifdef CONFIG_LPFC_NVME_INITIATOR
+#if (IS_ENABLED(CONFIG_NVME_FC))
         ret = nvme_fc_register_localport(&nfcp_info, &lpfc_nvme_template,
                                          &vport->phba->pcidev->dev, &localport);
 #else
@@ -2190,7 +2190,7 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
 void
 lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
 {
-#ifdef CONFIG_LPFC_NVME_INITIATOR
+#if (IS_ENABLED(CONFIG_NVME_FC))
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_rport *rport = NULL, *rport_next = NULL;
@@ -2274,7 +2274,7 @@ lpfc_nvme_update_localport(struct lpfc_vport *vport)
 int
 lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
-#ifdef CONFIG_LPFC_NVME_INITIATOR
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret = 0;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
@@ -2403,7 +2403,7 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 void
 lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
-#ifdef CONFIG_LPFC_NVME_INITIATOR
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index b7739a554fe0..acba1b67e505 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -520,7 +520,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         struct lpfc_hba *phba = ctxp->phba;
         struct lpfc_iocbq *nvmewqeq;
         unsigned long iflags;
-        int rc, id;
+        int rc;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         if (phba->ktime_on) {
@@ -530,7 +530,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                         ctxp->ts_nvme_data = ktime_get_ns();
         }
         if (phba->cpucheck_on & LPFC_CHECK_NVMET_IO) {
-                id = smp_processor_id();
+                int id = smp_processor_id();
                 ctxp->cpu = id;
                 if (id < LPFC_CHECK_CPU_CNT)
                         phba->cpucheck_xmt_io[id]++;
@@ -671,7 +671,7 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
                                            NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED;
 
-#ifdef CONFIG_LPFC_NVME_TARGET
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         error = nvmet_fc_register_targetport(&pinfo, &lpfc_tgttemplate,
                                              &phba->pcidev->dev,
                                              &phba->targetport);
@@ -756,7 +756,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
 void
 lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
 {
-#ifdef CONFIG_LPFC_NVME_TARGET
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
 
         if (phba->nvmet_support == 0)
@@ -788,7 +788,7 @@ static void
 lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                            struct hbq_dmabuf *nvmebuf)
 {
-#ifdef CONFIG_LPFC_NVME_TARGET
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
         struct lpfc_nvmet_rcv_ctx *ctxp;
@@ -891,7 +891,7 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                             struct rqb_dmabuf *nvmebuf,
                             uint64_t isr_timestamp)
 {
-#ifdef CONFIG_LPFC_NVME_TARGET
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index e7e5974e1a2c..2b209bbb4c91 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -35,8 +35,8 @@
 /*
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "07.701.16.00-rc1"
-#define MEGASAS_RELDATE                         "February 2, 2017"
+#define MEGASAS_VERSION                         "07.701.17.00-rc1"
+#define MEGASAS_RELDATE                         "March 2, 2017"
 
 /*
  * Device IDs
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 7ac9a9ee9bd4..0016f12cc563 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1963,6 +1963,9 @@ scan_target:
         if (!mr_device_priv_data)
                 return -ENOMEM;
         sdev->hostdata = mr_device_priv_data;
+
+        atomic_set(&mr_device_priv_data->r1_ldio_hint,
+                   instance->r1_ldio_hint_default);
         return 0;
 }
 
@@ -5034,10 +5037,12 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe)
                                          &instance->irq_context[j]);
                         /* Retry irq register for IO_APIC*/
                         instance->msix_vectors = 0;
-                        if (is_probe)
+                        if (is_probe) {
+                                pci_free_irq_vectors(instance->pdev);
                                 return megasas_setup_irqs_ioapic(instance);
-                        else
+                        } else {
                                 return -1;
+                        }
                 }
         }
         return 0;
@@ -5277,9 +5282,11 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         MPI2_REPLY_POST_HOST_INDEX_OFFSET);
         }
 
-        i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
-        if (i < 0)
-                goto fail_setup_irqs;
+        if (!instance->msix_vectors) {
+                i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
+                if (i < 0)
+                        goto fail_setup_irqs;
+        }
 
         dev_info(&instance->pdev->dev,
                 "firmware supports msix\t: (%d)", fw_msix_count);
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 29650ba669da..f990ab4d45e1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2159,7 +2159,7 @@ megasas_set_raidflag_cpu_affinity(union RAID_CONTEXT_UNION *praid_context,
                                 cpu_sel = MR_RAID_CTX_CPUSEL_1;
 
                         if (is_stream_detected(rctx_g35) &&
-                            (raid->level == 5) &&
+                            ((raid->level == 5) || (raid->level == 6)) &&
                             (raid->writeMode == MR_RL_WRITE_THROUGH_MODE) &&
                             (cpu_sel == MR_RAID_CTX_CPUSEL_FCFS))
                                 cpu_sel = MR_RAID_CTX_CPUSEL_0;
@@ -2338,7 +2338,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                         } else if ((scsi_buff_len > MR_LARGE_IO_MIN_SIZE) ||
-                                   atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint)) {
+                                   (atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint) > 0)) {
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                                 if (scsi_buff_len > MR_LARGE_IO_MIN_SIZE)
diff --git a/drivers/scsi/qedf/qedf_fip.c b/drivers/scsi/qedf/qedf_fip.c
index ed58b9104f58..e10b91cc3c62 100644
--- a/drivers/scsi/qedf/qedf_fip.c
+++ b/drivers/scsi/qedf/qedf_fip.c
@@ -99,7 +99,8 @@ static void qedf_fcoe_process_vlan_resp(struct qedf_ctx *qedf,
                 qedf_set_vlan_id(qedf, vid);
 
                 /* Inform waiter that it's ok to call fcoe_ctlr_link up() */
-                complete(&qedf->fipvlan_compl);
+                if (!completion_done(&qedf->fipvlan_compl))
+                        complete(&qedf->fipvlan_compl);
         }
 }
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 8e2a160490e6..cceddd995a4b 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2803,6 +2803,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
                 atomic_set(&qedf->num_offloads, 0);
                 qedf->stop_io_on_error = false;
                 pci_set_drvdata(pdev, qedf);
+                init_completion(&qedf->fipvlan_compl);
 
                 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_INFO,
                    "QLogic FastLinQ FCoE Module qedf %s, "
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 8e3d92807cb8..92775a8b74b1 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2007,6 +2007,7 @@ static void qedi_remove(struct pci_dev *pdev)
 
 static struct pci_device_id qedi_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x165E) },
+        { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x8084) },
         { 0 },
 };
 MODULE_DEVICE_TABLE(pci, qedi_pci_tbl);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 41d5b09f7326..83d61d2142e9 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1160,8 +1160,13 @@ static inline
 uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
 {
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+        struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
 
-        return ((RD_REG_DWORD(&reg->host_status)) == ISP_REG_DISCONNECT);
+        if (IS_P3P_TYPE(ha))
+                return ((RD_REG_DWORD(&reg82->host_int)) == ISP_REG_DISCONNECT);
+        else
+                return ((RD_REG_DWORD(&reg->host_status)) ==
+                        ISP_REG_DISCONNECT);
 }
 
 /**************************************************************************
@@ -1651,7 +1656,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                 /* Don't abort commands in adapter during EEH
                                  * recovery as it's not accessible/responding.
                                  */
-                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy &&
+                                    (sp->type == SRB_SCSI_CMD)) {
                                         /* Get a reference to the sp and drop the lock.
                                          * The reference ensures this sp->done() call
                                          * - and not the call in qla2xxx_eh_abort() -
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 19125d72f322..e5a2d590a104 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -496,7 +496,7 @@ static void scsi_run_queue(struct request_queue *q)
                 scsi_starved_list_run(sdev->host);
 
         if (q->mq_ops)
-                blk_mq_start_stopped_hw_queues(q, false);
+                blk_mq_run_hw_queues(q, false);
         else
                 blk_run_queue(q);
 }
@@ -667,7 +667,7 @@ static bool scsi_end_request(struct request *req, int error,
                     !list_empty(&sdev->host->starved_list))
                         kblockd_schedule_work(&sdev->requeue_work);
                 else
-                        blk_mq_start_stopped_hw_queues(q, true);
+                        blk_mq_run_hw_queues(q, true);
         } else {
                 unsigned long flags;
 
@@ -1974,7 +1974,7 @@ out:
         case BLK_MQ_RQ_QUEUE_BUSY:
                 if (atomic_read(&sdev->device_busy) == 0 &&
                     !scsi_device_blocked(sdev))
-                        blk_mq_delay_queue(hctx, SCSI_QUEUE_DELAY);
+                        blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
                 break;
         case BLK_MQ_RQ_QUEUE_ERROR:
                 /*
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index fcfeddc79331..35ad5e8a31ab 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2102,6 +2102,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
 
 #define READ_CAPACITY_RETRIES_ON_RESET  10
 
+/*
+ * Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
+ * and the reported logical block size is bigger than 512 bytes. Note
+ * that last_sector is a u64 and therefore logical_to_sectors() is not
+ * applicable.
+ */
+static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
+{
+        u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
+
+        if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
+                return false;
+
+        return true;
+}
+
 static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                                                 unsigned char *buffer)
 {
@@ -2167,7 +2183,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return -ENODEV;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2256,7 +2272,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return sector_size;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2956,7 +2972,8 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
                 rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
         } else
-                rw_max = BLK_DEF_MAX_SECTORS;
+                rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+                                      (sector_t)BLK_DEF_MAX_SECTORS);
 
         /* Combine with controller limits */
         q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 29b86505f796..225abaad4d1c 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -996,6 +996,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                 result = get_user(val, ip);
                 if (result)
                         return result;
+                if (val > SG_MAX_CDB_SIZE)
+                        return -ENOMEM;
                 sfp->next_cmd_len = (val > 0) ? val : 0;
                 return 0;
         case SG_GET_VERSION_NUM:
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 0b29b9329b1c..a8f630213a1a 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -836,6 +836,7 @@ static void get_capabilities(struct scsi_cd *cd)
         unsigned char *buffer;
         struct scsi_mode_data data;
         struct scsi_sense_hdr sshdr;
+        unsigned int ms_len = 128;
         int rc, n;
 
         static const char *loadmech[] =
@@ -862,10 +863,11 @@ static void get_capabilities(struct scsi_cd *cd)
         scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
 
         /* ask for mode page 0x2a */
-        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
+        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
                              SR_TIMEOUT, 3, &data, NULL);
 
-        if (!scsi_status_is_good(rc)) {
+        if (!scsi_status_is_good(rc) || data.length > ms_len ||
+            data.header_length + data.block_descriptor_length > data.length) {
                 /* failed, drive doesn't have capabilities mode page */
                 cd->cdi.speed = 1;
                 cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index a72a4ba78125..8e5e6c04c035 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -309,8 +309,8 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
 
         mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mmio_base = devm_ioremap_resource(dev, mem_res);
-        if (IS_ERR(*(void **)&mmio_base)) {
-                err = PTR_ERR(*(void **)&mmio_base);
+        if (IS_ERR(mmio_base)) {
+                err = PTR_ERR(mmio_base);
                 goto out;
         }
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 1359913bf840..096e95b911bd 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -4662,8 +4662,6 @@ static void __ufshcd_transfer_req_compl(struct ufs_hba *hba,
                 }
                 if (ufshcd_is_clkscaling_supported(hba))
                         hba->clk_scaling.active_reqs--;
-                if (ufshcd_is_clkscaling_supported(hba))
-                        hba->clk_scaling.active_reqs--;
         }
 
         /* clear corresponding bits of completed commands */
@@ -7642,7 +7640,7 @@ static inline ssize_t ufshcd_pm_lvl_store(struct device *dev,
         if (kstrtoul(buf, 0, &value))
                 return -EINVAL;
 
-        if ((value < UFS_PM_LVL_0) || (value >= UFS_PM_LVL_MAX))
+        if (value >= UFS_PM_LVL_MAX)
                 return -EINVAL;
 
         spin_lock_irqsave(hba->host->host_lock, flags);
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 7cbad0d45b9c..6ba270e0494d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -409,6 +409,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
                         ret = PTR_ERR(vmfile);
                         goto out;
                 }
+                vmfile->f_mode |= FMODE_LSEEK;
                 asma->file = vmfile;
         }
         get_file(asma->file);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index a91802432f2f..e3f9ed3690b7 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -485,8 +485,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *);
 
 int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
 {
-        iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-        return 0;
+        return iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
 }
 EXPORT_SYMBOL(iscsit_queue_rsp);
 
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index bf40f03755dd..344e8448869c 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -1398,11 +1398,10 @@ static u32 lio_sess_get_initiator_sid(
 static int lio_queue_data_in(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_DATAIN;
-        cmd->conn->conn_transport->iscsit_queue_data_in(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_data_in(conn, cmd);
 }
 
 static int lio_write_pending(struct se_cmd *se_cmd)
@@ -1431,16 +1430,14 @@ static int lio_write_pending_status(struct se_cmd *se_cmd)
 static int lio_queue_status(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_STATUS;
 
         if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
-                iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-                return 0;
+                return iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
         }
-        cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_status(conn, cmd);
 }
 
 static void lio_queue_tm_rsp(struct se_cmd *se_cmd)
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index e65bf78ceef3..fce627628200 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -782,22 +782,6 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param)
                 if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH))
                         SET_PSTATE_REPLY_OPTIONAL(param);
                 /*
-                 * The GlobalSAN iSCSI Initiator for MacOSX does
-                 * not respond to MaxBurstLength, FirstBurstLength,
-                 * DefaultTime2Wait or DefaultTime2Retain parameter keys.
-                 * So, we set them to 'reply optional' here, and assume the
-                 * the defaults from iscsi_parameters.h if the initiator
-                 * is not RFC compliant and the keys are not negotiated.
-                 */
-                if (!strcmp(param->name, MAXBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, FIRSTBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2WAIT))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2RETAIN))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                /*
                  * Required for gPXE iSCSI boot client
                  */
                 if (!strcmp(param->name, MAXCONNECTIONS))
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 5041a9c8bdcb..7d3e2fcc26a0 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -567,7 +567,7 @@ static void iscsit_remove_cmd_from_immediate_queue(
         }
 }
 
-void iscsit_add_cmd_to_response_queue(
+int iscsit_add_cmd_to_response_queue(
         struct iscsi_cmd *cmd,
         struct iscsi_conn *conn,
         u8 state)
@@ -578,7 +578,7 @@ void iscsit_add_cmd_to_response_queue(
         if (!qr) {
                 pr_err("Unable to allocate memory for"
                         " struct iscsi_queue_req\n");
-                return;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&qr->qr_list);
         qr->cmd = cmd;
@@ -590,6 +590,7 @@ void iscsit_add_cmd_to_response_queue(
         spin_unlock_bh(&conn->response_queue_lock);
 
         wake_up(&conn->queues_wq);
+        return 0;
 }
 
 struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *conn)
@@ -737,21 +738,23 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
 {
         struct se_cmd *se_cmd = NULL;
         int rc;
+        bool op_scsi = false;
         /*
          * Determine if a struct se_cmd is associated with
          * this struct iscsi_cmd.
          */
         switch (cmd->iscsi_opcode) {
         case ISCSI_OP_SCSI_CMD:
-                se_cmd = &cmd->se_cmd;
-                __iscsit_free_cmd(cmd, true, shutdown);
+                op_scsi = true;
                 /*
                  * Fallthrough
                  */
         case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
-                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
-                        __iscsit_free_cmd(cmd, true, shutdown);
+                se_cmd = &cmd->se_cmd;
+                __iscsit_free_cmd(cmd, op_scsi, shutdown);
+                rc = transport_generic_free_cmd(se_cmd, shutdown);
+                if (!rc && shutdown && se_cmd->se_sess) {
+                        __iscsit_free_cmd(cmd, op_scsi, shutdown);
                         target_put_sess_cmd(se_cmd);
                 }
                 break;
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 8ff08856516a..9e4197af8708 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -31,7 +31,7 @@ extern int iscsit_find_cmd_for_recovery(struct iscsi_session *, struct iscsi_cmd
                         struct iscsi_conn_recovery **, itt_t);
 extern void iscsit_add_cmd_to_immediate_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_immediate_queue(struct iscsi_conn *);
-extern void iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
+extern int iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *);
 extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_conn *);
 extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index fd7c16a7ca6e..fc4a9c303d55 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -197,8 +197,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
                 /*
                  * Set the ASYMMETRIC ACCESS State
                  */
-                buf[off++] |= (atomic_read(
-                        &tg_pt_gp->tg_pt_gp_alua_access_state) & 0xff);
+                buf[off++] |= tg_pt_gp->tg_pt_gp_alua_access_state & 0xff;
                 /*
                  * Set supported ASYMMETRIC ACCESS State bits
                  */
@@ -710,7 +709,7 @@ target_alua_state_check(struct se_cmd *cmd)
 
         spin_lock(&lun->lun_tg_pt_gp_lock);
         tg_pt_gp = lun->lun_tg_pt_gp;
-        out_alua_state = atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
+        out_alua_state = tg_pt_gp->tg_pt_gp_alua_access_state;
         nonop_delay_msecs = tg_pt_gp->tg_pt_gp_nonop_delay_msecs;
 
         // XXX: keeps using tg_pt_gp witout reference after unlock
@@ -911,7 +910,7 @@ static int core_alua_write_tpg_metadata(
 }
 
 /*
- * Called with tg_pt_gp->tg_pt_gp_md_mutex held
+ * Called with tg_pt_gp->tg_pt_gp_transition_mutex held
  */
 static int core_alua_update_tpg_primary_metadata(
         struct t10_alua_tg_pt_gp *tg_pt_gp)
@@ -934,7 +933,7 @@ static int core_alua_update_tpg_primary_metadata(
                         "alua_access_state=0x%02x\n"
                         "alua_access_status=0x%02x\n",
                         tg_pt_gp->tg_pt_gp_id,
-                        tg_pt_gp->tg_pt_gp_alua_pending_state,
+                        tg_pt_gp->tg_pt_gp_alua_access_state,
                         tg_pt_gp->tg_pt_gp_alua_access_status);
 
         snprintf(path, ALUA_METADATA_PATH_LEN,
@@ -1013,93 +1012,41 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp)
         spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 }
 
-static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
-{
-        struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work,
-                struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work);
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status ==
-                         ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG);
-
-        /*
-         * Update the ALUA metadata buf that has been allocated in
-         * core_alua_do_port_transition(), this metadata will be written
-         * to struct file.
-         *
-         * Note that there is the case where we do not want to update the
-         * metadata when the saved metadata is being parsed in userspace
-         * when setting the existing port access state and access status.
-         *
-         * Also note that the failure to write out the ALUA metadata to
-         * struct file does NOT affect the actual ALUA transition.
-         */
-        if (tg_pt_gp->tg_pt_gp_write_metadata) {
-                mutex_lock(&tg_pt_gp->tg_pt_gp_md_mutex);
-                core_alua_update_tpg_primary_metadata(tg_pt_gp);
-                mutex_unlock(&tg_pt_gp->tg_pt_gp_md_mutex);
-        }
-        /*
-         * Set the current primary ALUA access state to the requested new state
-         */
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                   tg_pt_gp->tg_pt_gp_alua_pending_state);
-
-        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
-                " from primary access state %s to %s\n", (explicit) ? "explicit" :
-                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
-                tg_pt_gp->tg_pt_gp_id,
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_previous_state),
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_pending_state));
-
-        core_alua_queue_state_change_ua(tg_pt_gp);
-
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
-
-        if (tg_pt_gp->tg_pt_gp_transition_complete)
-                complete(tg_pt_gp->tg_pt_gp_transition_complete);
-}
-
 static int core_alua_do_transition_tg_pt(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         int new_state,
         int explicit)
 {
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        DECLARE_COMPLETION_ONSTACK(wait);
+        int prev_state;
 
+        mutex_lock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         /* Nothing to be done here */
-        if (atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == new_state)
+        if (tg_pt_gp->tg_pt_gp_alua_access_state == new_state) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return 0;
+        }
 
-        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return -EAGAIN;
-
-        /*
-         * Flush any pending transitions
-         */
-        if (!explicit)
-                flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
+        }
 
         /*
          * Save the old primary ALUA access state, and set the current state
          * to ALUA_ACCESS_STATE_TRANSITION.
          */
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                        ALUA_ACCESS_STATE_TRANSITION);
+        prev_state = tg_pt_gp->tg_pt_gp_alua_access_state;
+        tg_pt_gp->tg_pt_gp_alua_access_state = ALUA_ACCESS_STATE_TRANSITION;
         tg_pt_gp->tg_pt_gp_alua_access_status = (explicit) ?
                                 ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG :
                                 ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA;
 
         core_alua_queue_state_change_ua(tg_pt_gp);
 
-        if (new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return 0;
-
-        tg_pt_gp->tg_pt_gp_alua_previous_state =
-                atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
-        tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
+        }
 
         /*
          * Check for the optional ALUA primary state transition delay
@@ -1108,19 +1055,36 @@ static int core_alua_do_transition_tg_pt(
                 msleep_interruptible(tg_pt_gp->tg_pt_gp_trans_delay_msecs);
 
         /*
-         * Take a reference for workqueue item
+         * Set the current primary ALUA access state to the requested new state
          */
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+        tg_pt_gp->tg_pt_gp_alua_access_state = new_state;
 
-        schedule_work(&tg_pt_gp->tg_pt_gp_transition_work);
-        if (explicit) {
-                tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                wait_for_completion(&wait);
-                tg_pt_gp->tg_pt_gp_transition_complete = NULL;
+        /*
+         * Update the ALUA metadata buf that has been allocated in
+         * core_alua_do_port_transition(), this metadata will be written
+         * to struct file.
+         *
+         * Note that there is the case where we do not want to update the
+         * metadata when the saved metadata is being parsed in userspace
+         * when setting the existing port access state and access status.
+         *
+         * Also note that the failure to write out the ALUA metadata to
+         * struct file does NOT affect the actual ALUA transition.
+         */
+        if (tg_pt_gp->tg_pt_gp_write_metadata) {
+                core_alua_update_tpg_primary_metadata(tg_pt_gp);
         }
 
+        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
+                " from primary access state %s to %s\n", (explicit) ? "explicit" :
+                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
+                tg_pt_gp->tg_pt_gp_id,
+                core_alua_dump_state(prev_state),
+                core_alua_dump_state(new_state));
+
+        core_alua_queue_state_change_ua(tg_pt_gp);
+
+        mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         return 0;
 }
 
@@ -1685,14 +1649,12 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
         }
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_list);
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_lun_list);
-        mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex);
+        mutex_init(&tg_pt_gp->tg_pt_gp_transition_mutex);
         spin_lock_init(&tg_pt_gp->tg_pt_gp_lock);
         atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0);
-        INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
-                  core_alua_do_transition_tg_pt_work);
         tg_pt_gp->tg_pt_gp_dev = dev;
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
+        tg_pt_gp->tg_pt_gp_alua_access_state =
+                        ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED;
         /*
          * Enable both explicit and implicit ALUA support by default
          */
@@ -1797,8 +1759,6 @@ void core_alua_free_tg_pt_gp(
         dev->t10_alua.alua_tg_pt_gps_counter--;
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
-        flush_work(&tg_pt_gp->tg_pt_gp_transition_work);
-
         /*
          * Allow a struct t10_alua_tg_pt_gp_member * referenced by
          * core_alua_get_tg_pt_gp_by_name() in
@@ -1938,8 +1898,8 @@ ssize_t core_alua_show_tg_pt_gp_info(struct se_lun *lun, char *page)
                         "Primary Access Status: %s\nTG Port Secondary Access"
                         " State: %s\nTG Port Secondary Access Status: %s\n",
                         config_item_name(tg_pt_ci), tg_pt_gp->tg_pt_gp_id,
-                        core_alua_dump_state(atomic_read(
-                                        &tg_pt_gp->tg_pt_gp_alua_access_state)),
+                        core_alua_dump_state(
+                                tg_pt_gp->tg_pt_gp_alua_access_state),
                         core_alua_dump_status(
                                 tg_pt_gp->tg_pt_gp_alua_access_status),
                         atomic_read(&lun->lun_tg_pt_secondary_offline) ?
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 38b5025e4c7a..70657fd56440 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2392,7 +2392,7 @@ static ssize_t target_tg_pt_gp_alua_access_state_show(struct config_item *item,
                 char *page)
 {
         return sprintf(page, "%d\n",
-                atomic_read(&to_tg_pt_gp(item)->tg_pt_gp_alua_access_state));
+                       to_tg_pt_gp(item)->tg_pt_gp_alua_access_state);
 }
 
 static ssize_t target_tg_pt_gp_alua_access_state_store(struct config_item *item,
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index d8a16ca6baa5..d1e6cab8e3d3 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link(
                 pr_err("Source se_lun->lun_se_dev does not exist\n");
                 return -EINVAL;
         }
+        if (lun->lun_shutdown) {
+                pr_err("Unable to create mappedlun symlink because"
+                        " lun->lun_shutdown=true\n");
+                return -EINVAL;
+        }
         se_tpg = lun->lun_tpg;
 
         nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 6fb191914f45..dfaef4d3b2d2 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -642,6 +642,8 @@ void core_tpg_remove_lun(
          */
         struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev);
 
+        lun->lun_shutdown = true;
+
         core_clear_lun_from_tpg(lun, tpg);
         /*
          * Wait for any active I/O references to percpu se_lun->lun_ref to
@@ -663,6 +665,8 @@ void core_tpg_remove_lun(
         }
         if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 hlist_del_rcu(&lun->link);
+
+        lun->lun_shutdown = false;
         mutex_unlock(&tpg->tpg_lun_mutex);
 
         percpu_ref_exit(&lun->lun_ref);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index b1a3cdb29468..a0cd56ee5fe9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -64,8 +64,9 @@ struct kmem_cache *t10_alua_lba_map_cache;
 struct kmem_cache *t10_alua_lba_map_mem_cache;
 
 static void transport_complete_task_attr(struct se_cmd *cmd);
+static int translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason);
 static void transport_handle_queue_full(struct se_cmd *cmd,
-                struct se_device *dev);
+                struct se_device *dev, int err, bool write_pending);
 static int transport_put_cmd(struct se_cmd *cmd);
 static void target_complete_ok_work(struct work_struct *work);
 
@@ -804,7 +805,8 @@ void target_qf_do_work(struct work_struct *work)
 
                 if (cmd->t_state == TRANSPORT_COMPLETE_QF_WP)
                         transport_write_pending_qf(cmd);
-                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK)
+                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK ||
+                         cmd->t_state == TRANSPORT_COMPLETE_QF_ERR)
                         transport_complete_qf(cmd);
         }
 }
@@ -1719,7 +1721,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
                 }
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 goto check_stop;
         default:
@@ -1730,7 +1732,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         }
 
         ret = transport_send_check_condition_and_sense(cmd, sense_reason, 0);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
 check_stop:
@@ -1739,8 +1741,7 @@ check_stop:
         return;
 
 queue_full:
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 EXPORT_SYMBOL(transport_generic_request_failure);
 
@@ -1977,13 +1978,29 @@ static void transport_complete_qf(struct se_cmd *cmd)
         int ret = 0;
 
         transport_complete_task_attr(cmd);
+        /*
+         * If a fabric driver ->write_pending() or ->queue_data_in() callback
+         * has returned neither -ENOMEM or -EAGAIN, assume it's fatal and
+         * the same callbacks should not be retried.  Return CHECK_CONDITION
+         * if a scsi_status is not already set.
+         *
+         * If a fabric driver ->queue_status() has returned non zero, always
+         * keep retrying no matter what..
+         */
+        if (cmd->t_state == TRANSPORT_COMPLETE_QF_ERR) {
+                if (cmd->scsi_status)
+                        goto queue_status;
 
-        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-                trace_target_cmd_complete(cmd);
-                ret = cmd->se_tfo->queue_status(cmd);
-                goto out;
+                cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
+                cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+                cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+                translate_sense_reason(cmd, TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE);
+                goto queue_status;
         }
 
+        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)
+                goto queue_status;
+
         switch (cmd->data_direction) {
         case DMA_FROM_DEVICE:
                 if (cmd->scsi_status)
@@ -2007,19 +2024,33 @@ queue_status:
                 break;
         }
 
-out:
         if (ret < 0) {
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
                 return;
         }
         transport_lun_remove_cmd(cmd);
         transport_cmd_check_stop_to_fabric(cmd);
 }
 
-static void transport_handle_queue_full(
-        struct se_cmd *cmd,
-        struct se_device *dev)
+static void transport_handle_queue_full(struct se_cmd *cmd, struct se_device *dev,
+                                        int err, bool write_pending)
 {
+        /*
+         * -EAGAIN or -ENOMEM signals retry of ->write_pending() and/or
+         * ->queue_data_in() callbacks from new process context.
+         *
+         * Otherwise for other errors, transport_complete_qf() will send
+         * CHECK_CONDITION via ->queue_status() instead of attempting to
+         * retry associated fabric driver data-transfer callbacks.
+         */
+        if (err == -EAGAIN || err == -ENOMEM) {
+                cmd->t_state = (write_pending) ? TRANSPORT_COMPLETE_QF_WP :
+                                                 TRANSPORT_COMPLETE_QF_OK;
+        } else {
+                pr_warn_ratelimited("Got unknown fabric queue status: %d\n", err);
+                cmd->t_state = TRANSPORT_COMPLETE_QF_ERR;
+        }
+
         spin_lock_irq(&dev->qf_cmd_lock);
         list_add_tail(&cmd->se_qf_node, &cmd->se_dev->qf_cmd_list);
         atomic_inc_mb(&dev->dev_qf_count);
@@ -2083,7 +2114,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 WARN_ON(!cmd->scsi_status);
                 ret = transport_send_check_condition_and_sense(
                                         cmd, 0, 1);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
 
                 transport_lun_remove_cmd(cmd);
@@ -2109,7 +2140,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 } else if (rc) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 rc, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2134,7 +2165,7 @@ queue_rsp:
                 if (target_read_prot_action(cmd)) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 cmd->pi_err, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2144,7 +2175,7 @@ queue_rsp:
 
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_data_in(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         case DMA_TO_DEVICE:
@@ -2157,7 +2188,7 @@ queue_rsp:
                         atomic_long_add(cmd->data_length,
                                         &cmd->se_lun->lun_stats.tx_data_octets);
                         ret = cmd->se_tfo->queue_data_in(cmd);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
                         break;
                 }
@@ -2166,7 +2197,7 @@ queue_rsp:
 queue_status:
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         default:
@@ -2180,8 +2211,8 @@ queue_status:
 queue_full:
         pr_debug("Handling complete_ok QUEUE_FULL: se_cmd: %p,"
                 " data_direction: %d\n", cmd, cmd->data_direction);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 void target_free_sgl(struct scatterlist *sgl, int nents)
@@ -2449,18 +2480,14 @@ transport_generic_new_cmd(struct se_cmd *cmd)
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
-        /* fabric drivers should only return -EAGAIN or -ENOMEM as error */
-        WARN_ON(ret);
-
-        return (!ret) ? 0 : TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return 0;
 
 queue_full:
         pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n", cmd);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_WP;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         return 0;
 }
 EXPORT_SYMBOL(transport_generic_new_cmd);
@@ -2470,10 +2497,10 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         int ret;
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM) {
+        if (ret) {
                 pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n",
                          cmd);
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         }
 }
 
@@ -3011,6 +3038,8 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         __releases(&cmd->t_state_lock)
         __acquires(&cmd->t_state_lock)
 {
+        int ret;
+
         assert_spin_locked(&cmd->t_state_lock);
         WARN_ON_ONCE(!irqs_disabled());
 
@@ -3034,7 +3063,9 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         trace_target_cmd_complete(cmd);
 
         spin_unlock_irq(&cmd->t_state_lock);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
         spin_lock_irq(&cmd->t_state_lock);
 
         return 1;
@@ -3055,6 +3086,7 @@ EXPORT_SYMBOL(transport_check_aborted_status);
 void transport_send_task_abort(struct se_cmd *cmd)
 {
         unsigned long flags;
+        int ret;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
         if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION)) {
@@ -3090,7 +3122,9 @@ send_abort:
                  cmd->t_task_cdb[0], cmd->tag);
 
         trace_target_cmd_complete(cmd);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 static void target_tmr_work(struct work_struct *work)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c6874c38a10b..f615c3bbb73e 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -311,24 +311,50 @@ static void free_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd)
                    DATA_BLOCK_BITS);
 }
 
-static void gather_data_area(struct tcmu_dev *udev, unsigned long *cmd_bitmap,
-                struct scatterlist *data_sg, unsigned int data_nents)
+static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+                             bool bidi)
 {
+        struct se_cmd *se_cmd = cmd->se_cmd;
         int i, block;
         int block_remaining = 0;
         void *from, *to;
         size_t copy_bytes, from_offset;
-        struct scatterlist *sg;
+        struct scatterlist *sg, *data_sg;
+        unsigned int data_nents;
+        DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
+
+        bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
+
+        if (!bidi) {
+                data_sg = se_cmd->t_data_sg;
+                data_nents = se_cmd->t_data_nents;
+        } else {
+                uint32_t count;
+
+                /*
+                 * For bidi case, the first count blocks are for Data-Out
+                 * buffer blocks, and before gathering the Data-In buffer
+                 * the Data-Out buffer blocks should be discarded.
+                 */
+                count = DIV_ROUND_UP(se_cmd->data_length, DATA_BLOCK_SIZE);
+                while (count--) {
+                        block = find_first_bit(bitmap, DATA_BLOCK_BITS);
+                        clear_bit(block, bitmap);
+                }
+
+                data_sg = se_cmd->t_bidi_data_sg;
+                data_nents = se_cmd->t_bidi_data_nents;
+        }
 
         for_each_sg(data_sg, sg, data_nents, i) {
                 int sg_remaining = sg->length;
                 to = kmap_atomic(sg_page(sg)) + sg->offset;
                 while (sg_remaining > 0) {
                         if (block_remaining == 0) {
-                                block = find_first_bit(cmd_bitmap,
+                                block = find_first_bit(bitmap,
                                                 DATA_BLOCK_BITS);
                                 block_remaining = DATA_BLOCK_SIZE;
-                                clear_bit(block, cmd_bitmap);
+                                clear_bit(block, bitmap);
                         }
                         copy_bytes = min_t(size_t, sg_remaining,
                                         block_remaining);
@@ -394,6 +420,27 @@ static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t d
         return true;
 }
 
+static inline size_t tcmu_cmd_get_data_length(struct tcmu_cmd *tcmu_cmd)
+{
+        struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+        size_t data_length = round_up(se_cmd->data_length, DATA_BLOCK_SIZE);
+
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
+                data_length += round_up(se_cmd->t_bidi_data_sg->length,
+                                DATA_BLOCK_SIZE);
+        }
+
+        return data_length;
+}
+
+static inline uint32_t tcmu_cmd_get_block_cnt(struct tcmu_cmd *tcmu_cmd)
+{
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
+
+        return data_length / DATA_BLOCK_SIZE;
+}
+
 static sense_reason_t
 tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 {
@@ -407,7 +454,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         uint32_t cmd_head;
         uint64_t cdb_off;
         bool copy_to_data_area;
-        size_t data_length;
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
         DECLARE_BITMAP(old_bitmap, DATA_BLOCK_BITS);
 
         if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
@@ -421,8 +468,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
          * expensive to tell how many regions are freed in the bitmap
         */
         base_command_size = max(offsetof(struct tcmu_cmd_entry,
-                                req.iov[se_cmd->t_bidi_data_nents +
-                                        se_cmd->t_data_nents]),
+                                req.iov[tcmu_cmd_get_block_cnt(tcmu_cmd)]),
                                 sizeof(struct tcmu_cmd_entry));
         command_size = base_command_size
                 + round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
@@ -433,11 +479,6 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 
         mb = udev->mb_addr;
         cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
-        data_length = se_cmd->data_length;
-        if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
-                data_length += se_cmd->t_bidi_data_sg->length;
-        }
         if ((command_size > (udev->cmdr_size / 2)) ||
             data_length > udev->data_size) {
                 pr_warn("TCMU: Request of size %zu/%zu is too big for %u/%zu "
@@ -511,11 +552,14 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         entry->req.iov_dif_cnt = 0;
 
         /* Handle BIDI commands */
-        iov_cnt = 0;
-        alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
-                se_cmd->t_bidi_data_nents, &iov, &iov_cnt, false);
-        entry->req.iov_bidi_cnt = iov_cnt;
-
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                iov_cnt = 0;
+                iov++;
+                alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
+                                se_cmd->t_bidi_data_nents, &iov, &iov_cnt,
+                                false);
+                entry->req.iov_bidi_cnt = iov_cnt;
+        }
         /* cmd's data_bitmap is what changed in process */
         bitmap_xor(tcmu_cmd->data_bitmap, old_bitmap, udev->data_bitmap,
                         DATA_BLOCK_BITS);
@@ -592,19 +636,11 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                                se_cmd->scsi_sense_length);
                 free_data_area(udev, cmd);
         } else if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
                 /* Get Data-In buffer before clean up */
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_bidi_data_sg, se_cmd->t_bidi_data_nents);
+                gather_data_area(udev, cmd, true);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_data_sg, se_cmd->t_data_nents);
+                gather_data_area(udev, cmd, false);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_TO_DEVICE) {
                 free_data_area(udev, cmd);
@@ -1196,11 +1232,6 @@ static ssize_t tcmu_cmd_time_out_store(struct config_item *item, const char *pag
         if (ret < 0)
                 return ret;
 
-        if (!val) {
-                pr_err("Illegal value for cmd_time_out\n");
-                return -EINVAL;
-        }
-
         udev->cmd_time_out = val * MSEC_PER_SEC;
         return count;
 }
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 91048eeca28b..69d0f430b2d1 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -107,8 +107,6 @@ struct cpufreq_cooling_device {
 };
 static DEFINE_IDA(cpufreq_ida);
 
-static unsigned int cpufreq_dev_count;
-
 static DEFINE_MUTEX(cooling_list_lock);
 static LIST_HEAD(cpufreq_dev_list);
 
@@ -395,13 +393,20 @@ static int get_static_power(struct cpufreq_cooling_device *cpufreq_device,
 
         opp = dev_pm_opp_find_freq_exact(cpufreq_device->cpu_dev, freq_hz,
                                          true);
+        if (IS_ERR(opp)) {
+                dev_warn_ratelimited(cpufreq_device->cpu_dev,
+                                     "Failed to find OPP for frequency %lu: %ld\n",
+                                     freq_hz, PTR_ERR(opp));
+                return -EINVAL;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp);
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(cpufreq_device->cpu_dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq_hz, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(cpufreq_device->cpu_dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq_hz);
                 return -EINVAL;
         }
 
@@ -693,9 +698,9 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 
         *state = cpufreq_cooling_get_level(cpu, target_freq);
         if (*state == THERMAL_CSTATE_INVALID) {
-                dev_warn_ratelimited(&cdev->device,
-                                     "Failed to convert %dKHz for cpu %d into a cdev state\n",
-                                     target_freq, cpu);
+                dev_err_ratelimited(&cdev->device,
+                                    "Failed to convert %dKHz for cpu %d into a cdev state\n",
+                                    target_freq, cpu);
                 return -EINVAL;
         }
 
@@ -771,6 +776,7 @@ __cpufreq_cooling_register(struct device_node *np,
         unsigned int freq, i, num_cpus;
         int ret;
         struct thermal_cooling_device_ops *cooling_ops;
+        bool first;
 
         if (!alloc_cpumask_var(&temp_mask, GFP_KERNEL))
                 return ERR_PTR(-ENOMEM);
@@ -874,13 +880,14 @@ __cpufreq_cooling_register(struct device_node *np,
         cpufreq_dev->cool_dev = cool_dev;
 
         mutex_lock(&cooling_list_lock);
+        /* Register the notifier for first cpufreq cooling device */
+        first = list_empty(&cpufreq_dev_list);
         list_add(&cpufreq_dev->node, &cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
 
-        /* Register the notifier for first cpufreq cooling device */
-        if (!cpufreq_dev_count++)
+        if (first)
                 cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                           CPUFREQ_POLICY_NOTIFIER);
-        mutex_unlock(&cooling_list_lock);
 
         goto put_policy;
 
@@ -1021,6 +1028,7 @@ EXPORT_SYMBOL(of_cpufreq_power_cooling_register);
 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 {
         struct cpufreq_cooling_device *cpufreq_dev;
+        bool last;
 
         if (!cdev)
                 return;
@@ -1028,14 +1036,15 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
         cpufreq_dev = cdev->devdata;
 
         mutex_lock(&cooling_list_lock);
+        list_del(&cpufreq_dev->node);
         /* Unregister the notifier for the last cpufreq cooling device */
-        if (!--cpufreq_dev_count)
+        last = list_empty(&cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
+
+        if (last)
                 cpufreq_unregister_notifier(&thermal_cpufreq_notifier_block,
                                             CPUFREQ_POLICY_NOTIFIER);
 
-        list_del(&cpufreq_dev->node);
-        mutex_unlock(&cooling_list_lock);
-
         thermal_cooling_device_unregister(cpufreq_dev->cool_dev);
         ida_simple_remove(&cpufreq_ida, cpufreq_dev->id);
         kfree(cpufreq_dev->dyn_power_table);
diff --git a/drivers/thermal/devfreq_cooling.c b/drivers/thermal/devfreq_cooling.c
index 7743a78d4723..4bf4ad58cffd 100644
--- a/drivers/thermal/devfreq_cooling.c
+++ b/drivers/thermal/devfreq_cooling.c
@@ -186,16 +186,22 @@ get_static_power(struct devfreq_cooling_device *dfc, unsigned long freq)
                 return 0;
 
         opp = dev_pm_opp_find_freq_exact(dev, freq, true);
-        if (IS_ERR(opp) && (PTR_ERR(opp) == -ERANGE))
+        if (PTR_ERR(opp) == -ERANGE)
                 opp = dev_pm_opp_find_freq_exact(dev, freq, false);
 
+        if (IS_ERR(opp)) {
+                dev_err_ratelimited(dev, "Failed to find OPP for frequency %lu: %ld\n",
+                                    freq, PTR_ERR(opp));
+                return 0;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp) / 1000; /* mV */
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq);
                 return 0;
         }
 
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 6ee55a2d47bb..e65808c482f1 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -257,7 +257,7 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 {
         unsigned int baud = tty_termios_baud_rate(termios);
         struct dw8250_data *d = p->private_data;
-        unsigned int rate;
+        long rate;
         int ret;
 
         if (IS_ERR(d->clk) || !old)
@@ -265,7 +265,12 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 
         clk_disable_unprepare(d->clk);
         rate = clk_round_rate(d->clk, baud * 16);
-        ret = clk_set_rate(d->clk, rate);
+        if (rate < 0)
+                ret = rate;
+        else if (rate == 0)
+                ret = -ENOENT;
+        else
+                ret = clk_set_rate(d->clk, rate);
         clk_prepare_enable(d->clk);
 
         if (!ret)
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index a65fb8197aec..0e3f529d50e9 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -128,9 +128,13 @@ config SERIAL_8250_PCI
           by the parport_serial driver, enabled with CONFIG_PARPORT_SERIAL.
 
 config SERIAL_8250_EXAR
-        tristate "8250/16550 PCI device support"
-        depends on SERIAL_8250_PCI
+        tristate "8250/16550 Exar/Commtech PCI/PCIe device support"
+        depends on SERIAL_8250_PCI
         default SERIAL_8250
+        help
+          This builds support for XR17C1xx, XR17V3xx and some Commtech
+          422x PCIe serial cards that are not covered by the more generic
+          SERIAL_8250_PCI option.
 
 config SERIAL_8250_HP300
         tristate
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8789ea423ccf..b0a377725d63 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2373,7 +2373,7 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
         if (strcmp(name, "qdf2400_e44") == 0) {
                 pr_info_once("UART: Working around QDF2400 SoC erratum 44");
                 qdf2400_e44_present = true;
-        } else if (strcmp(name, "pl011") != 0 || strcmp(name, "ttyAMA") != 0) {
+        } else if (strcmp(name, "pl011") != 0) {
                 return -ENODEV;
         }
 
@@ -2452,18 +2452,37 @@ static void pl011_early_write(struct console *con, const char *s, unsigned n)
         uart_console_write(&dev->port, s, n, pl011_putc);
 }
 
+/*
+ * On non-ACPI systems, earlycon is enabled by specifying
+ * "earlycon=pl011,<address>" on the kernel command line.
+ *
+ * On ACPI ARM64 systems, an "early" console is enabled via the SPCR table,
+ * by specifying only "earlycon" on the command line.  Because it requires
+ * SPCR, the console starts after ACPI is parsed, which is later than a
+ * traditional early console.
+ *
+ * To get the traditional early console that starts before ACPI is parsed,
+ * specify the full "earlycon=pl011,<address>" option.
+ */
 static int __init pl011_early_console_setup(struct earlycon_device *device,
                                             const char *opt)
 {
         if (!device->port.membase)
                 return -ENODEV;
 
-        device->con->write = qdf2400_e44_present ?
-                                qdf2400_e44_early_write : pl011_early_write;
+        /* On QDF2400 SOCs affected by Erratum 44, the "qdf2400_e44" must
+         * also be specified, e.g. "earlycon=pl011,<address>,qdf2400_e44".
+         */
+        if (!strcmp(device->options, "qdf2400_e44"))
+                device->con->write = qdf2400_e44_early_write;
+        else
+                device->con->write = pl011_early_write;
+
         return 0;
 }
 OF_EARLYCON_DECLARE(pl011, "arm,pl011", pl011_early_console_setup);
 OF_EARLYCON_DECLARE(pl011, "arm,sbsa-uart", pl011_early_console_setup);
+EARLYCON_DECLARE(qdf2400_e44, pl011_early_console_setup);
 
 #else
 #define AMBA_CONSOLE    NULL
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index dcebb28ffbc4..1f50a83ef958 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1951,6 +1951,11 @@ static void atmel_flush_buffer(struct uart_port *port)
                 atmel_uart_writel(port, ATMEL_PDC_TCR, 0);
                 atmel_port->pdc_tx.ofs = 0;
         }
+        /*
+         * in uart_flush_buffer(), the xmit circular buffer has just
+         * been cleared, so we have to reset tx_len accordingly.
+         */
+        atmel_port->tx_len = 0;
 }
 
 /*
@@ -2483,6 +2488,9 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
         pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN;
         atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS);
 
+        /* Make sure that tx path is actually able to send characters */
+        atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN);
+
         uart_console_write(port, s, count, atmel_console_putchar);
 
         /*
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 6989b227d134..be94246b6fcc 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -1088,7 +1088,7 @@ static void mxs_auart_settermios(struct uart_port *u,
                                         AUART_LINECTRL_BAUD_DIV_MAX);
                 baud_max = u->uartclk * 32 / AUART_LINECTRL_BAUD_DIV_MIN;
                 baud = uart_get_baud_rate(u, termios, old, baud_min, baud_max);
-                div = u->uartclk * 32 / baud;
+                div = DIV_ROUND_CLOSEST(u->uartclk * 32, baud);
         }
 
         ctrl |= AUART_LINECTRL_BAUD_DIVFRAC(div & 0x3F);
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index bcf1d33e6ffe..c334bcc59c64 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -575,12 +575,13 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
                         pinctrl_select_state(ascport->pinctrl,
                                              ascport->states[NO_HW_FLOWCTRL]);
 
-                        gpiod = devm_get_gpiod_from_child(port->dev, "rts",
-                                                          &np->fwnode);
-                        if (!IS_ERR(gpiod)) {
-                                gpiod_direction_output(gpiod, 0);
+                        gpiod = devm_fwnode_get_gpiod_from_child(port->dev,
+                                                                 "rts",
+                                                                 &np->fwnode,
+                                                                 GPIOD_OUT_LOW,
+                                                                 np->name);
+                        if (!IS_ERR(gpiod))
                                 ascport->rts = gpiod;
-                        }
                 }
         }
 
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 68947f6de5ad..e4603b09863a 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -271,10 +271,13 @@ const struct file_operations tty_ldiscs_proc_fops = {
 
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+        struct tty_ldisc *ld;
+
         ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
-        if (!tty->ldisc)
+        ld = tty->ldisc;
+        if (!ld)
                 ldsem_up_read(&tty->ldisc_sem);
-        return tty->ldisc;
+        return ld;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index c5f0fc906136..8af8d9542663 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/debug.h>
-#include <linux/sched/debug.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/mm.h>
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index f03692ec5520..8fb309a0ff6b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1381,7 +1381,7 @@ static int usbtmc_probe(struct usb_interface *intf,
 
         dev_dbg(&intf->dev, "%s called\n", __func__);
 
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
@@ -1444,6 +1444,13 @@ static int usbtmc_probe(struct usb_interface *intf,
                         break;
                 }
         }
+
+        if (!data->bulk_out || !data->bulk_in) {
+                dev_err(&intf->dev, "bulk endpoints not found\n");
+                retcode = -ENODEV;
+                goto err_put;
+        }
+
         /* Find int endpoint */
         for (n = 0; n < iface_desc->desc.bNumEndpoints; n++) {
                 endpoint = &iface_desc->endpoint[n].desc;
@@ -1469,8 +1476,10 @@ static int usbtmc_probe(struct usb_interface *intf,
         if (data->iin_ep_present) {
                 /* allocate int urb */
                 data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
-                if (!data->iin_urb)
+                if (!data->iin_urb) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* Protect interrupt in endpoint data until iin_urb is freed */
                 kref_get(&data->kref);
@@ -1478,8 +1487,10 @@ static int usbtmc_probe(struct usb_interface *intf,
                 /* allocate buffer for interrupt in */
                 data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
                                         GFP_KERNEL);
-                if (!data->iin_buffer)
+                if (!data->iin_buffer) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* fill interrupt urb */
                 usb_fill_int_urb(data->iin_urb, data->usb_dev,
@@ -1512,6 +1523,7 @@ error_register:
         sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
         sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
         usbtmc_free_int(data);
+err_put:
         kref_put(&data->kref, usbtmc_delete);
         return retcode;
 }
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 25dbd8c7aec7..4be52c602e9b 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -280,6 +280,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 
                         /*
                          * Adjust bInterval for quirked devices.
+                         */
+                        /*
+                         * This quirk fixes bIntervals reported in ms.
+                         */
+                        if (to_usb_device(ddev)->quirks &
+                                USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) {
+                                n = clamp(fls(d->bInterval) + 3, i, j);
+                                i = j = n;
+                        }
+                        /*
                          * This quirk fixes bIntervals reported in
                          * linear microframes.
                          */
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 612fab6e54fb..79bdca5cb9c7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -520,8 +520,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
          */
         tbuf_size =  max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
         tbuf = kzalloc(tbuf_size, GFP_KERNEL);
-        if (!tbuf)
-                return -ENOMEM;
+        if (!tbuf) {
+                status = -ENOMEM;
+                goto err_alloc;
+        }
 
         bufp = tbuf;
 
@@ -734,6 +736,7 @@ error:
         }
 
         kfree(tbuf);
+ err_alloc:
 
         /* any errors get returned through the urb completion */
         spin_lock_irq(&hcd_root_hub_lock);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f0dd08198d74..5286bf67869a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4275,7 +4275,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
         struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
         int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
 
-        if (!udev->usb2_hw_lpm_capable)
+        if (!udev->usb2_hw_lpm_capable || !udev->bos)
                 return;
 
         if (hub)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 24f9f98968a5..96b21b0dac1e 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -170,6 +170,14 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Baum Vario Ultra */
+        { USB_DEVICE(0x0904, 0x6101), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6102), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6103), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+
         /* Keytouch QWERTY Panel keyboard */
         { USB_DEVICE(0x0926, 0x3333), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 0d75158e43fe..79e7a3480d51 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
                 int status)
 {
         struct dwc3                     *dwc = dep->dwc;
+        unsigned int                    unmap_after_complete = false;
 
         req->started = false;
         list_del(&req->list);
@@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
 
-        if (dwc->ep0_bounced && dep->number <= 1)
+        /*
+         * NOTICE we don't want to unmap before calling ->complete() if we're
+         * dealing with a bounced ep0 request. If we unmap it here, we would end
+         * up overwritting the contents of req->buf and this could confuse the
+         * gadget driver.
+         */
+        if (dwc->ep0_bounced && dep->number <= 1) {
                 dwc->ep0_bounced = false;
-
-        usb_gadget_unmap_request_by_dev(dwc->sysdev,
-                        &req->request, req->direction);
+                unmap_after_complete = true;
+        } else {
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+        }
 
         trace_dwc3_gadget_giveback(req);
 
@@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         usb_gadget_giveback_request(&dep->endpoint, &req->request);
         spin_lock(&dwc->lock);
 
+        if (unmap_after_complete)
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+
         if (dep->number > 1)
                 pm_runtime_put(dwc->dev);
 }
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index a30766ca4226..5e3828d9dac7 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -535,13 +535,15 @@ static int acm_notify_serial_state(struct f_acm *acm)
 {
         struct usb_composite_dev *cdev = acm->port.func.config->cdev;
         int                     status;
+        __le16                  serial_state;
 
         spin_lock(&acm->lock);
         if (acm->notify_req) {
                 dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n",
                         acm->port_num, acm->serial_state);
+                serial_state = cpu_to_le16(acm->serial_state);
                 status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE,
-                                0, &acm->serial_state, sizeof(acm->serial_state));
+                                0, &serial_state, sizeof(acm->serial_state));
         } else {
                 acm->pending = true;
                 status = 0;
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 89b48bcc377a..5eea44823ca0 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -367,7 +367,7 @@ try_again:
         count  = min_t(unsigned, count, hidg->report_length);
 
         spin_unlock_irqrestore(&hidg->write_spinlock, flags);
-        status = copy_from_user(hidg->req->buf, buffer, count);
+        status = copy_from_user(req->buf, buffer, count);
 
         if (status != 0) {
                 ERROR(hidg->func.config->cdev,
@@ -378,9 +378,9 @@ try_again:
 
         spin_lock_irqsave(&hidg->write_spinlock, flags);
 
-        /* we our function has been disabled by host */
+        /* when our function has been disabled by host */
         if (!hidg->req) {
-                free_ep_req(hidg->in_ep, hidg->req);
+                free_ep_req(hidg->in_ep, req);
                 /*
                  * TODO
                  * Should we fail with error here?
@@ -394,7 +394,7 @@ try_again:
         req->complete = f_hidg_req_complete;
         req->context  = hidg;
 
-        status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
+        status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
         if (status < 0) {
                 ERROR(hidg->func.config->cdev,
                         "usb_ep_queue error on int endpoint %zd\n", status);
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index d2351139342f..a82e2bd5ea34 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -373,7 +373,7 @@ static void bot_cleanup_old_alt(struct f_uas *fu)
         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
         usb_ep_free_request(fu->ep_out, fu->cmd.req);
-        usb_ep_free_request(fu->ep_out, fu->bot_status.req);
+        usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 
         kfree(fu->cmd.buf);
 
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 29b41b5dee04..f8a1881609a2 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -594,6 +594,14 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         opts->streaming_maxpacket = clamp(opts->streaming_maxpacket, 1U, 3072U);
         opts->streaming_maxburst = min(opts->streaming_maxburst, 15U);
 
+        /* For SS, wMaxPacketSize has to be 1024 if bMaxBurst is not 0 */
+        if (opts->streaming_maxburst &&
+            (opts->streaming_maxpacket % 1024) != 0) {
+                opts->streaming_maxpacket = roundup(opts->streaming_maxpacket, 1024);
+                INFO(cdev, "overriding streaming_maxpacket to %d\n",
+                     opts->streaming_maxpacket);
+        }
+
         /* Fill in the FS/HS/SS Video Streaming specific descriptors from the
          * module parameters.
          *
@@ -625,7 +633,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
         uvc_ss_streaming_comp.wBytesPerInterval =
                 cpu_to_le16(max_packet_size * max_packet_mult *
-                            opts->streaming_maxburst);
+                            (opts->streaming_maxburst + 1));
 
         /* Allocate endpoints. */
         ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index a97da645c1b9..8a365aad66fe 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
                 td = phys_to_virt(addr);
                 addr2 = (dma_addr_t)td->next;
                 pci_pool_free(dev->data_requests, td, addr);
-                td->next = 0x00;
                 addr = addr2;
         }
         req->chain_len = 1;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index bd02a6cd8e2c..6ed468fa7d5e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -344,6 +344,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
 static struct platform_driver usb_xhci_driver = {
         .probe  = xhci_plat_probe,
         .remove = xhci_plat_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
         .driver = {
                 .name = "xhci-hcd",
                 .pm = DEV_PM_OPS,
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d9936c771fa0..a3309aa02993 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1989,6 +1989,9 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 case TRB_NORMAL:
                         td->urb->actual_length = requested - remaining;
                         goto finish_td;
+                case TRB_STATUS:
+                        td->urb->actual_length = requested;
+                        goto finish_td;
                 default:
                         xhci_warn(xhci, "WARN: unexpected TRB Type %d\n",
                                   trb_type);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 50aee8b7718b..953fd8f62df0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1477,6 +1477,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct xhci_ring *ep_ring;
         struct xhci_virt_ep *ep;
         struct xhci_command *command;
+        struct xhci_virt_device *vdev;
 
         xhci = hcd_to_xhci(hcd);
         spin_lock_irqsave(&xhci->lock, flags);
@@ -1485,15 +1486,27 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
         /* Make sure the URB hasn't completed or been unlinked already */
         ret = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (ret || !urb->hcpriv)
+        if (ret)
                 goto done;
+
+        /* give back URB now if we can't queue it for cancel */
+        vdev = xhci->devs[urb->dev->slot_id];
+        urb_priv = urb->hcpriv;
+        if (!vdev || !urb_priv)
+                goto err_giveback;
+
+        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+        ep = &vdev->eps[ep_index];
+        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
+        if (!ep || !ep_ring)
+                goto err_giveback;
+
         temp = readl(&xhci->op_regs->status);
         if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "HW died, freeing TD.");
-                urb_priv = urb->hcpriv;
                 for (i = urb_priv->num_tds_done;
-                     i < urb_priv->num_tds && xhci->devs[urb->dev->slot_id];
+                     i < urb_priv->num_tds;
                      i++) {
                         td = &urb_priv->td[i];
                         if (!list_empty(&td->td_list))
@@ -1501,23 +1514,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         if (!list_empty(&td->cancelled_td_list))
                                 list_del_init(&td->cancelled_td_list);
                 }
-
-                usb_hcd_unlink_urb_from_ep(hcd, urb);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
-                xhci_urb_free_priv(urb_priv);
-                return ret;
+                goto err_giveback;
         }
 
-        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
-        ep = &xhci->devs[urb->dev->slot_id]->eps[ep_index];
-        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
-        if (!ep_ring) {
-                ret = -EINVAL;
-                goto done;
-        }
-
-        urb_priv = urb->hcpriv;
         i = urb_priv->num_tds_done;
         if (i < urb_priv->num_tds)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -1554,6 +1553,14 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 done:
         spin_unlock_irqrestore(&xhci->lock, flags);
         return ret;
+
+err_giveback:
+        if (urb_priv)
+                xhci_urb_free_priv(urb_priv);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+        usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
+        return ret;
 }
 
 /* Drop an endpoint from a new bandwidth configuration for this device.
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 8b9fd7534f69..502bfe30a077 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -347,6 +347,9 @@ static int idmouse_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0x0A)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL)
diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
index 77176511658f..d3d124753266 100644
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -366,6 +366,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
 
         hdev = interface_to_usbdev(intf);
         desc = intf->cur_altsetting;
+
+        if (desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &desc->endpoint[0].desc;
 
         /* valid only for SS root hub */
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index e45a3a680db8..07014cad6dbe 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 3) {
+                usb_put_dev(usbdev);
+                return -ENODEV;
+        }
+
         /*
          * Allocate parport interface 
          */
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index d8bae6ca8904..0c3664ab705e 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2490,8 +2490,8 @@ static int musb_remove(struct platform_device *pdev)
         musb_host_cleanup(musb);
         musb_gadget_cleanup(musb);
 
-        spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
+        spin_lock_irqsave(&musb->lock, flags);
         musb_disable_interrupts(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         spin_unlock_irqrestore(&musb->lock, flags);
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index 00e272bfee39..355655f8a3fb 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -238,8 +238,27 @@ static void cppi41_dma_callback(void *private_data,
                         transferred < cppi41_channel->packet_sz)
                 cppi41_channel->prog_len = 0;
 
-        if (cppi41_channel->is_tx)
-                empty = musb_is_tx_fifo_empty(hw_ep);
+        if (cppi41_channel->is_tx) {
+                u8 type;
+
+                if (is_host_active(musb))
+                        type = hw_ep->out_qh->type;
+                else
+                        type = hw_ep->ep_in.type;
+
+                if (type == USB_ENDPOINT_XFER_ISOC)
+                        /*
+                         * Don't use the early-TX-interrupt workaround below
+                         * for Isoch transfter. Since Isoch are periodic
+                         * transfer, by the time the next transfer is
+                         * scheduled, the current one should be done already.
+                         *
+                         * This avoids audio playback underrun issue.
+                         */
+                        empty = true;
+                else
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+        }
 
         if (!cppi41_channel->is_tx || empty) {
                 cppi41_trans_done(cppi41_channel);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 7c047c4a2565..9c7ee26ef388 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -933,7 +933,7 @@ static int dsps_probe(struct platform_device *pdev)
         if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
                 ret = dsps_setup_optional_vbus_irq(pdev, glue);
                 if (ret)
-                        return ret;
+                        goto err_iounmap;
         }
 
         platform_set_drvdata(pdev, glue);
@@ -946,6 +946,8 @@ static int dsps_probe(struct platform_device *pdev)
 
 err:
         pm_runtime_disable(&pdev->dev);
+err_iounmap:
+        iounmap(glue->usbss_base);
         return ret;
 }
 
@@ -956,6 +958,7 @@ static int dsps_remove(struct platform_device *pdev)
         platform_device_unregister(glue->musb);
 
         pm_runtime_disable(&pdev->dev);
+        iounmap(glue->usbss_base);
 
         return 0;
 }
diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
index b3b33cf7ddf6..f333024660b4 100644
--- a/drivers/usb/phy/phy-isp1301.c
+++ b/drivers/usb/phy/phy-isp1301.c
@@ -136,7 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
         .driver = {
                 .name = DRV_NAME,
-                .of_match_table = of_match_ptr(isp1301_of_match),
+                .of_match_table = isp1301_of_match,
         },
         .probe = isp1301_probe,
         .remove = isp1301_remove,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 42cc72e54c05..af67a0de6b5d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,14 @@ static void option_instat_callback(struct urb *urb);
 #define BANDRICH_PRODUCT_1012                   0x1012
 
 #define QUALCOMM_VENDOR_ID                      0x05C6
+/* These Quectel products use Qualcomm's vendor ID */
+#define QUECTEL_PRODUCT_UC20                    0x9003
+#define QUECTEL_PRODUCT_UC15                    0x9090
+
+#define QUECTEL_VENDOR_ID                       0x2c7c
+/* These Quectel products use Quectel's vendor ID */
+#define QUECTEL_PRODUCT_EC21                    0x0121
+#define QUECTEL_PRODUCT_EC25                    0x0125
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -1161,7 +1169,14 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
+        /* Quectel products using Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        /* Quectel products using Quectel vendor ID */
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 696458db7e3c..38b3f0d8cd58 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -169,6 +169,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x413c, 0x81a9)},   /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b1)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b3)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {DEVICE_SWI(0x413c, 0x81b5)},   /* Dell Wireless 5811e QDL */
+        {DEVICE_SWI(0x413c, 0x81b6)},   /* Dell Wireless 5811e QDL */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
index 252c7bd9218a..d01496fd27fe 100644
--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
         int result;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+                return -ENODEV;
+
         result = wa_rpipes_create(wa);
         if (result < 0)
                 goto error_rpipes_create;
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 0aa6c3c29d17..35a1e777b449 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -823,6 +823,9 @@ static int hwarc_probe(struct usb_interface *iface,
         struct hwarc *hwarc;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
         if (uwb_rc == NULL) {
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 2bfc846ac071..6345e85822a4 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                                  result);
         }
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
         if (i1480_usb == NULL) {
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 609f4f982c74..561084ab387f 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -403,6 +403,7 @@ static void vfio_group_release(struct kref *kref)
         struct iommu_group *iommu_group = group->iommu_group;
 
         WARN_ON(!list_empty(&group->device_list));
+        WARN_ON(group->notifier.head);
 
         list_for_each_entry_safe(unbound, tmp,
                                  &group->unbound_list, unbound_next) {
@@ -1573,6 +1574,10 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep)
                 return -EBUSY;
         }
 
+        /* Warn if previous user didn't cleanup and re-init to drop them */
+        if (WARN_ON(group->notifier.head))
+                BLOCKING_INIT_NOTIFIER_HEAD(&group->notifier);
+
         filep->private_data = group;
 
         return 0;
@@ -1584,9 +1589,6 @@ static int vfio_group_fops_release(struct inode *inode, struct file *filep)
 
         filep->private_data = NULL;
 
-        /* Any user didn't unregister? */
-        WARN_ON(group->notifier.head);
-
         vfio_group_try_dissolve_container(group);
 
         atomic_dec(&group->opened);
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index c26fa1f3ed86..32d2633092a3 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -1182,8 +1182,7 @@ static struct vfio_group *find_iommu_group(struct vfio_domain *domain,
         return NULL;
 }
 
-static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
-                                    phys_addr_t *base)
+static bool vfio_iommu_has_sw_msi(struct iommu_group *group, phys_addr_t *base)
 {
         struct list_head group_resv_regions;
         struct iommu_resv_region *region, *next;
@@ -1192,7 +1191,7 @@ static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
         INIT_LIST_HEAD(&group_resv_regions);
         iommu_get_group_resv_regions(group, &group_resv_regions);
         list_for_each_entry(region, &group_resv_regions, list) {
-                if (region->type & IOMMU_RESV_MSI) {
+                if (region->type == IOMMU_RESV_SW_MSI) {
                         *base = region->start;
                         ret = true;
                         goto out;
@@ -1283,7 +1282,7 @@ static int vfio_iommu_type1_attach_group(void *iommu_data,
         if (ret)
                 goto out_domain;
 
-        resv_msi = vfio_iommu_has_resv_msi(iommu_group, &resv_msi_base);
+        resv_msi = vfio_iommu_has_sw_msi(iommu_group, &resv_msi_base);
 
         INIT_LIST_HEAD(&domain->group_list);
         list_add(&group->next, &domain->group_list);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index ce5e63d2c66a..44eed8eb0725 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -223,6 +223,46 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+vhost_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct vhost_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        /* Find the vhost_vsock according to guest context id  */
+        vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
+        if (!vsock)
+                return -ENODEV;
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num)
+                        vhost_poll_queue(&tx_vq->poll);
+        }
+
+        return 0;
+}
+
 static struct virtio_vsock_pkt *
 vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,
                       unsigned int out, unsigned int in)
@@ -675,6 +715,7 @@ static struct virtio_transport vhost_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = vhost_transport_cancel_pkt,
 
                 .dgram_enqueue            = virtio_transport_dgram_enqueue,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index d7efcb632f7d..002f1ce22bd0 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -297,14 +297,15 @@ static int pwm_backlight_probe(struct platform_device *pdev)
         }
 
         /*
-         * If the GPIO is configured as input, change the direction to output
-         * and set the GPIO as active.
+         * If the GPIO is not known to be already configured as output, that
+         * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL,
+         * change the direction to output and set the GPIO as active.
          * Do not force the GPIO to active when it was already output as it
          * could cause backlight flickering or we would enable the backlight too
          * early. Leave the decision of the initial backlight state for later.
          */
         if (pb->enable_gpio &&
-            gpiod_get_direction(pb->enable_gpio) == GPIOF_DIR_IN)
+            gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT)
                 gpiod_direction_output(pb->enable_gpio, 1);
 
         pb->power_supply = devm_regulator_get(&pdev->dev, "power");
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 8c4dc1e1f94f..b827a8113e26 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/errno.h>
 #include <linux/fb.h>
+#include <linux/pci.h>
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <video/vga.h>
@@ -143,6 +144,8 @@ static struct attribute *efifb_attrs[] = {
 };
 ATTRIBUTE_GROUPS(efifb);
 
+static bool pci_dev_disabled;   /* FB base matches BAR of a disabled device */
+
 static int efifb_probe(struct platform_device *dev)
 {
         struct fb_info *info;
@@ -152,7 +155,7 @@ static int efifb_probe(struct platform_device *dev)
         unsigned int size_total;
         char *option = NULL;
 
-        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
                 return -ENODEV;
 
         if (fb_get_options("efifb", &option))
@@ -360,3 +363,64 @@ static struct platform_driver efifb_driver = {
 };
 
 builtin_platform_driver(efifb_driver);
+
+#if defined(CONFIG_PCI) && !defined(CONFIG_X86)
+
+static bool pci_bar_found;      /* did we find a BAR matching the efifb base? */
+
+static void claim_efifb_bar(struct pci_dev *dev, int idx)
+{
+        u16 word;
+
+        pci_bar_found = true;
+
+        pci_read_config_word(dev, PCI_COMMAND, &word);
+        if (!(word & PCI_COMMAND_MEMORY)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: assigned to efifb but device is disabled!\n",
+                        idx);
+                return;
+        }
+
+        if (pci_claim_resource(dev, idx)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: failed to claim resource for efifb!\n", idx);
+                return;
+        }
+
+        dev_info(&dev->dev, "BAR %d: assigned to efifb\n", idx);
+}
+
+static void efifb_fixup_resources(struct pci_dev *dev)
+{
+        u64 base = screen_info.lfb_base;
+        u64 size = screen_info.lfb_size;
+        int i;
+
+        if (pci_bar_found || screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+                return;
+
+        if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE)
+                base |= (u64)screen_info.ext_lfb_base << 32;
+
+        if (!base)
+                return;
+
+        for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
+                struct resource *res = &dev->resource[i];
+
+                if (!(res->flags & IORESOURCE_MEM))
+                        continue;
+
+                if (res->start <= base && res->end >= base + size - 1) {
+                        claim_efifb_bar(dev, i);
+                        break;
+                }
+        }
+}
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY,
+                               16, efifb_fixup_resources);
+
+#endif
diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
index 1abba07b84b3..f4cbfb3b8a09 100644
--- a/drivers/video/fbdev/omap/omapfb_main.c
+++ b/drivers/video/fbdev/omap/omapfb_main.c
@@ -1608,19 +1608,6 @@ static int omapfb_find_ctrl(struct omapfb_device *fbdev)
         return 0;
 }
 
-static void check_required_callbacks(struct omapfb_device *fbdev)
-{
-#define _C(x) (fbdev->ctrl->x != NULL)
-#define _P(x) (fbdev->panel->x != NULL)
-        BUG_ON(fbdev->ctrl == NULL || fbdev->panel == NULL);
-        BUG_ON(!(_C(init) && _C(cleanup) && _C(get_caps) &&
-                 _C(set_update_mode) && _C(setup_plane) && _C(enable_plane) &&
-                 _P(init) && _P(cleanup) && _P(enable) && _P(disable) &&
-                 _P(get_caps)));
-#undef _P
-#undef _C
-}
-
 /*
  * Called by LDM binding to probe and attach a new device.
  * Initialization sequence:
@@ -1705,8 +1692,6 @@ static int omapfb_do_probe(struct platform_device *pdev,
                 omapfb_ops.fb_mmap = omapfb_mmap;
         init_state++;
 
-        check_required_callbacks(fbdev);
-
         r = planes_init(fbdev);
         if (r)
                 goto cleanup;
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index bd017b57c47f..f599520374dd 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -578,10 +578,14 @@ static int ssd1307fb_probe(struct i2c_client *client,
 
         par->vbat_reg = devm_regulator_get_optional(&client->dev, "vbat");
         if (IS_ERR(par->vbat_reg)) {
-                dev_err(&client->dev, "failed to get VBAT regulator: %ld\n",
-                        PTR_ERR(par->vbat_reg));
                 ret = PTR_ERR(par->vbat_reg);
-                goto fb_alloc_error;
+                if (ret == -ENODEV) {
+                        par->vbat_reg = NULL;
+                } else {
+                        dev_err(&client->dev, "failed to get VBAT regulator: %d\n",
+                                ret);
+                        goto fb_alloc_error;
+                }
         }
 
         if (of_property_read_u32(node, "solomon,width", &par->width))
@@ -668,10 +672,13 @@ static int ssd1307fb_probe(struct i2c_client *client,
                 udelay(4);
         }
 
-        ret = regulator_enable(par->vbat_reg);
-        if (ret) {
-                dev_err(&client->dev, "failed to enable VBAT: %d\n", ret);
-                goto reset_oled_error;
+        if (par->vbat_reg) {
+                ret = regulator_enable(par->vbat_reg);
+                if (ret) {
+                        dev_err(&client->dev, "failed to enable VBAT: %d\n",
+                                ret);
+                        goto reset_oled_error;
+                }
         }
 
         ret = ssd1307fb_init(par);
@@ -710,7 +717,8 @@ panel_init_error:
                 pwm_put(par->pwm);
         };
 regulator_enable_error:
-        regulator_disable(par->vbat_reg);
+        if (par->vbat_reg)
+                regulator_disable(par->vbat_reg);
 reset_oled_error:
         fb_deferred_io_cleanup(info);
 fb_alloc_error:
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index d0115a7af0a9..3ee309c50b2d 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -643,7 +643,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateInitWait:
-InitWait:
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
@@ -654,7 +653,8 @@ InitWait:
                  * get Connected twice here.
                  */
                 if (dev->state != XenbusStateConnected)
-                        goto InitWait; /* no InitWait seen yet, fudge it */
+                        /* no InitWait seen yet, fudge it */
+                        xenbus_switch_state(dev, XenbusStateConnected);
 
                 if (xenbus_read_unsigned(info->xbdev->otherend,
                                          "request-update", 0))
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 400d70b69379..48230a5e12f2 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -232,6 +232,12 @@ static int virtio_dev_probe(struct device *_d)
                 if (device_features & (1ULL << i))
                         __virtio_set_bit(dev, i);
 
+        if (drv->validate) {
+                err = drv->validate(dev);
+                if (err)
+                        goto err;
+        }
+
         err = virtio_finalize_features(dev);
         if (err)
                 goto err;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 4e1191508228..34adf9b9c053 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -242,11 +242,11 @@ static inline void update_stat(struct virtio_balloon *vb, int idx,
 
 #define pages_to_bytes(x) ((u64)(x) << PAGE_SHIFT)
 
-static void update_balloon_stats(struct virtio_balloon *vb)
+static unsigned int update_balloon_stats(struct virtio_balloon *vb)
 {
         unsigned long events[NR_VM_EVENT_ITEMS];
         struct sysinfo i;
-        int idx = 0;
+        unsigned int idx = 0;
         long available;
 
         all_vm_events(events);
@@ -254,18 +254,22 @@ static void update_balloon_stats(struct virtio_balloon *vb)
 
         available = si_mem_available();
 
+#ifdef CONFIG_VM_EVENT_COUNTERS
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_IN,
                                 pages_to_bytes(events[PSWPIN]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_OUT,
                                 pages_to_bytes(events[PSWPOUT]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MAJFLT, events[PGMAJFAULT]);
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MINFLT, events[PGFAULT]);
+#endif
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMFREE,
                                 pages_to_bytes(i.freeram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMTOT,
                                 pages_to_bytes(i.totalram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_AVAIL,
                                 pages_to_bytes(available));
+
+        return idx;
 }
 
 /*
@@ -291,14 +295,14 @@ static void stats_handle_request(struct virtio_balloon *vb)
 {
         struct virtqueue *vq;
         struct scatterlist sg;
-        unsigned int len;
+        unsigned int len, num_stats;
 
-        update_balloon_stats(vb);
+        num_stats = update_balloon_stats(vb);
 
         vq = vb->stats_vq;
         if (!virtqueue_get_buf(vq, &len))
                 return;
-        sg_init_one(&sg, vb->stats, sizeof(vb->stats));
+        sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
         virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
         virtqueue_kick(vq);
 }
@@ -423,13 +427,16 @@ static int init_vqs(struct virtio_balloon *vb)
         vb->deflate_vq = vqs[1];
         if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) {
                 struct scatterlist sg;
+                unsigned int num_stats;
                 vb->stats_vq = vqs[2];
 
                 /*
                  * Prime this virtqueue with one buffer so the hypervisor can
                  * use it to signal us later (it can't be broken yet!).
                  */
-                sg_init_one(&sg, vb->stats, sizeof vb->stats);
+                num_stats = update_balloon_stats(vb);
+
+                sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
                 if (virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, GFP_KERNEL)
                     < 0)
                         BUG();
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index df548a6fb844..698d5d06fa03 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -33,8 +33,10 @@ void vp_synchronize_vectors(struct virtio_device *vdev)
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i;
 
-        synchronize_irq(pci_irq_vector(vp_dev->pci_dev, 0));
-        for (i = 1; i < vp_dev->msix_vectors; i++)
+        if (vp_dev->intx_enabled)
+                synchronize_irq(vp_dev->pci_dev->irq);
+
+        for (i = 0; i < vp_dev->msix_vectors; ++i)
                 synchronize_irq(pci_irq_vector(vp_dev->pci_dev, i));
 }
 
@@ -60,13 +62,16 @@ static irqreturn_t vp_config_changed(int irq, void *opaque)
 static irqreturn_t vp_vring_interrupt(int irq, void *opaque)
 {
         struct virtio_pci_device *vp_dev = opaque;
+        struct virtio_pci_vq_info *info;
         irqreturn_t ret = IRQ_NONE;
-        struct virtqueue *vq;
+        unsigned long flags;
 
-        list_for_each_entry(vq, &vp_dev->vdev.vqs, list) {
-                if (vq->callback && vring_interrupt(irq, vq) == IRQ_HANDLED)
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_for_each_entry(info, &vp_dev->virtqueues, node) {
+                if (vring_interrupt(irq, info->vq) == IRQ_HANDLED)
                         ret = IRQ_HANDLED;
         }
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
 
         return ret;
 }
@@ -97,185 +102,244 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
         return vp_vring_interrupt(irq, opaque);
 }
 
-static void vp_remove_vqs(struct virtio_device *vdev)
+static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
+                                   bool per_vq_vectors, struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        struct virtqueue *vq, *n;
+        const char *name = dev_name(&vp_dev->vdev.dev);
+        unsigned i, v;
+        int err = -ENOMEM;
 
-        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
-                if (vp_dev->msix_vector_map) {
-                        int v = vp_dev->msix_vector_map[vq->index];
+        vp_dev->msix_vectors = nvectors;
 
-                        if (v != VIRTIO_MSI_NO_VECTOR)
-                                free_irq(pci_irq_vector(vp_dev->pci_dev, v),
-                                        vq);
-                }
-                vp_dev->del_vq(vq);
+        vp_dev->msix_names = kmalloc(nvectors * sizeof *vp_dev->msix_names,
+                                     GFP_KERNEL);
+        if (!vp_dev->msix_names)
+                goto error;
+        vp_dev->msix_affinity_masks
+                = kzalloc(nvectors * sizeof *vp_dev->msix_affinity_masks,
+                          GFP_KERNEL);
+        if (!vp_dev->msix_affinity_masks)
+                goto error;
+        for (i = 0; i < nvectors; ++i)
+                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
+                                        GFP_KERNEL))
+                        goto error;
+
+        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
+                                             nvectors, PCI_IRQ_MSIX |
+                                             (desc ? PCI_IRQ_AFFINITY : 0),
+                                             desc);
+        if (err < 0)
+                goto error;
+        vp_dev->msix_enabled = 1;
+
+        /* Set the vector used for configuration */
+        v = vp_dev->msix_used_vectors;
+        snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                 "%s-config", name);
+        err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                          vp_config_changed, 0, vp_dev->msix_names[v],
+                          vp_dev);
+        if (err)
+                goto error;
+        ++vp_dev->msix_used_vectors;
+
+        v = vp_dev->config_vector(vp_dev, v);
+        /* Verify we had enough resources to assign the vector */
+        if (v == VIRTIO_MSI_NO_VECTOR) {
+                err = -EBUSY;
+                goto error;
         }
+
+        if (!per_vq_vectors) {
+                /* Shared vector for all VQs */
+                v = vp_dev->msix_used_vectors;
+                snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                         "%s-virtqueues", name);
+                err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                                  vp_vring_interrupt, 0, vp_dev->msix_names[v],
+                                  vp_dev);
+                if (err)
+                        goto error;
+                ++vp_dev->msix_used_vectors;
+        }
+        return 0;
+error:
+        return err;
+}
+
+static struct virtqueue *vp_setup_vq(struct virtio_device *vdev, unsigned index,
+                                     void (*callback)(struct virtqueue *vq),
+                                     const char *name,
+                                     u16 msix_vec)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = kmalloc(sizeof *info, GFP_KERNEL);
+        struct virtqueue *vq;
+        unsigned long flags;
+
+        /* fill out our structure that represents an active queue */
+        if (!info)
+                return ERR_PTR(-ENOMEM);
+
+        vq = vp_dev->setup_vq(vp_dev, info, index, callback, name,
+                              msix_vec);
+        if (IS_ERR(vq))
+                goto out_info;
+
+        info->vq = vq;
+        if (callback) {
+                spin_lock_irqsave(&vp_dev->lock, flags);
+                list_add(&info->node, &vp_dev->virtqueues);
+                spin_unlock_irqrestore(&vp_dev->lock, flags);
+        } else {
+                INIT_LIST_HEAD(&info->node);
+        }
+
+        vp_dev->vqs[index] = info;
+        return vq;
+
+out_info:
+        kfree(info);
+        return vq;
+}
+
+static void vp_del_vq(struct virtqueue *vq)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        unsigned long flags;
+
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_del(&info->node);
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
+
+        vp_dev->del_vq(info);
+        kfree(info);
 }
 
 /* the config->del_vqs() implementation */
 void vp_del_vqs(struct virtio_device *vdev)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtqueue *vq, *n;
         int i;
 
-        if (WARN_ON_ONCE(list_empty_careful(&vdev->vqs)))
-                return;
+        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+                if (vp_dev->per_vq_vectors) {
+                        int v = vp_dev->vqs[vq->index]->msix_vector;
 
-        vp_remove_vqs(vdev);
+                        if (v != VIRTIO_MSI_NO_VECTOR) {
+                                int irq = pci_irq_vector(vp_dev->pci_dev, v);
+
+                                irq_set_affinity_hint(irq, NULL);
+                                free_irq(irq, vq);
+                        }
+                }
+                vp_del_vq(vq);
+        }
+        vp_dev->per_vq_vectors = false;
+
+        if (vp_dev->intx_enabled) {
+                free_irq(vp_dev->pci_dev->irq, vp_dev);
+                vp_dev->intx_enabled = 0;
+        }
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                for (i = 0; i < vp_dev->msix_vectors; i++)
+        for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+                free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+        for (i = 0; i < vp_dev->msix_vectors; i++)
+                if (vp_dev->msix_affinity_masks[i])
                         free_cpumask_var(vp_dev->msix_affinity_masks[i]);
 
+        if (vp_dev->msix_enabled) {
                 /* Disable the vector used for configuration */
                 vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
 
-                kfree(vp_dev->msix_affinity_masks);
-                kfree(vp_dev->msix_names);
-                kfree(vp_dev->msix_vector_map);
+                pci_free_irq_vectors(vp_dev->pci_dev);
+                vp_dev->msix_enabled = 0;
         }
 
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-        pci_free_irq_vectors(vp_dev->pci_dev);
+        vp_dev->msix_vectors = 0;
+        vp_dev->msix_used_vectors = 0;
+        kfree(vp_dev->msix_names);
+        vp_dev->msix_names = NULL;
+        kfree(vp_dev->msix_affinity_masks);
+        vp_dev->msix_affinity_masks = NULL;
+        kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 
 static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                 struct virtqueue *vqs[], vq_callback_t *callbacks[],
-                const char * const names[], struct irq_affinity *desc)
+                const char * const names[], bool per_vq_vectors,
+                struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        const char *name = dev_name(&vp_dev->vdev.dev);
-        int i, err = -ENOMEM, allocated_vectors, nvectors;
-        unsigned flags = PCI_IRQ_MSIX;
-        bool shared = false;
         u16 msix_vec;
+        int i, err, nvectors, allocated_vectors;
 
-        if (desc) {
-                flags |= PCI_IRQ_AFFINITY;
-                desc->pre_vectors++; /* virtio config vector */
-        }
-
-        nvectors = 1;
-        for (i = 0; i < nvqs; i++)
-                if (callbacks[i])
-                        nvectors++;
-
-        /* Try one vector per queue first. */
-        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
-                        nvectors, flags, desc);
-        if (err < 0) {
-                /* Fallback to one vector for config, one shared for queues. */
-                shared = true;
-                err = pci_alloc_irq_vectors(vp_dev->pci_dev, 2, 2,
-                                PCI_IRQ_MSIX);
-                if (err < 0)
-                        return err;
-        }
-        if (err < 0)
-                return err;
-
-        vp_dev->msix_vectors = nvectors;
-        vp_dev->msix_names = kmalloc_array(nvectors,
-                        sizeof(*vp_dev->msix_names), GFP_KERNEL);
-        if (!vp_dev->msix_names)
-                goto out_free_irq_vectors;
-
-        vp_dev->msix_affinity_masks = kcalloc(nvectors,
-                        sizeof(*vp_dev->msix_affinity_masks), GFP_KERNEL);
-        if (!vp_dev->msix_affinity_masks)
-                goto out_free_msix_names;
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
 
-        for (i = 0; i < nvectors; ++i) {
-                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
-                                GFP_KERNEL))
-                        goto out_free_msix_affinity_masks;
+        if (per_vq_vectors) {
+                /* Best option: one for change interrupt, one per vq. */
+                nvectors = 1;
+                for (i = 0; i < nvqs; ++i)
+                        if (callbacks[i])
+                                ++nvectors;
+        } else {
+                /* Second best: one for change, shared for all vqs. */
+                nvectors = 2;
         }
 
-        /* Set the vector used for configuration */
-        snprintf(vp_dev->msix_names[0], sizeof(*vp_dev->msix_names),
-                 "%s-config", name);
-        err = request_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_config_changed,
-                        0, vp_dev->msix_names[0], vp_dev);
+        err = vp_request_msix_vectors(vdev, nvectors, per_vq_vectors,
+                                      per_vq_vectors ? desc : NULL);
         if (err)
-                goto out_free_msix_affinity_masks;
+                goto error_find;
 
-        /* Verify we had enough resources to assign the vector */
-        if (vp_dev->config_vector(vp_dev, 0) == VIRTIO_MSI_NO_VECTOR) {
-                err = -EBUSY;
-                goto out_free_config_irq;
-        }
-
-        vp_dev->msix_vector_map = kmalloc_array(nvqs,
-                        sizeof(*vp_dev->msix_vector_map), GFP_KERNEL);
-        if (!vp_dev->msix_vector_map)
-                goto out_disable_config_irq;
-
-        allocated_vectors = 1; /* vector 0 is the config interrupt */
+        vp_dev->per_vq_vectors = per_vq_vectors;
+        allocated_vectors = vp_dev->msix_used_vectors;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
 
-                if (callbacks[i])
-                        msix_vec = allocated_vectors;
-                else
+                if (!callbacks[i])
                         msix_vec = VIRTIO_MSI_NO_VECTOR;
-
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                msix_vec);
+                else if (vp_dev->per_vq_vectors)
+                        msix_vec = allocated_vectors++;
+                else
+                        msix_vec = VP_MSIX_VQ_VECTOR;
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     msix_vec);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto error_find;
                 }
 
-                if (msix_vec == VIRTIO_MSI_NO_VECTOR) {
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
+                if (!vp_dev->per_vq_vectors || msix_vec == VIRTIO_MSI_NO_VECTOR)
                         continue;
-                }
 
-                snprintf(vp_dev->msix_names[i + 1],
-                         sizeof(*vp_dev->msix_names), "%s-%s",
+                /* allocate per-vq irq if available and necessary */
+                snprintf(vp_dev->msix_names[msix_vec],
+                         sizeof *vp_dev->msix_names,
+                         "%s-%s",
                          dev_name(&vp_dev->vdev.dev), names[i]);
                 err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec),
-                                  vring_interrupt, IRQF_SHARED,
-                                  vp_dev->msix_names[i + 1], vqs[i]);
-                if (err) {
-                        /* don't free this irq on error */
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
-                        goto out_remove_vqs;
-                }
-                vp_dev->msix_vector_map[i] = msix_vec;
-
-                /*
-                 * Use a different vector for each queue if they are available,
-                 * else share the same vector for all VQs.
-                 */
-                if (!shared)
-                        allocated_vectors++;
+                                  vring_interrupt, 0,
+                                  vp_dev->msix_names[msix_vec],
+                                  vqs[i]);
+                if (err)
+                        goto error_find;
         }
-
         return 0;
 
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        kfree(vp_dev->msix_vector_map);
-out_disable_config_irq:
-        vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
-out_free_config_irq:
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-out_free_msix_affinity_masks:
-        for (i = 0; i < nvectors; i++) {
-                if (vp_dev->msix_affinity_masks[i])
-                        free_cpumask_var(vp_dev->msix_affinity_masks[i]);
-        }
-        kfree(vp_dev->msix_affinity_masks);
-out_free_msix_names:
-        kfree(vp_dev->msix_names);
-out_free_irq_vectors:
-        pci_free_irq_vectors(vp_dev->pci_dev);
+error_find:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -286,29 +350,33 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i, err;
 
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
+
         err = request_irq(vp_dev->pci_dev->irq, vp_interrupt, IRQF_SHARED,
                         dev_name(&vdev->dev), vp_dev);
         if (err)
-                return err;
+                goto out_del_vqs;
 
+        vp_dev->intx_enabled = 1;
+        vp_dev->per_vq_vectors = false;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                VIRTIO_MSI_NO_VECTOR);
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     VIRTIO_MSI_NO_VECTOR);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto out_del_vqs;
                 }
         }
 
         return 0;
-
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
+out_del_vqs:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -319,9 +387,15 @@ int vp_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
         int err;
 
-        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, desc);
+        /* Try MSI-X with one vector per queue. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, true, desc);
         if (!err)
                 return 0;
+        /* Fallback: MSI-X with one vector for config, one shared for queues. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, false, desc);
+        if (!err)
+                return 0;
+        /* Finally fall back to regular interrupts. */
         return vp_find_vqs_intx(vdev, nvqs, vqs, callbacks, names);
 }
 
@@ -341,15 +415,16 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 {
         struct virtio_device *vdev = vq->vdev;
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        struct cpumask *mask;
+        unsigned int irq;
 
         if (!vq->callback)
                 return -EINVAL;
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                int vec = vp_dev->msix_vector_map[vq->index];
-                struct cpumask *mask = vp_dev->msix_affinity_masks[vec];
-                unsigned int irq = pci_irq_vector(vp_dev->pci_dev, vec);
-
+        if (vp_dev->msix_enabled) {
+                mask = vp_dev->msix_affinity_masks[info->msix_vector];
+                irq = pci_irq_vector(vp_dev->pci_dev, info->msix_vector);
                 if (cpu == -1)
                         irq_set_affinity_hint(irq, NULL);
                 else {
@@ -364,12 +439,13 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 const struct cpumask *vp_get_vq_affinity(struct virtio_device *vdev, int index)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        unsigned int *map = vp_dev->msix_vector_map;
 
-        if (!map || map[index] == VIRTIO_MSI_NO_VECTOR)
+        if (!vp_dev->per_vq_vectors ||
+            vp_dev->vqs[index]->msix_vector == VIRTIO_MSI_NO_VECTOR)
                 return NULL;
 
-        return pci_irq_get_affinity(vp_dev->pci_dev, map[index]);
+        return pci_irq_get_affinity(vp_dev->pci_dev,
+                                    vp_dev->vqs[index]->msix_vector);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -440,6 +516,8 @@ static int virtio_pci_probe(struct pci_dev *pci_dev,
         vp_dev->vdev.dev.parent = &pci_dev->dev;
         vp_dev->vdev.dev.release = virtio_pci_release_dev;
         vp_dev->pci_dev = pci_dev;
+        INIT_LIST_HEAD(&vp_dev->virtqueues);
+        spin_lock_init(&vp_dev->lock);
 
         /* enable the device */
         rc = pci_enable_device(pci_dev);
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index ac8c9d788964..e96334aec1e0 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -31,6 +31,17 @@
 #include <linux/highmem.h>
 #include <linux/spinlock.h>
 
+struct virtio_pci_vq_info {
+        /* the actual virtqueue */
+        struct virtqueue *vq;
+
+        /* the list node for the virtqueues list */
+        struct list_head node;
+
+        /* MSI-X vector (or none) */
+        unsigned msix_vector;
+};
+
 /* Our device structure */
 struct virtio_pci_device {
         struct virtio_device vdev;
@@ -64,25 +75,47 @@ struct virtio_pci_device {
         /* the IO mapping for the PCI config space */
         void __iomem *ioaddr;
 
+        /* a list of queues so we can dispatch IRQs */
+        spinlock_t lock;
+        struct list_head virtqueues;
+
+        /* array of all queues for house-keeping */
+        struct virtio_pci_vq_info **vqs;
+
+        /* MSI-X support */
+        int msix_enabled;
+        int intx_enabled;
         cpumask_var_t *msix_affinity_masks;
         /* Name strings for interrupts. This size should be enough,
          * and I'm too lazy to allocate each name separately. */
         char (*msix_names)[256];
-        /* Total Number of MSI-X vectors (including per-VQ ones). */
-        int msix_vectors;
-        /* Map of per-VQ MSI-X vectors, may be NULL */
-        unsigned *msix_vector_map;
+        /* Number of available vectors */
+        unsigned msix_vectors;
+        /* Vectors allocated, excluding per-vq vectors if any */
+        unsigned msix_used_vectors;
+
+        /* Whether we have vector per vq */
+        bool per_vq_vectors;
 
         struct virtqueue *(*setup_vq)(struct virtio_pci_device *vp_dev,
+                                      struct virtio_pci_vq_info *info,
                                       unsigned idx,
                                       void (*callback)(struct virtqueue *vq),
                                       const char *name,
                                       u16 msix_vec);
-        void (*del_vq)(struct virtqueue *vq);
+        void (*del_vq)(struct virtio_pci_vq_info *info);
 
         u16 (*config_vector)(struct virtio_pci_device *vp_dev, u16 vector);
 };
 
+/* Constants for MSI-X */
+/* Use first vector for configuration changes, second and the rest for
+ * virtqueues Thus, we need at least 2 vectors for MSI. */
+enum {
+        VP_MSIX_CONFIG_VECTOR = 0,
+        VP_MSIX_VQ_VECTOR = 1,
+};
+
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index f7362c5fe18a..4bfa48fb1324 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -112,6 +112,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -129,6 +130,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         if (!num || ioread32(vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN))
                 return ERR_PTR(-ENOENT);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     VIRTIO_PCI_VRING_ALIGN, &vp_dev->vdev,
@@ -159,13 +162,14 @@ out_deactivate:
         return ERR_PTR(err);
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         iowrite16(vq->index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 iowrite16(VIRTIO_MSI_NO_VECTOR,
                           vp_dev->ioaddr + VIRTIO_MSI_QUEUE_VECTOR);
                 /* Flush the write out to device */
diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
index 7bc3004b840e..8978f109d2d7 100644
--- a/drivers/virtio/virtio_pci_modern.c
+++ b/drivers/virtio/virtio_pci_modern.c
@@ -293,6 +293,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -322,6 +323,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         /* get offset of notification word for this vq */
         off = vp_ioread16(&cfg->queue_notify_off);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     SMP_CACHE_BYTES, &vp_dev->vdev,
@@ -405,13 +408,14 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         return 0;
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         vp_iowrite16(vq->index, &vp_dev->common->queue_select);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 vp_iowrite16(VIRTIO_MSI_NO_VECTOR,
                              &vp_dev->common->queue_msix_vector);
                 /* Flush the write out to device */
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 4ce10bcca18b..23e391d3ec01 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -27,10 +27,10 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/syscore_ops.h>
 #include <linux/acpi.h>
 #include <acpi/processor.h>
 #include <xen/xen.h>
-#include <xen/xen-ops.h>
 #include <xen/interface/platform.h>
 #include <asm/xen/hypercall.h>
 
@@ -408,7 +408,7 @@ static int check_acpi_ids(struct acpi_processor *pr_backup)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             read_acpi_id, NULL, NULL, NULL);
-        acpi_get_devices("ACPI0007", read_acpi_id, NULL, NULL);
+        acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, read_acpi_id, NULL, NULL);
 
 upload:
         if (!bitmap_equal(acpi_id_present, acpi_ids_done, nr_acpi_bits)) {
@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(void)
         return rc;
 }
 
-static int xen_acpi_processor_resume(struct notifier_block *nb,
-                                     unsigned long action, void *data)
+static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
 {
+        int rc;
+
         bitmap_zero(acpi_ids_done, nr_acpi_bits);
-        return xen_upload_processor_pm_data();
+
+        rc = xen_upload_processor_pm_data();
+        if (rc != 0)
+                pr_info("ACPI data upload failed, error = %d\n", rc);
+}
+
+static void xen_acpi_processor_resume(void)
+{
+        static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
+
+        /*
+         * xen_upload_processor_pm_data() calls non-atomic code.
+         * However, the context for xen_acpi_processor_resume is syscore
+         * with only the boot CPU online and in an atomic context.
+         *
+         * So defer the upload for some point safer.
+         */
+        schedule_work(&wq);
 }
 
-struct notifier_block xen_acpi_processor_resume_nb = {
-        .notifier_call = xen_acpi_processor_resume,
+static struct syscore_ops xap_syscore_ops = {
+        .resume = xen_acpi_processor_resume,
 };
 
 static int __init xen_acpi_processor_init(void)
@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_init(void)
         if (rc)
                 goto err_unregister;
 
-        xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
+        register_syscore_ops(&xap_syscore_ops);
 
         return 0;
 err_unregister:
@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_exit(void)
 {
         int i;
 
-        xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
+        unregister_syscore_ops(&xap_syscore_ops);
         kfree(acpi_ids_done);
         kfree(acpi_id_present);
         kfree(acpi_id_cst_present);
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 1f4733b80c87..f3b089b7c0b6 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -442,8 +442,10 @@ static int xenbus_write_transaction(unsigned msg_type,
                 return xenbus_command_reply(u, XS_ERROR, "ENOENT");
 
         rc = xenbus_dev_request_and_reply(&u->u.msg, u);
-        if (rc)
+        if (rc && trans) {
+                list_del(&trans->list);
                 kfree(trans);
+        }
 
 out:
         return rc;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 29b7fc28c607..c4115901d906 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1259,7 +1259,7 @@ struct btrfs_root {
         atomic_t will_be_snapshoted;
 
         /* For qgroup metadata space reserve */
-        atomic_t qgroup_meta_rsv;
+        atomic64_t qgroup_meta_rsv;
 };
 static inline u32 btrfs_inode_sectorsize(const struct inode *inode)
 {
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 08b74daf35d0..eb1ee7b6f532 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1342,7 +1342,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
         atomic_set(&root->orphan_inodes, 0);
         atomic_set(&root->refs, 1);
         atomic_set(&root->will_be_snapshoted, 0);
-        atomic_set(&root->qgroup_meta_rsv, 0);
+        atomic64_set(&root->qgroup_meta_rsv, 0);
         root->log_transid = 0;
         root->log_transid_committed = -1;
         root->last_log_commit = 0;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 28e81922a21c..27fdb250b446 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1714,7 +1714,8 @@ static int __process_pages_contig(struct address_space *mapping,
                          * can we find nothing at @index.
                          */
                         ASSERT(page_ops & PAGE_LOCK);
-                        return ret;
+                        err = -EAGAIN;
+                        goto out;
                 }
 
                 for (i = 0; i < ret; i++) {
@@ -2583,26 +2584,36 @@ static void end_bio_extent_readpage(struct bio *bio)
 
                 if (tree->ops) {
                         ret = tree->ops->readpage_io_failed_hook(page, mirror);
-                        if (!ret && !bio->bi_error)
-                                uptodate = 1;
-                } else {
+                        if (ret == -EAGAIN) {
+                                /*
+                                 * Data inode's readpage_io_failed_hook() always
+                                 * returns -EAGAIN.
+                                 *
+                                 * The generic bio_readpage_error handles errors
+                                 * the following way: If possible, new read
+                                 * requests are created and submitted and will
+                                 * end up in end_bio_extent_readpage as well (if
+                                 * we're lucky, not in the !uptodate case). In
+                                 * that case it returns 0 and we just go on with
+                                 * the next page in our bio. If it can't handle
+                                 * the error it will return -EIO and we remain
+                                 * responsible for that page.
+                                 */
+                                ret = bio_readpage_error(bio, offset, page,
+                                                         start, end, mirror);
+                                if (ret == 0) {
+                                        uptodate = !bio->bi_error;
+                                        offset += len;
+                                        continue;
+                                }
+                        }
+
                         /*
-                         * The generic bio_readpage_error handles errors the
-                         * following way: If possible, new read requests are
-                         * created and submitted and will end up in
-                         * end_bio_extent_readpage as well (if we're lucky, not
-                         * in the !uptodate case). In that case it returns 0 and
-                         * we just go on with the next page in our bio. If it
-                         * can't handle the error it will return -EIO and we
-                         * remain responsible for that page.
+                         * metadata's readpage_io_failed_hook() always returns
+                         * -EIO and fixes nothing.  -EIO is also returned if
+                         * data inode error could not be fixed.
                          */
-                        ret = bio_readpage_error(bio, offset, page, start, end,
-                                                 mirror);
-                        if (ret == 0) {
-                                uptodate = !bio->bi_error;
-                                offset += len;
-                                continue;
-                        }
+                        ASSERT(ret == -EIO);
                 }
 readpage_ok:
                 if (likely(uptodate)) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c40060cc481f..5e71f1ea3391 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6709,6 +6709,20 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         max_size = min_t(unsigned long, PAGE_SIZE, max_size);
         ret = btrfs_decompress(compress_type, tmp, page,
                                extent_offset, inline_size, max_size);
+
+        /*
+         * decompression code contains a memset to fill in any space between the end
+         * of the uncompressed data and the end of max_size in case the decompressed
+         * data ends up shorter than ram_bytes.  That doesn't cover the hole between
+         * the end of an inline extent and the beginning of the next block, so we
+         * cover that region here.
+         */
+
+        if (max_size + pg_offset < PAGE_SIZE) {
+                char *map = kmap(page);
+                memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset);
+                kunmap(page);
+        }
         kfree(tmp);
         return ret;
 }
@@ -7896,7 +7910,6 @@ struct btrfs_retry_complete {
 static void btrfs_retry_endio_nocsum(struct bio *bio)
 {
         struct btrfs_retry_complete *done = bio->bi_private;
-        struct inode *inode;
         struct bio_vec *bvec;
         int i;
 
@@ -7904,12 +7917,12 @@ static void btrfs_retry_endio_nocsum(struct bio *bio)
                 goto end;
 
         ASSERT(bio->bi_vcnt == 1);
-        inode = bio->bi_io_vec->bv_page->mapping->host;
-        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(inode));
+        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(done->inode));
 
         done->uptodate = 1;
         bio_for_each_segment_all(bvec, bio, i)
-        clean_io_failure(BTRFS_I(done->inode), done->start, bvec->bv_page, 0);
+                clean_io_failure(BTRFS_I(done->inode), done->start,
+                                 bvec->bv_page, 0);
 end:
         complete(&done->done);
         bio_put(bio);
@@ -7959,8 +7972,10 @@ next_block_or_try_again:
 
                 start += sectorsize;
 
-                if (nr_sectors--) {
+                nr_sectors--;
+                if (nr_sectors) {
                         pgoff += sectorsize;
+                        ASSERT(pgoff < PAGE_SIZE);
                         goto next_block_or_try_again;
                 }
         }
@@ -7972,9 +7987,7 @@ static void btrfs_retry_endio(struct bio *bio)
 {
         struct btrfs_retry_complete *done = bio->bi_private;
         struct btrfs_io_bio *io_bio = btrfs_io_bio(bio);
-        struct inode *inode;
         struct bio_vec *bvec;
-        u64 start;
         int uptodate;
         int ret;
         int i;
@@ -7984,11 +7997,8 @@ static void btrfs_retry_endio(struct bio *bio)
 
         uptodate = 1;
 
-        start = done->start;
-
         ASSERT(bio->bi_vcnt == 1);
-        inode = bio->bi_io_vec->bv_page->mapping->host;
-        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(inode));
+        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(done->inode));
 
         bio_for_each_segment_all(bvec, bio, i) {
                 ret = __readpage_endio_check(done->inode, io_bio, i,
@@ -8066,8 +8076,10 @@ next:
 
                 ASSERT(nr_sectors);
 
-                if (--nr_sectors) {
+                nr_sectors--;
+                if (nr_sectors) {
                         pgoff += sectorsize;
+                        ASSERT(pgoff < PAGE_SIZE);
                         goto next_block;
                 }
         }
@@ -10509,9 +10521,9 @@ out_inode:
 }
 
 __attribute__((const))
-static int dummy_readpage_io_failed_hook(struct page *page, int failed_mirror)
+static int btrfs_readpage_io_failed_hook(struct page *page, int failed_mirror)
 {
-        return 0;
+        return -EAGAIN;
 }
 
 static const struct inode_operations btrfs_dir_inode_operations = {
@@ -10556,7 +10568,7 @@ static const struct extent_io_ops btrfs_extent_io_ops = {
         .submit_bio_hook = btrfs_submit_bio_hook,
         .readpage_end_io_hook = btrfs_readpage_end_io_hook,
         .merge_bio_hook = btrfs_merge_bio_hook,
-        .readpage_io_failed_hook = dummy_readpage_io_failed_hook,
+        .readpage_io_failed_hook = btrfs_readpage_io_failed_hook,
 
         /* optional callbacks */
         .fill_delalloc = run_delalloc_range,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index a5da750c1087..a59801dc2a34 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2948,20 +2948,20 @@ int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
         ret = qgroup_reserve(root, num_bytes, enforce);
         if (ret < 0)
                 return ret;
-        atomic_add(num_bytes, &root->qgroup_meta_rsv);
+        atomic64_add(num_bytes, &root->qgroup_meta_rsv);
         return ret;
 }
 
 void btrfs_qgroup_free_meta_all(struct btrfs_root *root)
 {
         struct btrfs_fs_info *fs_info = root->fs_info;
-        int reserved;
+        u64 reserved;
 
         if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) ||
             !is_fstree(root->objectid))
                 return;
 
-        reserved = atomic_xchg(&root->qgroup_meta_rsv, 0);
+        reserved = atomic64_xchg(&root->qgroup_meta_rsv, 0);
         if (reserved == 0)
                 return;
         btrfs_qgroup_free_refroot(fs_info, root->objectid, reserved);
@@ -2976,8 +2976,8 @@ void btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes)
                 return;
 
         BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
-        WARN_ON(atomic_read(&root->qgroup_meta_rsv) < num_bytes);
-        atomic_sub(num_bytes, &root->qgroup_meta_rsv);
+        WARN_ON(atomic64_read(&root->qgroup_meta_rsv) < num_bytes);
+        atomic64_sub(num_bytes, &root->qgroup_meta_rsv);
         btrfs_qgroup_free_refroot(fs_info, root->objectid, num_bytes);
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 456c8901489b..a60d5bfb8a49 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                 goto out;
         }
 
+        /*
+         * Check that we don't overflow at later allocations, we request
+         * clone_sources_count + 1 items, and compare to unsigned long inside
+         * access_ok.
+         */
         if (arg->clone_sources_count >
-            ULLONG_MAX / sizeof(*arg->clone_sources)) {
+            ULONG_MAX / sizeof(struct clone_root) - 1) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index da687dc79cce..9530a333d302 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -549,16 +549,19 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
                 case Opt_ssd:
                         btrfs_set_and_info(info, SSD,
                                            "use ssd allocation scheme");
+                        btrfs_clear_opt(info->mount_opt, NOSSD);
                         break;
                 case Opt_ssd_spread:
                         btrfs_set_and_info(info, SSD_SPREAD,
                                            "use spread ssd allocation scheme");
                         btrfs_set_opt(info->mount_opt, SSD);
+                        btrfs_clear_opt(info->mount_opt, NOSSD);
                         break;
                 case Opt_nossd:
                         btrfs_set_and_info(info, NOSSD,
                                              "not using ssd allocation scheme");
                         btrfs_clear_opt(info->mount_opt, SSD);
+                        btrfs_clear_opt(info->mount_opt, SSD_SPREAD);
                         break;
                 case Opt_barrier:
                         btrfs_clear_and_info(info, NOBARRIER,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 73d56eef5e60..ab8a66d852f9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6213,7 +6213,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
         for (dev_nr = 0; dev_nr < total_devs; dev_nr++) {
                 dev = bbio->stripes[dev_nr].dev;
                 if (!dev || !dev->bdev ||
-                    (bio_op(bio) == REQ_OP_WRITE && !dev->writeable)) {
+                    (bio_op(first_bio) == REQ_OP_WRITE && !dev->writeable)) {
                         bbio_error(bbio, first_bio, logical);
                         continue;
                 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 15e1db8738ae..dd3f5fabfdf6 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -972,6 +972,86 @@ out:
         return rc;
 }
 
+ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        struct inode *src_inode = file_inode(src_file);
+        struct inode *target_inode = file_inode(dst_file);
+        struct cifsFileInfo *smb_file_src;
+        struct cifsFileInfo *smb_file_target;
+        struct cifs_tcon *src_tcon;
+        struct cifs_tcon *target_tcon;
+        ssize_t rc;
+
+        cifs_dbg(FYI, "copychunk range\n");
+
+        if (src_inode == target_inode) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        if (!src_file->private_data || !dst_file->private_data) {
+                rc = -EBADF;
+                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
+                goto out;
+        }
+
+        rc = -EXDEV;
+        smb_file_target = dst_file->private_data;
+        smb_file_src = src_file->private_data;
+        src_tcon = tlink_tcon(smb_file_src->tlink);
+        target_tcon = tlink_tcon(smb_file_target->tlink);
+
+        if (src_tcon->ses != target_tcon->ses) {
+                cifs_dbg(VFS, "source and target of copy not on same server\n");
+                goto out;
+        }
+
+        /*
+         * Note: cifs case is easier than btrfs since server responsible for
+         * checks for proper open modes and file type and if it wants
+         * server could even support copy of range where source = target
+         */
+        lock_two_nondirectories(target_inode, src_inode);
+
+        cifs_dbg(FYI, "about to flush pages\n");
+        /* should we flush first and last page first */
+        truncate_inode_pages(&target_inode->i_data, 0);
+
+        if (target_tcon->ses->server->ops->copychunk_range)
+                rc = target_tcon->ses->server->ops->copychunk_range(xid,
+                        smb_file_src, smb_file_target, off, len, destoff);
+        else
+                rc = -EOPNOTSUPP;
+
+        /* force revalidate of size and timestamps of target file now
+         * that target is updated on the server
+         */
+        CIFS_I(target_inode)->time = 0;
+        /* although unlocking in the reverse order from locking is not
+         * strictly necessary here it is a little cleaner to be consistent
+         */
+        unlock_two_nondirectories(src_inode, target_inode);
+
+out:
+        return rc;
+}
+
+static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        unsigned int xid = get_xid();
+        ssize_t rc;
+
+        rc = cifs_file_copychunk_range(xid, src_file, off, dst_file, destoff,
+                                        len, flags);
+        free_xid(xid);
+        return rc;
+}
+
 const struct file_operations cifs_file_ops = {
         .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
@@ -984,6 +1064,7 @@ const struct file_operations cifs_file_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1001,6 +1082,7 @@ const struct file_operations cifs_file_strict_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1018,6 +1100,7 @@ const struct file_operations cifs_file_direct_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1035,6 +1118,7 @@ const struct file_operations cifs_file_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1051,6 +1135,7 @@ const struct file_operations cifs_file_strict_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1067,6 +1152,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1078,6 +1164,7 @@ const struct file_operations cifs_dir_ops = {
         .release = cifs_closedir,
         .read    = generic_read_dir,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = generic_file_llseek,
 };
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index da717fee3026..30bf89b1fd9a 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -139,6 +139,11 @@ extern ssize_t	cifs_listxattr(struct dentry *, char *, size_t);
 # define cifs_listxattr NULL
 #endif
 
+extern ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                        struct file *src_file, loff_t off,
+                                        struct file *dst_file, loff_t destoff,
+                                        size_t len, unsigned int flags);
+
 extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_CIFS_NFSD_EXPORT
 extern const struct export_operations cifs_export_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d42dd3288647..37f5a41cc50c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -243,6 +243,7 @@ struct smb_version_operations {
         /* verify the message */
         int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
         bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+        int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
         void (*downgrade_oplock)(struct TCP_Server_Info *,
                                         struct cifsInodeInfo *, bool);
         /* process transaction2 response */
@@ -407,9 +408,10 @@ struct smb_version_operations {
         char * (*create_lease_buf)(u8 *, u8);
         /* parse lease context buffer and return oplock/epoch info */
         __u8 (*parse_lease_buf)(void *, unsigned int *);
-        int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
-                        struct cifsFileInfo *target_file, u64 src_off, u64 len,
-                        u64 dest_off);
+        ssize_t (*copychunk_range)(const unsigned int,
+                        struct cifsFileInfo *src_file,
+                        struct cifsFileInfo *target_file,
+                        u64 src_off, u64 len, u64 dest_off);
         int (*duplicate_extents)(const unsigned int, struct cifsFileInfo *src,
                         struct cifsFileInfo *target_file, u64 src_off, u64 len,
                         u64 dest_off);
@@ -946,7 +948,6 @@ struct cifs_tcon {
         bool use_persistent:1; /* use persistent instead of durable handles */
 #ifdef CONFIG_CIFS_SMB2
         bool print:1;           /* set if connection to printer share */
-        bool bad_network_name:1; /* set if ret status STATUS_BAD_NETWORK_NAME */
         __le32 capabilities;
         __u32 share_flags;
         __u32 maximal_access;
@@ -1343,6 +1344,7 @@ struct mid_q_entry {
         void *callback_data;      /* general purpose pointer for callback */
         void *resp_buf;         /* pointer to received SMB header */
         int mid_state;  /* wish this were enum but can not pass to wait_event */
+        unsigned int mid_flags;
         __le16 command;         /* smb command code */
         bool large_buf:1;       /* if valid response, is pointer to large buf */
         bool multiRsp:1;        /* multiple trans2 responses for one request  */
@@ -1350,6 +1352,12 @@ struct mid_q_entry {
         bool decrypted:1;       /* decrypted entry */
 };
 
+struct close_cancelled_open {
+        struct cifs_fid         fid;
+        struct cifs_tcon        *tcon;
+        struct work_struct      work;
+};
+
 /*      Make code in transport.c a little cleaner by moving
         update of optional stats into function below */
 #ifdef CONFIG_CIFS_STATS2
@@ -1481,6 +1489,9 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
 #define   MID_RESPONSE_MALFORMED 0x10
 #define   MID_SHUTDOWN           0x20
 
+/* Flags */
+#define   MID_WAIT_CANCELLED     1 /* Cancelled while waiting for response */
+
 /* Types of response buffer returned from SendReceive2 */
 #define   CIFS_NO_BUFFER        0    /* Response buffer not returned */
 #define   CIFS_SMALL_BUFFER     1
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 066950671929..5d21f00ae341 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1428,6 +1428,8 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 
         length = cifs_discard_remaining_data(server);
         dequeue_mid(mid, rdata->result);
+        mid->resp_buf = server->smallbuf;
+        server->smallbuf = NULL;
         return length;
 }
 
@@ -1541,6 +1543,8 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                 return cifs_readv_discard(server, mid);
 
         dequeue_mid(mid, false);
+        mid->resp_buf = server->smallbuf;
+        server->smallbuf = NULL;
         return length;
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9ae695ae3ed7..d82467cfb0e2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -904,10 +904,19 @@ cifs_demultiplex_thread(void *p)
 
                 server->lstrp = jiffies;
                 if (mid_entry != NULL) {
+                        if ((mid_entry->mid_flags & MID_WAIT_CANCELLED) &&
+                             mid_entry->mid_state == MID_RESPONSE_RECEIVED &&
+                                        server->ops->handle_cancelled_mid)
+                                server->ops->handle_cancelled_mid(
+                                                        mid_entry->resp_buf,
+                                                        server);
+
                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
                                 mid_entry->callback(mid_entry);
-                } else if (!server->ops->is_oplock_break ||
-                           !server->ops->is_oplock_break(buf, server)) {
+                } else if (server->ops->is_oplock_break &&
+                           server->ops->is_oplock_break(buf, server)) {
+                        cifs_dbg(FYI, "Received oplock break\n");
+                } else {
                         cifs_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
                                  atomic_read(&midCount));
                         cifs_dump_mem("Received Data is: ", buf,
@@ -3744,6 +3753,9 @@ try_mount_again:
         if (IS_ERR(tcon)) {
                 rc = PTR_ERR(tcon);
                 tcon = NULL;
+                if (rc == -EACCES)
+                        goto mount_fail_check;
+
                 goto remote_path_check;
         }
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index aa3debbba826..21d404535739 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2597,7 +2597,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                 wdata->credits = credits;
 
                 if (!wdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(wdata->cfile, false))
+                    !(rc = cifs_reopen_file(wdata->cfile, false)))
                         rc = server->ops->async_writev(wdata,
                                         cifs_uncached_writedata_release);
                 if (rc) {
@@ -3022,7 +3022,7 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                 rdata->credits = credits;
 
                 if (!rdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(rdata->cfile, true))
+                    !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
 error:
                 if (rc) {
@@ -3617,7 +3617,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 }
 
                 if (!rdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(rdata->cfile, true))
+                    !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
                 if (rc) {
                         add_credits_and_wake_if(server, rdata->credits, 0);
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 001528781b6b..265c45fe4ea5 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -34,71 +34,14 @@
 #include "cifs_ioctl.h"
 #include <linux/btrfs.h>
 
-static int cifs_file_clone_range(unsigned int xid, struct file *src_file,
-                          struct file *dst_file)
-{
-        struct inode *src_inode = file_inode(src_file);
-        struct inode *target_inode = file_inode(dst_file);
-        struct cifsFileInfo *smb_file_src;
-        struct cifsFileInfo *smb_file_target;
-        struct cifs_tcon *src_tcon;
-        struct cifs_tcon *target_tcon;
-        int rc;
-
-        cifs_dbg(FYI, "ioctl clone range\n");
-
-        if (!src_file->private_data || !dst_file->private_data) {
-                rc = -EBADF;
-                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
-                goto out;
-        }
-
-        rc = -EXDEV;
-        smb_file_target = dst_file->private_data;
-        smb_file_src = src_file->private_data;
-        src_tcon = tlink_tcon(smb_file_src->tlink);
-        target_tcon = tlink_tcon(smb_file_target->tlink);
-
-        if (src_tcon->ses != target_tcon->ses) {
-                cifs_dbg(VFS, "source and target of copy not on same server\n");
-                goto out;
-        }
-
-        /*
-         * Note: cifs case is easier than btrfs since server responsible for
-         * checks for proper open modes and file type and if it wants
-         * server could even support copy of range where source = target
-         */
-        lock_two_nondirectories(target_inode, src_inode);
-
-        cifs_dbg(FYI, "about to flush pages\n");
-        /* should we flush first and last page first */
-        truncate_inode_pages(&target_inode->i_data, 0);
-
-        if (target_tcon->ses->server->ops->clone_range)
-                rc = target_tcon->ses->server->ops->clone_range(xid,
-                        smb_file_src, smb_file_target, 0, src_inode->i_size, 0);
-        else
-                rc = -EOPNOTSUPP;
-
-        /* force revalidate of size and timestamps of target file now
-           that target is updated on the server */
-        CIFS_I(target_inode)->time = 0;
-        /* although unlocking in the reverse order from locking is not
-           strictly necessary here it is a little cleaner to be consistent */
-        unlock_two_nondirectories(src_inode, target_inode);
-out:
-        return rc;
-}
-
-static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+static long cifs_ioctl_copychunk(unsigned int xid, struct file *dst_file,
                         unsigned long srcfd)
 {
         int rc;
         struct fd src_file;
         struct inode *src_inode;
 
-        cifs_dbg(FYI, "ioctl clone range\n");
+        cifs_dbg(FYI, "ioctl copychunk range\n");
         /* the destination must be opened for writing */
         if (!(dst_file->f_mode & FMODE_WRITE)) {
                 cifs_dbg(FYI, "file target not open for write\n");
@@ -129,7 +72,8 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
         if (S_ISDIR(src_inode->i_mode))
                 goto out_fput;
 
-        rc = cifs_file_clone_range(xid, src_file.file, dst_file);
+        rc = cifs_file_copychunk_range(xid, src_file.file, 0, dst_file, 0,
+                                        src_inode->i_size, 0);
 
 out_fput:
         fdput(src_file);
@@ -251,7 +195,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                         }
                         break;
                 case CIFS_IOC_COPYCHUNK_FILE:
-                        rc = cifs_ioctl_clone(xid, filep, arg);
+                        rc = cifs_ioctl_copychunk(xid, filep, arg);
                         break;
                 case CIFS_IOC_SET_INTEGRITY:
                         if (pSMBFile == NULL)
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index cc93ba4da9b5..27bc360c7ffd 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1015,6 +1015,15 @@ cifs_dir_needs_close(struct cifsFileInfo *cfile)
         return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle;
 }
 
+static bool
+cifs_can_echo(struct TCP_Server_Info *server)
+{
+        if (server->tcpStatus == CifsGood)
+                return true;
+
+        return false;
+}
+
 struct smb_version_operations smb1_operations = {
         .send_cancel = send_nt_cancel,
         .compare_fids = cifs_compare_fids,
@@ -1049,6 +1058,7 @@ struct smb_version_operations smb1_operations = {
         .get_dfs_refer = CIFSGetDFSRefer,
         .qfs_tcon = cifs_qfs_tcon,
         .is_path_accessible = cifs_is_path_accessible,
+        .can_echo = cifs_can_echo,
         .query_path_info = cifs_query_path_info,
         .query_file_info = cifs_query_file_info,
         .get_srv_inum = cifs_get_srv_inum,
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index fd516ea8b8f8..1a04b3a5beb1 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -659,3 +659,49 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
         cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
         return false;
 }
+
+void
+smb2_cancelled_close_fid(struct work_struct *work)
+{
+        struct close_cancelled_open *cancelled = container_of(work,
+                                        struct close_cancelled_open, work);
+
+        cifs_dbg(VFS, "Close unmatched open\n");
+
+        SMB2_close(0, cancelled->tcon, cancelled->fid.persistent_fid,
+                   cancelled->fid.volatile_fid);
+        cifs_put_tcon(cancelled->tcon);
+        kfree(cancelled);
+}
+
+int
+smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
+{
+        struct smb2_sync_hdr *sync_hdr = get_sync_hdr(buffer);
+        struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
+        struct cifs_tcon *tcon;
+        struct close_cancelled_open *cancelled;
+
+        if (sync_hdr->Command != SMB2_CREATE ||
+            sync_hdr->Status != STATUS_SUCCESS)
+                return 0;
+
+        cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+        if (!cancelled)
+                return -ENOMEM;
+
+        tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId,
+                                  sync_hdr->TreeId);
+        if (!tcon) {
+                kfree(cancelled);
+                return -ENOENT;
+        }
+
+        cancelled->fid.persistent_fid = rsp->PersistentFileId;
+        cancelled->fid.volatile_fid = rsp->VolatileFileId;
+        cancelled->tcon = tcon;
+        INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
+        queue_work(cifsiod_wq, &cancelled->work);
+
+        return 0;
+}
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0231108d9387..152e37f2ad92 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -21,6 +21,7 @@
 #include <linux/vfs.h>
 #include <linux/falloc.h>
 #include <linux/scatterlist.h>
+#include <linux/uuid.h>
 #include <crypto/aead.h>
 #include "cifsglob.h"
 #include "smb2pdu.h"
@@ -592,8 +593,8 @@ req_res_key_exit:
         return rc;
 }
 
-static int
-smb2_clone_range(const unsigned int xid,
+static ssize_t
+smb2_copychunk_range(const unsigned int xid,
                         struct cifsFileInfo *srcfile,
                         struct cifsFileInfo *trgtfile, u64 src_off,
                         u64 len, u64 dest_off)
@@ -605,13 +606,14 @@ smb2_clone_range(const unsigned int xid,
         struct cifs_tcon *tcon;
         int chunks_copied = 0;
         bool chunk_sizes_updated = false;
+        ssize_t bytes_written, total_bytes_written = 0;
 
         pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
 
         if (pcchunk == NULL)
                 return -ENOMEM;
 
-        cifs_dbg(FYI, "in smb2_clone_range - about to call request res key\n");
+        cifs_dbg(FYI, "in smb2_copychunk_range - about to call request res key\n");
         /* Request a key from the server to identify the source of the copy */
         rc = SMB2_request_res_key(xid, tlink_tcon(srcfile->tlink),
                                 srcfile->fid.persistent_fid,
@@ -669,14 +671,16 @@ smb2_clone_range(const unsigned int xid,
                         }
                         chunks_copied++;
 
-                        src_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        dest_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        len -= le32_to_cpu(retbuf->TotalBytesWritten);
+                        bytes_written = le32_to_cpu(retbuf->TotalBytesWritten);
+                        src_off += bytes_written;
+                        dest_off += bytes_written;
+                        len -= bytes_written;
+                        total_bytes_written += bytes_written;
 
-                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %d\n",
+                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %zu\n",
                                 le32_to_cpu(retbuf->ChunksWritten),
                                 le32_to_cpu(retbuf->ChunkBytesWritten),
-                                le32_to_cpu(retbuf->TotalBytesWritten));
+                                bytes_written);
                 } else if (rc == -EINVAL) {
                         if (ret_data_len != sizeof(struct copychunk_ioctl_rsp))
                                 goto cchunk_out;
@@ -713,7 +717,10 @@ smb2_clone_range(const unsigned int xid,
 cchunk_out:
         kfree(pcchunk);
         kfree(retbuf);
-        return rc;
+        if (rc)
+                return rc;
+        else
+                return total_bytes_written;
 }
 
 static int
@@ -2322,6 +2329,7 @@ struct smb_version_operations smb20_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2377,7 +2385,7 @@ struct smb_version_operations smb20_operations = {
         .set_oplock_level = smb2_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .get_dfs_refer = smb2_get_dfs_refer,
@@ -2404,6 +2412,7 @@ struct smb_version_operations smb21_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2459,7 +2468,7 @@ struct smb_version_operations smb21_operations = {
         .set_oplock_level = smb21_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .enum_snapshots = smb3_enum_snapshots,
@@ -2488,6 +2497,7 @@ struct smb_version_operations smb30_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2545,7 +2555,7 @@ struct smb_version_operations smb30_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
         .validate_negotiate = smb3_validate_negotiate,
         .wp_retry_size = smb2_wp_retry_size,
@@ -2582,6 +2592,7 @@ struct smb_version_operations smb311_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2639,7 +2650,7 @@ struct smb_version_operations smb311_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
 /*      .validate_negotiate = smb3_validate_negotiate, */ /* not used in 3.11 */
         .wp_retry_size = smb2_wp_retry_size,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 7446496850a3..02da648041fc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -562,8 +562,10 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
          * but for time being this is our only auth choice so doesn't matter.
          * We just found a server which sets blob length to zero expecting raw.
          */
-        if (blob_length == 0)
+        if (blob_length == 0) {
                 cifs_dbg(FYI, "missing security blob on negprot\n");
+                server->sec_ntlmssp = true;
+        }
 
         rc = cifs_enable_signing(server, ses->sign);
         if (rc)
@@ -1171,9 +1173,6 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
         else
                 return -EIO;
 
-        if (tcon && tcon->bad_network_name)
-                return -ENOENT;
-
         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
         if (unc_path == NULL)
                 return -ENOMEM;
@@ -1185,6 +1184,10 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
                 return -EINVAL;
         }
 
+        /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
+        if (tcon)
+                tcon->tid = 0;
+
         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
         if (rc) {
                 kfree(unc_path);
@@ -1273,8 +1276,6 @@ tcon_exit:
 tcon_error_exit:
         if (rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
-                if (tcon)
-                        tcon->bad_network_name = true;
         }
         goto tcon_exit;
 }
@@ -2177,6 +2178,9 @@ void smb2_reconnect_server(struct work_struct *work)
         struct cifs_tcon *tcon, *tcon2;
         struct list_head tmp_list;
         int tcon_exist = false;
+        int rc;
+        int resched = false;
+
 
         /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
         mutex_lock(&server->reconnect_mutex);
@@ -2204,13 +2208,18 @@ void smb2_reconnect_server(struct work_struct *work)
         spin_unlock(&cifs_tcp_ses_lock);
 
         list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
-                if (!smb2_reconnect(SMB2_INTERNAL_CMD, tcon))
+                rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon);
+                if (!rc)
                         cifs_reopen_persistent_handles(tcon);
+                else
+                        resched = true;
                 list_del_init(&tcon->rlist);
                 cifs_put_tcon(tcon);
         }
 
         cifs_dbg(FYI, "Reconnecting tcons finished\n");
+        if (resched)
+                queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
         mutex_unlock(&server->reconnect_mutex);
 
         /* now we can safely release srv struct */
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 69e35873b1de..6853454fc871 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -48,6 +48,10 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses,
                               struct smb_rqst *rqst);
 extern struct mid_q_entry *smb2_setup_async_request(
                         struct TCP_Server_Info *server, struct smb_rqst *rqst);
+extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
+                                           __u64 ses_id);
+extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
+                                                __u64 ses_id, __u32  tid);
 extern int smb2_calc_signature(struct smb_rqst *rqst,
                                 struct TCP_Server_Info *server);
 extern int smb3_calc_signature(struct smb_rqst *rqst,
@@ -164,6 +168,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
 extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
                              const u64 persistent_fid, const u64 volatile_fid,
                              const __u8 oplock_level);
+extern int smb2_handle_cancelled_mid(char *buffer,
+                                        struct TCP_Server_Info *server);
+void smb2_cancelled_close_fid(struct work_struct *work);
 extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
                          u64 persistent_file_id, u64 volatile_file_id,
                          struct kstatfs *FSData);
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 7c3bb1bd7eed..506b67fc93d9 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -115,23 +115,70 @@ smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
         return 0;
 }
 
-struct cifs_ses *
-smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+static struct cifs_ses *
+smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
 {
         struct cifs_ses *ses;
 
-        spin_lock(&cifs_tcp_ses_lock);
         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
                 if (ses->Suid != ses_id)
                         continue;
-                spin_unlock(&cifs_tcp_ses_lock);
                 return ses;
         }
+
+        return NULL;
+}
+
+struct cifs_ses *
+smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+{
+        struct cifs_ses *ses;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
         spin_unlock(&cifs_tcp_ses_lock);
 
+        return ses;
+}
+
+static struct cifs_tcon *
+smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32  tid)
+{
+        struct cifs_tcon *tcon;
+
+        list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
+                if (tcon->tid != tid)
+                        continue;
+                ++tcon->tc_count;
+                return tcon;
+        }
+
         return NULL;
 }
 
+/*
+ * Obtain tcon corresponding to the tid in the given
+ * cifs_ses
+ */
+
+struct cifs_tcon *
+smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32  tid)
+{
+        struct cifs_ses *ses;
+        struct cifs_tcon *tcon;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
+        if (!ses) {
+                spin_unlock(&cifs_tcp_ses_lock);
+                return NULL;
+        }
+        tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
+        spin_unlock(&cifs_tcp_ses_lock);
+
+        return tcon;
+}
+
 int
 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 526f0533cb4e..f6e13a977fc8 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -752,9 +752,11 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
 
         rc = wait_for_response(ses->server, midQ);
         if (rc != 0) {
+                cifs_dbg(FYI, "Cancelling wait for mid %llu\n", midQ->mid);
                 send_cancel(ses->server, rqst, midQ);
                 spin_lock(&GlobalMid_Lock);
                 if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+                        midQ->mid_flags |= MID_WAIT_CANCELLED;
                         midQ->callback = DeleteMidQEntry;
                         spin_unlock(&GlobalMid_Lock);
                         add_credits(ses->server, 1, optype);
diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 02a7a9286449..6d6eca394d4d 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -327,7 +327,6 @@ EXPORT_SYMBOL(fscrypt_decrypt_page);
 static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
         struct dentry *dir;
-        struct fscrypt_info *ci;
         int dir_has_key, cached_with_key;
 
         if (flags & LOOKUP_RCU)
@@ -339,18 +338,11 @@ static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
                 return 0;
         }
 
-        ci = d_inode(dir)->i_crypt_info;
-        if (ci && ci->ci_keyring_key &&
-            (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                          (1 << KEY_FLAG_REVOKED) |
-                                          (1 << KEY_FLAG_DEAD))))
-                ci = NULL;
-
         /* this should eventually be an flag in d_flags */
         spin_lock(&dentry->d_lock);
         cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
         spin_unlock(&dentry->d_lock);
-        dir_has_key = (ci != NULL);
+        dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
         dput(dir);
 
         /*
diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 13052b85c393..37b49894c762 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -350,7 +350,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                 fname->disk_name.len = iname->len;
                 return 0;
         }
-        ret = fscrypt_get_crypt_info(dir);
+        ret = fscrypt_get_encryption_info(dir);
         if (ret && ret != -EOPNOTSUPP)
                 return ret;
 
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index fdbb8af32eaf..e39696e64494 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -67,7 +67,6 @@ struct fscrypt_info {
         u8 ci_filename_mode;
         u8 ci_flags;
         struct crypto_skcipher *ci_ctfm;
-        struct key *ci_keyring_key;
         u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE];
 };
 
@@ -101,7 +100,4 @@ extern int fscrypt_do_page_crypto(const struct inode *inode,
 extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,
                                               gfp_t gfp_flags);
 
-/* keyinfo.c */
-extern int fscrypt_get_crypt_info(struct inode *);
-
 #endif /* _FSCRYPT_PRIVATE_H */
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index d5d896fa5a71..8cdfddce2b34 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -95,6 +95,7 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
         kfree(description);
         if (IS_ERR(keyring_key))
                 return PTR_ERR(keyring_key);
+        down_read(&keyring_key->sem);
 
         if (keyring_key->type != &key_type_logon) {
                 printk_once(KERN_WARNING
@@ -102,11 +103,9 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                 res = -ENOKEY;
                 goto out;
         }
-        down_read(&keyring_key->sem);
         ukp = user_key_payload_locked(keyring_key);
         if (ukp->datalen != sizeof(struct fscrypt_key)) {
                 res = -EINVAL;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         master_key = (struct fscrypt_key *)ukp->data;
@@ -117,17 +116,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                                 "%s: key size incorrect: %d\n",
                                 __func__, master_key->size);
                 res = -ENOKEY;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
-        up_read(&keyring_key->sem);
-        if (res)
-                goto out;
-
-        crypt_info->ci_keyring_key = keyring_key;
-        return 0;
 out:
+        up_read(&keyring_key->sem);
         key_put(keyring_key);
         return res;
 }
@@ -169,12 +162,11 @@ static void put_crypt_info(struct fscrypt_info *ci)
         if (!ci)
                 return;
 
-        key_put(ci->ci_keyring_key);
         crypto_free_skcipher(ci->ci_ctfm);
         kmem_cache_free(fscrypt_info_cachep, ci);
 }
 
-int fscrypt_get_crypt_info(struct inode *inode)
+int fscrypt_get_encryption_info(struct inode *inode)
 {
         struct fscrypt_info *crypt_info;
         struct fscrypt_context ctx;
@@ -184,21 +176,15 @@ int fscrypt_get_crypt_info(struct inode *inode)
         u8 *raw_key = NULL;
         int res;
 
+        if (inode->i_crypt_info)
+                return 0;
+
         res = fscrypt_initialize(inode->i_sb->s_cop->flags);
         if (res)
                 return res;
 
         if (!inode->i_sb->s_cop->get_context)
                 return -EOPNOTSUPP;
-retry:
-        crypt_info = ACCESS_ONCE(inode->i_crypt_info);
-        if (crypt_info) {
-                if (!crypt_info->ci_keyring_key ||
-                                key_validate(crypt_info->ci_keyring_key) == 0)
-                        return 0;
-                fscrypt_put_encryption_info(inode, crypt_info);
-                goto retry;
-        }
 
         res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
         if (res < 0) {
@@ -229,7 +215,6 @@ retry:
         crypt_info->ci_data_mode = ctx.contents_encryption_mode;
         crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
         crypt_info->ci_ctfm = NULL;
-        crypt_info->ci_keyring_key = NULL;
         memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
                                 sizeof(crypt_info->ci_master_key));
 
@@ -273,14 +258,8 @@ retry:
         if (res)
                 goto out;
 
-        kzfree(raw_key);
-        raw_key = NULL;
-        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
-                put_crypt_info(crypt_info);
-                goto retry;
-        }
-        return 0;
-
+        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
+                crypt_info = NULL;
 out:
         if (res == -ENOKEY)
                 res = 0;
@@ -288,6 +267,7 @@ out:
         kzfree(raw_key);
         return res;
 }
+EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
 void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
 {
@@ -305,17 +285,3 @@ void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
         put_crypt_info(ci);
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
-
-int fscrypt_get_encryption_info(struct inode *inode)
-{
-        struct fscrypt_info *ci = inode->i_crypt_info;
-
-        if (!ci ||
-                (ci->ci_keyring_key &&
-                 (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                               (1 << KEY_FLAG_REVOKED) |
-                                               (1 << KEY_FLAG_DEAD)))))
-                return fscrypt_get_crypt_info(inode);
-        return 0;
-}
-EXPORT_SYMBOL(fscrypt_get_encryption_info);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 14b76da71269..4908906d54d5 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -33,17 +33,10 @@ static int create_encryption_context_from_policy(struct inode *inode,
                                 const struct fscrypt_policy *policy)
 {
         struct fscrypt_context ctx;
-        int res;
 
         if (!inode->i_sb->s_cop->set_context)
                 return -EOPNOTSUPP;
 
-        if (inode->i_sb->s_cop->prepare_context) {
-                res = inode->i_sb->s_cop->prepare_context(inode);
-                if (res)
-                        return res;
-        }
-
         ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1;
         memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
                                         FS_KEY_DESCRIPTOR_SIZE);
diff --git a/fs/dax.c b/fs/dax.c
index de622d4282a6..85abd741253d 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -373,6 +373,22 @@ restart:
                 }
                 spin_lock_irq(&mapping->tree_lock);
 
+                if (!entry) {
+                        /*
+                         * We needed to drop the page_tree lock while calling
+                         * radix_tree_preload() and we didn't have an entry to
+                         * lock.  See if another thread inserted an entry at
+                         * our index during this time.
+                         */
+                        entry = __radix_tree_lookup(&mapping->page_tree, index,
+                                        NULL, &slot);
+                        if (entry) {
+                                radix_tree_preload_end();
+                                spin_unlock_irq(&mapping->tree_lock);
+                                goto restart;
+                        }
+                }
+
                 if (pmd_downgrade) {
                         radix_tree_delete(&mapping->page_tree, index);
                         mapping->nrexceptional--;
@@ -388,19 +404,12 @@ restart:
                 if (err) {
                         spin_unlock_irq(&mapping->tree_lock);
                         /*
-                         * Someone already created the entry?  This is a
-                         * normal failure when inserting PMDs in a range
-                         * that already contains PTEs.  In that case we want
-                         * to return -EEXIST immediately.
-                         */
-                        if (err == -EEXIST && !(size_flag & RADIX_DAX_PMD))
-                                goto restart;
-                        /*
-                         * Our insertion of a DAX PMD entry failed, most
-                         * likely because it collided with a PTE sized entry
-                         * at a different index in the PMD range.  We haven't
-                         * inserted anything into the radix tree and have no
-                         * waiters to wake.
+                         * Our insertion of a DAX entry failed, most likely
+                         * because we were inserting a PMD entry and it
+                         * collided with a PTE sized entry at a different
+                         * index in the PMD range.  We haven't inserted
+                         * anything into the radix tree and have no waiters to
+                         * wake.
                          */
                         return ERR_PTR(err);
                 }
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index f493af666591..fb69ee2388db 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2466,6 +2466,7 @@ extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern void ext4_evict_inode(struct inode *);
 extern void ext4_clear_inode(struct inode *);
+extern int  ext4_file_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern int  ext4_sync_inode(handle_t *, struct inode *);
 extern void ext4_dirty_inode(struct inode *, int);
 extern int ext4_change_inode_journal_flag(struct inode *, int);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 8210c1f43556..cefa9835f275 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -744,7 +744,7 @@ const struct file_operations ext4_file_operations = {
 
 const struct inode_operations ext4_file_inode_operations = {
         .setattr        = ext4_setattr,
-        .getattr        = ext4_getattr,
+        .getattr        = ext4_file_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 30a9f210d1e3..375fb1c05d49 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1169,10 +1169,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,
         set_buffer_uptodate(dir_block);
         err = ext4_handle_dirty_dirent_node(handle, inode, dir_block);
         if (err)
-                goto out;
+                return err;
         set_buffer_verified(dir_block);
-out:
-        return err;
+        return ext4_mark_inode_dirty(handle, inode);
 }
 
 static int ext4_convert_inline_data_nolock(handle_t *handle,
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7385e6a6b6cb..b9ffa9f4191f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5390,17 +5390,52 @@ err_out:
 int ext4_getattr(const struct path *path, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct inode *inode;
-        unsigned long long delalloc_blocks;
+        struct inode *inode = d_inode(path->dentry);
+        struct ext4_inode *raw_inode;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned int flags;
+
+        if (EXT4_FITS_IN_INODE(raw_inode, ei, i_crtime)) {
+                stat->result_mask |= STATX_BTIME;
+                stat->btime.tv_sec = ei->i_crtime.tv_sec;
+                stat->btime.tv_nsec = ei->i_crtime.tv_nsec;
+        }
+
+        flags = ei->i_flags & EXT4_FL_USER_VISIBLE;
+        if (flags & EXT4_APPEND_FL)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (flags & EXT4_COMPR_FL)
+                stat->attributes |= STATX_ATTR_COMPRESSED;
+        if (flags & EXT4_ENCRYPT_FL)
+                stat->attributes |= STATX_ATTR_ENCRYPTED;
+        if (flags & EXT4_IMMUTABLE_FL)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (flags & EXT4_NODUMP_FL)
+                stat->attributes |= STATX_ATTR_NODUMP;
+
+        stat->attributes_mask |= (STATX_ATTR_APPEND |
+                                  STATX_ATTR_COMPRESSED |
+                                  STATX_ATTR_ENCRYPTED |
+                                  STATX_ATTR_IMMUTABLE |
+                                  STATX_ATTR_NODUMP);
 
-        inode = d_inode(path->dentry);
         generic_fillattr(inode, stat);
+        return 0;
+}
+
+int ext4_file_getattr(const struct path *path, struct kstat *stat,
+                      u32 request_mask, unsigned int query_flags)
+{
+        struct inode *inode = d_inode(path->dentry);
+        u64 delalloc_blocks;
+
+        ext4_getattr(path, stat, request_mask, query_flags);
 
         /*
          * If there is inline data in the inode, the inode will normally not
          * have data blocks allocated (it may have an external xattr block).
          * Report at least one sector for such files, so tools like tar, rsync,
-         * others doen't incorrectly think the file is completely sparse.
+         * others don't incorrectly think the file is completely sparse.
          */
         if (unlikely(ext4_has_inline_data(inode)))
                 stat->blocks += (stat->size + 511) >> 9;
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 578f8c33fb44..c992ef2c2f94 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -511,7 +511,7 @@ mext_check_arguments(struct inode *orig_inode,
         if ((orig_start & ~(PAGE_MASK >> orig_inode->i_blkbits)) !=
             (donor_start & ~(PAGE_MASK >> orig_inode->i_blkbits))) {
                 ext4_debug("ext4 move extent: orig and donor's start "
-                        "offset are not alligned [ino:orig %lu, donor %lu]\n",
+                        "offsets are not aligned [ino:orig %lu, donor %lu]\n",
                         orig_inode->i_ino, donor_inode->i_ino);
                 return -EINVAL;
         }
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6ad612c576fc..07e5e1405771 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3912,6 +3912,7 @@ const struct inode_operations ext4_dir_inode_operations = {
         .tmpfile        = ext4_tmpfile,
         .rename         = ext4_rename2,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
@@ -3920,6 +3921,7 @@ const struct inode_operations ext4_dir_inode_operations = {
 
 const struct inode_operations ext4_special_inode_operations = {
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2e03a0a88d92..a9448db1cf7e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1120,17 +1120,16 @@ static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
                                  EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx, len);
 }
 
-static int ext4_prepare_context(struct inode *inode)
-{
-        return ext4_convert_inline_data(inode);
-}
-
 static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                                                         void *fs_data)
 {
         handle_t *handle = fs_data;
         int res, res2, retries = 0;
 
+        res = ext4_convert_inline_data(inode);
+        if (res)
+                return res;
+
         /*
          * If a journal handle was specified, then the encryption context is
          * being set on a new inode via inheritance and is part of a larger
@@ -1196,7 +1195,6 @@ static unsigned ext4_max_namelen(struct inode *inode)
 static const struct fscrypt_operations ext4_cryptops = {
         .key_prefix             = "ext4:",
         .get_context            = ext4_get_context,
-        .prepare_context        = ext4_prepare_context,
         .set_context            = ext4_set_context,
         .dummy_context          = ext4_dummy_context,
         .is_encrypted           = ext4_encrypted_inode,
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
index 73b184d161fc..5c8fc53cb0e5 100644
--- a/fs/ext4/symlink.c
+++ b/fs/ext4/symlink.c
@@ -85,17 +85,20 @@ errout:
 const struct inode_operations ext4_encrypted_symlink_inode_operations = {
         .get_link       = ext4_encrypted_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_symlink_inode_operations = {
         .get_link       = page_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_fast_symlink_inode_operations = {
         .get_link       = simple_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 67636acf7624..996e7900d4c8 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -131,31 +131,26 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
 }
 
 static int ext4_xattr_block_csum_verify(struct inode *inode,
-                                        sector_t block_nr,
-                                        struct ext4_xattr_header *hdr)
+                                        struct buffer_head *bh)
 {
-        if (ext4_has_metadata_csum(inode->i_sb) &&
-            (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr)))
-                return 0;
-        return 1;
-}
-
-static void ext4_xattr_block_csum_set(struct inode *inode,
-                                      sector_t block_nr,
-                                      struct ext4_xattr_header *hdr)
-{
-        if (!ext4_has_metadata_csum(inode->i_sb))
-                return;
+        struct ext4_xattr_header *hdr = BHDR(bh);
+        int ret = 1;
 
-        hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr);
+        if (ext4_has_metadata_csum(inode->i_sb)) {
+                lock_buffer(bh);
+                ret = (hdr->h_checksum == ext4_xattr_block_csum(inode,
+                                                        bh->b_blocknr, hdr));
+                unlock_buffer(bh);
+        }
+        return ret;
 }
 
-static inline int ext4_handle_dirty_xattr_block(handle_t *handle,
-                                                struct inode *inode,
-                                                struct buffer_head *bh)
+static void ext4_xattr_block_csum_set(struct inode *inode,
+                                      struct buffer_head *bh)
 {
-        ext4_xattr_block_csum_set(inode, bh->b_blocknr, BHDR(bh));
-        return ext4_handle_dirty_metadata(handle, inode, bh);
+        if (ext4_has_metadata_csum(inode->i_sb))
+                BHDR(bh)->h_checksum = ext4_xattr_block_csum(inode,
+                                                bh->b_blocknr, BHDR(bh));
 }
 
 static inline const struct xattr_handler *
@@ -233,7 +228,7 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1))
                 return -EFSCORRUPTED;
-        if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh)))
+        if (!ext4_xattr_block_csum_verify(inode, bh))
                 return -EFSBADCRC;
         error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
                                        bh->b_data);
@@ -618,23 +613,22 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                         }
                 }
 
+                ext4_xattr_block_csum_set(inode, bh);
                 /*
                  * Beware of this ugliness: Releasing of xattr block references
                  * from different inodes can race and so we have to protect
                  * from a race where someone else frees the block (and releases
                  * its journal_head) before we are done dirtying the buffer. In
                  * nojournal mode this race is harmless and we actually cannot
-                 * call ext4_handle_dirty_xattr_block() with locked buffer as
+                 * call ext4_handle_dirty_metadata() with locked buffer as
                  * that function can call sync_dirty_buffer() so for that case
                  * we handle the dirtying after unlocking the buffer.
                  */
                 if (ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 unlock_buffer(bh);
                 if (!ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
                 dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
@@ -863,13 +857,14 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ext4_xattr_cache_insert(ext4_mb_cache,
                                         bs->bh);
                         }
+                        ext4_xattr_block_csum_set(inode, bs->bh);
                         unlock_buffer(bs->bh);
                         if (error == -EFSCORRUPTED)
                                 goto bad_block;
                         if (!error)
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      bs->bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   bs->bh);
                         if (error)
                                 goto cleanup;
                         goto inserted;
@@ -967,10 +962,11 @@ inserted:
                                         ce->e_reusable = 0;
                                 ea_bdebug(new_bh, "reusing; refcount now=%d",
                                           ref);
+                                ext4_xattr_block_csum_set(inode, new_bh);
                                 unlock_buffer(new_bh);
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      new_bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   new_bh);
                                 if (error)
                                         goto cleanup_dquot;
                         }
@@ -1020,11 +1016,12 @@ getblk_failed:
                                 goto getblk_failed;
                         }
                         memcpy(new_bh->b_data, s->base, new_bh->b_size);
+                        ext4_xattr_block_csum_set(inode, new_bh);
                         set_buffer_uptodate(new_bh);
                         unlock_buffer(new_bh);
                         ext4_xattr_cache_insert(ext4_mb_cache, new_bh);
-                        error = ext4_handle_dirty_xattr_block(handle,
-                                                              inode, new_bh);
+                        error = ext4_handle_dirty_metadata(handle, inode,
+                                                           new_bh);
                         if (error)
                                 goto cleanup;
                 }
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index a77df377e2e8..ee2d0a485fc3 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -196,6 +196,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
         si->base_mem += (NM_I(sbi)->nat_bits_blocks << F2FS_BLKSIZE_BITS);
         si->base_mem += NM_I(sbi)->nat_blocks * NAT_ENTRY_BITMAP_SIZE;
         si->base_mem += NM_I(sbi)->nat_blocks / 8;
+        si->base_mem += NM_I(sbi)->nat_blocks * sizeof(unsigned short);
 
 get_cache:
         si->cache_mem = 0;
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 4650c9b85de7..8d5c62b07b28 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -750,7 +750,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
         dentry_blk = page_address(page);
         bit_pos = dentry - dentry_blk->dentry;
         for (i = 0; i < slots; i++)
-                clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
+                __clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
 
         /* Let's check and deallocate this dentry page */
         bit_pos = find_next_bit_le(&dentry_blk->dentry_bitmap,
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index e849f83d6114..0a6e115562f6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -561,6 +561,8 @@ struct f2fs_nm_info {
         struct mutex build_lock;        /* lock for build free nids */
         unsigned char (*free_nid_bitmap)[NAT_ENTRY_BITMAP_SIZE];
         unsigned char *nat_block_bitmap;
+        unsigned short *free_nid_count; /* free nid count of NAT block */
+        spinlock_t free_nid_lock;       /* protect updating of nid count */
 
         /* for checkpoint */
         char *nat_bitmap;               /* NAT bitmap pointer */
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 94967171dee8..481aa8dc79f4 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -338,9 +338,6 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                 set_nat_flag(e, IS_CHECKPOINTED, false);
         __set_nat_cache_dirty(nm_i, e);
 
-        if (enabled_nat_bits(sbi, NULL) && new_blkaddr == NEW_ADDR)
-                clear_bit_le(NAT_BLOCK_OFFSET(ni->nid), nm_i->empty_nat_bits);
-
         /* update fsync_mark if its inode nat entry is still alive */
         if (ni->nid != ni->ino)
                 e = __lookup_nat_cache(nm_i, ni->ino);
@@ -1823,7 +1820,8 @@ static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)
                 kmem_cache_free(free_nid_slab, i);
 }
 
-void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
+static void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid,
+                        bool set, bool build, bool locked)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(nid);
@@ -1833,9 +1831,18 @@ void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
                 return;
 
         if (set)
-                set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
         else
-                clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+
+        if (!locked)
+                spin_lock(&nm_i->free_nid_lock);
+        if (set)
+                nm_i->free_nid_count[nat_ofs]++;
+        else if (!build)
+                nm_i->free_nid_count[nat_ofs]--;
+        if (!locked)
+                spin_unlock(&nm_i->free_nid_lock);
 }
 
 static void scan_nat_page(struct f2fs_sb_info *sbi,
@@ -1847,7 +1854,10 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(start_nid);
         int i;
 
-        set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
+        if (test_bit_le(nat_ofs, nm_i->nat_block_bitmap))
+                return;
+
+        __set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
 
         i = start_nid % NAT_ENTRY_PER_BLOCK;
 
@@ -1861,7 +1871,7 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
                 f2fs_bug_on(sbi, blk_addr == NEW_ADDR);
                 if (blk_addr == NULL_ADDR)
                         freed = add_free_nid(sbi, start_nid, true);
-                update_free_nid_bitmap(sbi, start_nid, freed);
+                update_free_nid_bitmap(sbi, start_nid, freed, true, false);
         }
 }
 
@@ -1877,6 +1887,8 @@ static void scan_free_nid_bits(struct f2fs_sb_info *sbi)
         for (i = 0; i < nm_i->nat_blocks; i++) {
                 if (!test_bit_le(i, nm_i->nat_block_bitmap))
                         continue;
+                if (!nm_i->free_nid_count[i])
+                        continue;
                 for (idx = 0; idx < NAT_ENTRY_PER_BLOCK; idx++) {
                         nid_t nid;
 
@@ -1907,58 +1919,6 @@ out:
         up_read(&nm_i->nat_tree_lock);
 }
 
-static int scan_nat_bits(struct f2fs_sb_info *sbi)
-{
-        struct f2fs_nm_info *nm_i = NM_I(sbi);
-        struct page *page;
-        unsigned int i = 0;
-        nid_t nid;
-
-        if (!enabled_nat_bits(sbi, NULL))
-                return -EAGAIN;
-
-        down_read(&nm_i->nat_tree_lock);
-check_empty:
-        i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                i = 0;
-                goto check_partial;
-        }
-
-        for (nid = i * NAT_ENTRY_PER_BLOCK; nid < (i + 1) * NAT_ENTRY_PER_BLOCK;
-                                                                        nid++) {
-                if (unlikely(nid >= nm_i->max_nid))
-                        break;
-                add_free_nid(sbi, nid, true);
-        }
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] >= MAX_FREE_NIDS)
-                goto out;
-        i++;
-        goto check_empty;
-
-check_partial:
-        i = find_next_zero_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                disable_nat_bits(sbi, true);
-                up_read(&nm_i->nat_tree_lock);
-                return -EINVAL;
-        }
-
-        nid = i * NAT_ENTRY_PER_BLOCK;
-        page = get_current_nat_page(sbi, nid);
-        scan_nat_page(sbi, page, nid);
-        f2fs_put_page(page, 1);
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] < MAX_FREE_NIDS) {
-                i++;
-                goto check_partial;
-        }
-out:
-        up_read(&nm_i->nat_tree_lock);
-        return 0;
-}
-
 static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1980,21 +1940,6 @@ static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 
                 if (nm_i->nid_cnt[FREE_NID_LIST])
                         return;
-
-                /* try to find free nids with nat_bits */
-                if (!scan_nat_bits(sbi) && nm_i->nid_cnt[FREE_NID_LIST])
-                        return;
-        }
-
-        /* find next valid candidate */
-        if (enabled_nat_bits(sbi, NULL)) {
-                int idx = find_next_zero_bit_le(nm_i->full_nat_bits,
-                                        nm_i->nat_blocks, 0);
-
-                if (idx >= nm_i->nat_blocks)
-                        set_sbi_flag(sbi, SBI_NEED_FSCK);
-                else
-                        nid = idx * NAT_ENTRY_PER_BLOCK;
         }
 
         /* readahead nat pages to be scanned */
@@ -2081,7 +2026,7 @@ retry:
                 __insert_nid_to_list(sbi, i, ALLOC_NID_LIST, false);
                 nm_i->available_nids--;
 
-                update_free_nid_bitmap(sbi, *nid, false);
+                update_free_nid_bitmap(sbi, *nid, false, false, false);
 
                 spin_unlock(&nm_i->nid_list_lock);
                 return true;
@@ -2137,7 +2082,7 @@ void alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
 
         nm_i->available_nids++;
 
-        update_free_nid_bitmap(sbi, nid, true);
+        update_free_nid_bitmap(sbi, nid, true, false, false);
 
         spin_unlock(&nm_i->nid_list_lock);
 
@@ -2383,7 +2328,7 @@ add_out:
         list_add_tail(&nes->set_list, head);
 }
 
-void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
+static void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                                                 struct page *page)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -2402,16 +2347,16 @@ void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                         valid++;
         }
         if (valid == 0) {
-                set_bit_le(nat_index, nm_i->empty_nat_bits);
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->empty_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
                 return;
         }
 
-        clear_bit_le(nat_index, nm_i->empty_nat_bits);
+        __clear_bit_le(nat_index, nm_i->empty_nat_bits);
         if (valid == NAT_ENTRY_PER_BLOCK)
-                set_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->full_nat_bits);
         else
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
 }
 
 static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
@@ -2467,11 +2412,11 @@ static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
                         add_free_nid(sbi, nid, false);
                         spin_lock(&NM_I(sbi)->nid_list_lock);
                         NM_I(sbi)->available_nids++;
-                        update_free_nid_bitmap(sbi, nid, true);
+                        update_free_nid_bitmap(sbi, nid, true, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 } else {
                         spin_lock(&NM_I(sbi)->nid_list_lock);
-                        update_free_nid_bitmap(sbi, nid, false);
+                        update_free_nid_bitmap(sbi, nid, false, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 }
         }
@@ -2577,6 +2522,40 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi)
         return 0;
 }
 
+inline void load_free_nid_bitmap(struct f2fs_sb_info *sbi)
+{
+        struct f2fs_nm_info *nm_i = NM_I(sbi);
+        unsigned int i = 0;
+        nid_t nid, last_nid;
+
+        if (!enabled_nat_bits(sbi, NULL))
+                return;
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+
+                nid = i * NAT_ENTRY_PER_BLOCK;
+                last_nid = (i + 1) * NAT_ENTRY_PER_BLOCK;
+
+                spin_lock(&nm_i->free_nid_lock);
+                for (; nid < last_nid; nid++)
+                        update_free_nid_bitmap(sbi, nid, true, true, true);
+                spin_unlock(&nm_i->free_nid_lock);
+        }
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+        }
+}
+
 static int init_node_manager(struct f2fs_sb_info *sbi)
 {
         struct f2fs_super_block *sb_raw = F2FS_RAW_SUPER(sbi);
@@ -2638,7 +2617,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
         return 0;
 }
 
-int init_free_nid_cache(struct f2fs_sb_info *sbi)
+static int init_free_nid_cache(struct f2fs_sb_info *sbi)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
 
@@ -2651,6 +2630,14 @@ int init_free_nid_cache(struct f2fs_sb_info *sbi)
                                                                 GFP_KERNEL);
         if (!nm_i->nat_block_bitmap)
                 return -ENOMEM;
+
+        nm_i->free_nid_count = f2fs_kvzalloc(nm_i->nat_blocks *
+                                        sizeof(unsigned short), GFP_KERNEL);
+        if (!nm_i->free_nid_count)
+                return -ENOMEM;
+
+        spin_lock_init(&nm_i->free_nid_lock);
+
         return 0;
 }
 
@@ -2670,6 +2657,9 @@ int build_node_manager(struct f2fs_sb_info *sbi)
         if (err)
                 return err;
 
+        /* load free nid status from nat_bits table */
+        load_free_nid_bitmap(sbi);
+
         build_free_nids(sbi, true, true);
         return 0;
 }
@@ -2730,6 +2720,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
 
         kvfree(nm_i->nat_block_bitmap);
         kvfree(nm_i->free_nid_bitmap);
+        kvfree(nm_i->free_nid_count);
 
         kfree(nm_i->nat_bitmap);
         kfree(nm_i->nat_bits);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 4bd7a8b19332..29ef7088c558 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1163,6 +1163,12 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
                 if (f2fs_discard_en(sbi) &&
                         !f2fs_test_and_set_bit(offset, se->discard_map))
                         sbi->discard_blks--;
+
+                /* don't overwrite by SSR to keep node chain */
+                if (se->type == CURSEG_WARM_NODE) {
+                        if (!f2fs_test_and_set_bit(offset, se->ckpt_valid_map))
+                                se->ckpt_valid_blocks++;
+                }
         } else {
                 if (!f2fs_test_and_clear_bit(offset, se->cur_valid_map)) {
 #ifdef CONFIG_F2FS_CHECK_FS
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8f96461236f6..dde861387a40 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -136,17 +136,26 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
         vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
         vma->vm_ops = &hugetlb_vm_ops;
 
+        /*
+         * Offset passed to mmap (before page shift) could have been
+         * negative when represented as a (l)off_t.
+         */
+        if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
+                return -EINVAL;
+
         if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
                 return -EINVAL;
 
         vma_len = (loff_t)(vma->vm_end - vma->vm_start);
+        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+        /* check for overflow */
+        if (len < vma_len)
+                return -EINVAL;
 
         inode_lock(inode);
         file_accessed(file);
 
         ret = -ENOMEM;
-        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-
         if (hugetlb_reserve_pages(inode,
                                 vma->vm_pgoff >> huge_page_order(h),
                                 len >> huge_page_shift(h), vma,
@@ -155,7 +164,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 
         ret = 0;
         if (vma->vm_flags & VM_WRITE && inode->i_size < len)
-                inode->i_size = len;
+                i_size_write(inode, len);
 out:
         inode_unlock(inode);
 
@@ -695,14 +704,11 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode->i_mode = S_IFDIR | config->mode;
                 inode->i_uid = config->uid;
                 inode->i_gid = config->gid;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
-                info = HUGETLBFS_I(inode);
-                mpol_shared_policy_init(&info->policy, NULL);
                 inode->i_op = &hugetlbfs_dir_inode_operations;
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
@@ -733,7 +739,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
                 lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
@@ -741,15 +746,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
                 inode->i_mapping->private_data = resv_map;
-                info = HUGETLBFS_I(inode);
-                /*
-                 * The policy is initialized here even if we are creating a
-                 * private inode because initialization simply creates an
-                 * an empty rb tree and calls rwlock_init(), later when we
-                 * call mpol_free_shared_policy() it will just return because
-                 * the rb tree will still be empty.
-                 */
-                mpol_shared_policy_init(&info->policy, NULL);
                 switch (mode & S_IFMT) {
                 default:
                         init_special_inode(inode, mode, dev);
@@ -937,6 +933,18 @@ static struct inode *hugetlbfs_alloc_inode(struct super_block *sb)
                 hugetlbfs_inc_free_inodes(sbinfo);
                 return NULL;
         }
+
+        /*
+         * Any time after allocation, hugetlbfs_destroy_inode can be called
+         * for the inode.  mpol_free_shared_policy is unconditionally called
+         * as part of hugetlbfs_destroy_inode.  So, initialize policy here
+         * in case of a quick call to destroy.
+         *
+         * Note that the policy is initialized even if we are creating a
+         * private inode.  This simplifies hugetlbfs_destroy_inode.
+         */
+        mpol_shared_policy_init(&p->policy, NULL);
+
         return &p->vfs_inode;
 }
 
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index a1a359bfcc9c..5adc2fb62b0f 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1125,10 +1125,8 @@ static journal_t *journal_init_common(struct block_device *bdev,
 
         /* Set up a default-sized revoke table for the new mount. */
         err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
-        if (err) {
-                kfree(journal);
-                return NULL;
-        }
+        if (err)
+                goto err_cleanup;
 
         spin_lock_init(&journal->j_history_lock);
 
@@ -1145,23 +1143,25 @@ static journal_t *journal_init_common(struct block_device *bdev,
         journal->j_wbufsize = n;
         journal->j_wbuf = kmalloc_array(n, sizeof(struct buffer_head *),
                                         GFP_KERNEL);
-        if (!journal->j_wbuf) {
-                kfree(journal);
-                return NULL;
-        }
+        if (!journal->j_wbuf)
+                goto err_cleanup;
 
         bh = getblk_unmovable(journal->j_dev, start, journal->j_blocksize);
         if (!bh) {
                 pr_err("%s: Cannot get buffer for journal superblock\n",
                         __func__);
-                kfree(journal->j_wbuf);
-                kfree(journal);
-                return NULL;
+                goto err_cleanup;
         }
         journal->j_sb_buffer = bh;
         journal->j_superblock = (journal_superblock_t *)bh->b_data;
 
         return journal;
+
+err_cleanup:
+        kfree(journal->j_wbuf);
+        jbd2_journal_destroy_revoke(journal);
+        kfree(journal);
+        return NULL;
 }
 
 /* jbd2_journal_init_dev and jbd2_journal_init_inode:
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index cfc38b552118..f9aefcda5854 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -280,6 +280,7 @@ int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
 
 fail1:
         jbd2_journal_destroy_revoke_table(journal->j_revoke_table[0]);
+        journal->j_revoke_table[0] = NULL;
 fail0:
         return -ENOMEM;
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8e4dc7ab584c..ac2dfe0c5a9c 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -809,7 +809,8 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
                 if (kn->flags & KERNFS_HAS_MMAP)
                         unmap_mapping_range(inode->i_mapping, 0, 0, 1);
 
-                kernfs_release_file(kn, of);
+                if (kn->flags & KERNFS_HAS_RELEASE)
+                        kernfs_release_file(kn, of);
         }
 
         mutex_unlock(&kernfs_open_file_mutex);
diff --git a/fs/namei.c b/fs/namei.c
index d41fab78798b..19dcf62133cc 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2145,6 +2145,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
         int retval = 0;
         const char *s = nd->name->name;
 
+        if (!*s)
+                flags &= ~LOOKUP_RCU;
+
         nd->last_type = LAST_ROOT; /* if there are only slashes... */
         nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
         nd->depth = 0;
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index fb499a3f21b5..f92ba8d6c556 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2055,7 +2055,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = d_inode(old_dentry);
         struct inode *new_inode = d_inode(new_dentry);
-        struct dentry *dentry = NULL, *rehash = NULL;
+        struct dentry *dentry = NULL;
         struct rpc_task *task;
         int error = -EBUSY;
 
@@ -2078,10 +2078,8 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                  * To prevent any new references to the target during the
                  * rename, we unhash the dentry in advance.
                  */
-                if (!d_unhashed(new_dentry)) {
+                if (!d_unhashed(new_dentry))
                         d_drop(new_dentry);
-                        rehash = new_dentry;
-                }
 
                 if (d_count(new_dentry) > 2) {
                         int err;
@@ -2098,7 +2096,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
-                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
@@ -2119,8 +2116,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 error = task->tk_status;
         rpc_put_task(task);
 out:
-        if (rehash)
-                d_rehash(rehash);
         trace_nfs_rename_exit(old_dir, old_dentry,
                         new_dir, new_dentry, error);
         /* new dentry created? */
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44347f4bdc15..acd30baca461 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -202,10 +202,10 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                         task->tk_status);
                 nfs4_mark_deviceid_unavailable(devid);
                 pnfs_error_mark_layout_for_return(inode, lseg);
-                pnfs_set_lo_fail(lseg);
                 rpc_wake_up(&tbl->slot_tbl_waitq);
                 /* fall through */
         default:
+                pnfs_set_lo_fail(lseg);
 reset:
                 dprintk("%s Retry through MDS. Error %d\n", __func__,
                         task->tk_status);
@@ -560,6 +560,50 @@ filelayout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         return PNFS_ATTEMPTED;
 }
 
+static int
+filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
+                          struct nfs4_filelayout_segment *fl,
+                          gfp_t gfp_flags)
+{
+        struct nfs4_deviceid_node *d;
+        struct nfs4_file_layout_dsaddr *dsaddr;
+        int status = -EINVAL;
+
+        /* find and reference the deviceid */
+        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), &fl->deviceid,
+                        lo->plh_lc_cred, gfp_flags);
+        if (d == NULL)
+                goto out;
+
+        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
+        /* Found deviceid is unavailable */
+        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
+                goto out_put;
+
+        fl->dsaddr = dsaddr;
+
+        if (fl->first_stripe_index >= dsaddr->stripe_count) {
+                dprintk("%s Bad first_stripe_index %u\n",
+                                __func__, fl->first_stripe_index);
+                goto out_put;
+        }
+
+        if ((fl->stripe_type == STRIPE_SPARSE &&
+            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
+            (fl->stripe_type == STRIPE_DENSE &&
+            fl->num_fh != dsaddr->stripe_count)) {
+                dprintk("%s num_fh %u not valid for given packing\n",
+                        __func__, fl->num_fh);
+                goto out_put;
+        }
+        status = 0;
+out:
+        return status;
+out_put:
+        nfs4_fl_put_deviceid(dsaddr);
+        goto out;
+}
+
 /*
  * filelayout_check_layout()
  *
@@ -572,11 +616,8 @@ static int
 filelayout_check_layout(struct pnfs_layout_hdr *lo,
                         struct nfs4_filelayout_segment *fl,
                         struct nfs4_layoutget_res *lgr,
-                        struct nfs4_deviceid *id,
                         gfp_t gfp_flags)
 {
-        struct nfs4_deviceid_node *d;
-        struct nfs4_file_layout_dsaddr *dsaddr;
         int status = -EINVAL;
 
         dprintk("--> %s\n", __func__);
@@ -601,41 +642,10 @@ filelayout_check_layout(struct pnfs_layout_hdr *lo,
                 goto out;
         }
 
-        /* find and reference the deviceid */
-        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), id,
-                        lo->plh_lc_cred, gfp_flags);
-        if (d == NULL)
-                goto out;
-
-        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
-        /* Found deviceid is unavailable */
-        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
-                goto out_put;
-
-        fl->dsaddr = dsaddr;
-
-        if (fl->first_stripe_index >= dsaddr->stripe_count) {
-                dprintk("%s Bad first_stripe_index %u\n",
-                                __func__, fl->first_stripe_index);
-                goto out_put;
-        }
-
-        if ((fl->stripe_type == STRIPE_SPARSE &&
-            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
-            (fl->stripe_type == STRIPE_DENSE &&
-            fl->num_fh != dsaddr->stripe_count)) {
-                dprintk("%s num_fh %u not valid for given packing\n",
-                        __func__, fl->num_fh);
-                goto out_put;
-        }
-
         status = 0;
 out:
         dprintk("--> %s returns %d\n", __func__, status);
         return status;
-out_put:
-        nfs4_fl_put_deviceid(dsaddr);
-        goto out;
 }
 
 static void _filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
@@ -657,7 +667,6 @@ static int
 filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                          struct nfs4_filelayout_segment *fl,
                          struct nfs4_layoutget_res *lgr,
-                         struct nfs4_deviceid *id,
                          gfp_t gfp_flags)
 {
         struct xdr_stream stream;
@@ -682,9 +691,9 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
         if (unlikely(!p))
                 goto out_err;
 
-        memcpy(id, p, sizeof(*id));
+        memcpy(&fl->deviceid, p, sizeof(fl->deviceid));
         p += XDR_QUADLEN(NFS4_DEVICEID4_SIZE);
-        nfs4_print_deviceid(id);
+        nfs4_print_deviceid(&fl->deviceid);
 
         nfl_util = be32_to_cpup(p++);
         if (nfl_util & NFL4_UFLG_COMMIT_THRU_MDS)
@@ -831,15 +840,14 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
 {
         struct nfs4_filelayout_segment *fl;
         int rc;
-        struct nfs4_deviceid id;
 
         dprintk("--> %s\n", __func__);
         fl = kzalloc(sizeof(*fl), gfp_flags);
         if (!fl)
                 return NULL;
 
-        rc = filelayout_decode_layout(layoutid, fl, lgr, &id, gfp_flags);
-        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, &id, gfp_flags)) {
+        rc = filelayout_decode_layout(layoutid, fl, lgr, gfp_flags);
+        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, gfp_flags)) {
                 _filelayout_free_lseg(fl);
                 return NULL;
         }
@@ -888,18 +896,51 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
         return min(stripe_unit - (unsigned int)stripe_offset, size);
 }
 
+static struct pnfs_layout_segment *
+fl_pnfs_update_layout(struct inode *ino,
+                      struct nfs_open_context *ctx,
+                      loff_t pos,
+                      u64 count,
+                      enum pnfs_iomode iomode,
+                      bool strict_iomode,
+                      gfp_t gfp_flags)
+{
+        struct pnfs_layout_segment *lseg = NULL;
+        struct pnfs_layout_hdr *lo;
+        struct nfs4_filelayout_segment *fl;
+        int status;
+
+        lseg = pnfs_update_layout(ino, ctx, pos, count, iomode, strict_iomode,
+                                  gfp_flags);
+        if (!lseg)
+                lseg = ERR_PTR(-ENOMEM);
+        if (IS_ERR(lseg))
+                goto out;
+
+        lo = NFS_I(ino)->layout;
+        fl = FILELAYOUT_LSEG(lseg);
+
+        status = filelayout_check_deviceid(lo, fl, gfp_flags);
+        if (status)
+                lseg = ERR_PTR(status);
+out:
+        if (IS_ERR(lseg))
+                pnfs_put_lseg(lseg);
+        return lseg;
+}
+
 static void
 filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio,
                         struct nfs_page *req)
 {
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_READ,
-                                           false,
-                                           GFP_KERNEL);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_READ,
+                                                      false,
+                                                      GFP_KERNEL);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
@@ -919,13 +960,13 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         int status;
 
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_RW,
-                                           false,
-                                           GFP_NOFS);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_RW,
+                                                      false,
+                                                      GFP_NOFS);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
diff --git a/fs/nfs/filelayout/filelayout.h b/fs/nfs/filelayout/filelayout.h
index 2896cb833a11..79323b5dab0c 100644
--- a/fs/nfs/filelayout/filelayout.h
+++ b/fs/nfs/filelayout/filelayout.h
@@ -55,15 +55,16 @@ struct nfs4_file_layout_dsaddr {
 };
 
 struct nfs4_filelayout_segment {
-        struct pnfs_layout_segment generic_hdr;
-        u32 stripe_type;
-        u32 commit_through_mds;
-        u32 stripe_unit;
-        u32 first_stripe_index;
-        u64 pattern_offset;
-        struct nfs4_file_layout_dsaddr *dsaddr; /* Point to GETDEVINFO data */
-        unsigned int num_fh;
-        struct nfs_fh **fh_array;
+        struct pnfs_layout_segment      generic_hdr;
+        u32                             stripe_type;
+        u32                             commit_through_mds;
+        u32                             stripe_unit;
+        u32                             first_stripe_index;
+        u64                             pattern_offset;
+        struct nfs4_deviceid            deviceid;
+        struct nfs4_file_layout_dsaddr  *dsaddr; /* Point to GETDEVINFO data */
+        unsigned int                    num_fh;
+        struct nfs_fh                   **fh_array;
 };
 
 struct nfs4_filelayout {
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 85fde93dff77..457cfeb1d5c1 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -208,6 +208,10 @@ static bool ff_layout_mirror_valid(struct pnfs_layout_segment *lseg,
                 } else
                         goto outerr;
         }
+
+        if (IS_ERR(mirror->mirror_ds))
+                goto outerr;
+
         if (mirror->mirror_ds->ds == NULL) {
                 struct nfs4_deviceid_node *devid;
                 devid = &mirror->mirror_ds->id_node;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c780d98035cc..201ca3f2c4ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2442,17 +2442,14 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
         }
 
         nfs4_stateid_copy(&stateid, &delegation->stateid);
-        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
+                !test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+                        &delegation->flags)) {
                 rcu_read_unlock();
                 nfs_finish_clear_delegation_stateid(state, &stateid);
                 return;
         }
 
-        if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags)) {
-                rcu_read_unlock();
-                return;
-        }
-
         cred = get_rpccred(delegation->cred);
         rcu_read_unlock();
         status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index cbeeda1e94a2..d86031b6ad79 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2489,7 +2489,7 @@ bool nfsd4_spo_must_allow(struct svc_rqst *rqstp)
 
 int nfsd4_max_reply(struct svc_rqst *rqstp, struct nfsd4_op *op)
 {
-        if (op->opnum == OP_ILLEGAL)
+        if (op->opnum == OP_ILLEGAL || op->status == nfserr_notsupp)
                 return op_encode_hdr_size * sizeof(__be32);
 
         BUG_ON(OPDESC(op)->op_rsize_bop == NULL);
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 73e75ac90525..8bf8f667a8cf 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -538,13 +538,21 @@ out_free:
 
 static ssize_t
 nfsd_print_version_support(char *buf, int remaining, const char *sep,
-                unsigned vers, unsigned minor)
+                unsigned vers, int minor)
 {
-        const char *format = (minor == 0) ? "%s%c%u" : "%s%c%u.%u";
+        const char *format = minor < 0 ? "%s%c%u" : "%s%c%u.%u";
         bool supported = !!nfsd_vers(vers, NFSD_TEST);
 
-        if (vers == 4 && !nfsd_minorversion(minor, NFSD_TEST))
+        if (vers == 4 && minor >= 0 &&
+            !nfsd_minorversion(minor, NFSD_TEST))
                 supported = false;
+        if (minor == 0 && supported)
+                /*
+                 * special case for backward compatability.
+                 * +4.0 is never reported, it is implied by
+                 * +4, unless -4.0 is present.
+                 */
+                return 0;
         return snprintf(buf, remaining, format, sep,
                         supported ? '+' : '-', vers, minor);
 }
@@ -554,7 +562,6 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         char *mesg = buf;
         char *vers, *minorp, sign;
         int len, num, remaining;
-        unsigned minor;
         ssize_t tlen = 0;
         char *sep;
         struct nfsd_net *nn = net_generic(netns(file), nfsd_net_id);
@@ -575,6 +582,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                 if (len <= 0) return -EINVAL;
                 do {
                         enum vers_op cmd;
+                        unsigned minor;
                         sign = *vers;
                         if (sign == '+' || sign == '-')
                                 num = simple_strtol((vers+1), &minorp, 0);
@@ -585,8 +593,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                         return -EINVAL;
                                 if (kstrtouint(minorp+1, 0, &minor) < 0)
                                         return -EINVAL;
-                        } else
-                                minor = 0;
+                        }
+
                         cmd = sign == '-' ? NFSD_CLEAR : NFSD_SET;
                         switch(num) {
                         case 2:
@@ -594,8 +602,20 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                 nfsd_vers(num, cmd);
                                 break;
                         case 4:
-                                if (nfsd_minorversion(minor, cmd) >= 0)
-                                        break;
+                                if (*minorp == '.') {
+                                        if (nfsd_minorversion(minor, cmd) < 0)
+                                                return -EINVAL;
+                                } else if ((cmd == NFSD_SET) != nfsd_vers(num, NFSD_TEST)) {
+                                        /*
+                                         * Either we have +4 and no minors are enabled,
+                                         * or we have -4 and at least one minor is enabled.
+                                         * In either case, propagate 'cmd' to all minors.
+                                         */
+                                        minor = 0;
+                                        while (nfsd_minorversion(minor, cmd) >= 0)
+                                                minor++;
+                                }
+                                break;
                         default:
                                 return -EINVAL;
                         }
@@ -612,9 +632,11 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         sep = "";
         remaining = SIMPLE_TRANSACTION_LIMIT;
         for (num=2 ; num <= 4 ; num++) {
+                int minor;
                 if (!nfsd_vers(num, NFSD_AVAIL))
                         continue;
-                minor = 0;
+
+                minor = -1;
                 do {
                         len = nfsd_print_version_support(buf, remaining,
                                         sep, num, minor);
@@ -624,7 +646,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                         buf += len;
                         tlen += len;
                         minor++;
-                        sep = " ";
+                        if (len)
+                                sep = " ";
                 } while (num == 4 && minor <= NFSD_SUPPORTED_MINOR_VERSION);
         }
 out:
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index fa82b7707e85..03a7e9da4da0 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -786,6 +786,7 @@ nfserrno (int errno)
                 { nfserr_serverfault, -ESERVERFAULT },
                 { nfserr_serverfault, -ENFILE },
                 { nfserr_io, -EUCLEAN },
+                { nfserr_perm, -ENOKEY },
         };
         int     i;
 
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 786a4a2cb2d7..31e1f9593457 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -167,7 +167,8 @@ nfsd_adjust_nfsd_versions4(void)
 
 int nfsd_minorversion(u32 minorversion, enum vers_op change)
 {
-        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION)
+        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION &&
+            change != NFSD_AVAIL)
                 return -1;
         switch(change) {
         case NFSD_SET:
@@ -415,23 +416,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 
 void nfsd_reset_versions(void)
 {
-        int found_one = 0;
         int i;
 
-        for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) {
-                if (nfsd_program.pg_vers[i])
-                        found_one = 1;
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (nfsd_vers(i, NFSD_TEST))
+                        return;
 
-        if (!found_one) {
-                for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++)
-                        nfsd_program.pg_vers[i] = nfsd_version[i];
-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
-                for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++)
-                        nfsd_acl_program.pg_vers[i] =
-                                nfsd_acl_version[i];
-#endif
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (i != 4)
+                        nfsd_vers(i, NFSD_SET);
+                else {
+                        int minor = 0;
+                        while (nfsd_minorversion(minor, NFSD_SET) >= 0)
+                                minor++;
+                }
 }
 
 /*
diff --git a/fs/nsfs.c b/fs/nsfs.c
index 1656843e87d2..323f492e0822 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -91,6 +91,7 @@ slow:
                 return ERR_PTR(-ENOMEM);
         }
         d_instantiate(dentry, inode);
+        dentry->d_flags |= DCACHE_RCUACCESS;
         dentry->d_fsdata = (void *)ns->ops;
         d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
         if (d) {
diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
index c4ab6fdf17a0..e1534c9bab16 100644
--- a/fs/orangefs/devorangefs-req.c
+++ b/fs/orangefs/devorangefs-req.c
@@ -208,14 +208,19 @@ restart:
                                 continue;
                         /*
                          * Skip ops whose filesystem we don't know about unless
-                         * it is being mounted.
+                         * it is being mounted or unmounted.  It is possible for
+                         * a filesystem we don't know about to be unmounted if
+                         * it fails to mount in the kernel after userspace has
+                         * been sent the mount request.
                          */
                         /* XXX: is there a better way to detect this? */
                         } else if (ret == -1 &&
                                    !(op->upcall.type ==
                                         ORANGEFS_VFS_OP_FS_MOUNT ||
                                      op->upcall.type ==
-                                        ORANGEFS_VFS_OP_GETATTR)) {
+                                        ORANGEFS_VFS_OP_GETATTR ||
+                                     op->upcall.type ==
+                                        ORANGEFS_VFS_OP_FS_UMOUNT)) {
                                 gossip_debug(GOSSIP_DEV_DEBUG,
                                     "orangefs: skipping op tag %llu %s\n",
                                     llu(op->tag), get_opname_string(op));
diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
index 5e48a0be9761..8afac46fcc87 100644
--- a/fs/orangefs/orangefs-kernel.h
+++ b/fs/orangefs/orangefs-kernel.h
@@ -249,6 +249,7 @@ struct orangefs_sb_info_s {
         char devname[ORANGEFS_MAX_SERVER_ADDR_LEN];
         struct super_block *sb;
         int mount_pending;
+        int no_list;
         struct list_head list;
 };
 
diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 67c24351a67f..629d8c917fa6 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -263,8 +263,13 @@ int orangefs_remount(struct orangefs_sb_info_s *orangefs_sb)
                 if (!new_op)
                         return -ENOMEM;
                 new_op->upcall.req.features.features = 0;
-                ret = service_operation(new_op, "orangefs_features", 0);
-                orangefs_features = new_op->downcall.resp.features.features;
+                ret = service_operation(new_op, "orangefs_features",
+                    ORANGEFS_OP_PRIORITY | ORANGEFS_OP_NO_MUTEX);
+                if (!ret)
+                        orangefs_features =
+                            new_op->downcall.resp.features.features;
+                else
+                        orangefs_features = 0;
                 op_release(new_op);
         } else {
                 orangefs_features = 0;
@@ -488,7 +493,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
 
         if (ret) {
                 d = ERR_PTR(ret);
-                goto free_op;
+                goto free_sb_and_op;
         }
 
         /*
@@ -514,6 +519,9 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
         spin_unlock(&orangefs_superblocks_lock);
         op_release(new_op);
 
+        /* Must be removed from the list now. */
+        ORANGEFS_SB(sb)->no_list = 0;
+
         if (orangefs_userspace_version >= 20906) {
                 new_op = op_alloc(ORANGEFS_VFS_OP_FEATURES);
                 if (!new_op)
@@ -528,6 +536,10 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
 
         return dget(sb->s_root);
 
+free_sb_and_op:
+        /* Will call orangefs_kill_sb with sb not in list. */
+        ORANGEFS_SB(sb)->no_list = 1;
+        deactivate_locked_super(sb);
 free_op:
         gossip_err("orangefs_mount: mount request failed with %d\n", ret);
         if (ret == -EINVAL) {
@@ -553,12 +565,14 @@ void orangefs_kill_sb(struct super_block *sb)
          */
          orangefs_unmount_sb(sb);
 
-        /* remove the sb from our list of orangefs specific sb's */
-
-        spin_lock(&orangefs_superblocks_lock);
-        __list_del_entry(&ORANGEFS_SB(sb)->list);       /* not list_del_init */
-        ORANGEFS_SB(sb)->list.prev = NULL;
-        spin_unlock(&orangefs_superblocks_lock);
+        if (!ORANGEFS_SB(sb)->no_list) {
+                /* remove the sb from our list of orangefs specific sb's */
+                spin_lock(&orangefs_superblocks_lock);
+                /* not list_del_init */
+                __list_del_entry(&ORANGEFS_SB(sb)->list);
+                ORANGEFS_SB(sb)->list.prev = NULL;
+                spin_unlock(&orangefs_superblocks_lock);
+        }
 
         /*
          * make sure that ORANGEFS_DEV_REMOUNT_ALL loop that might've seen us
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 8f91ec66baa3..d04ea4349909 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1074,6 +1074,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table)
 
                 if ((table->proc_handler == proc_dostring) ||
                     (table->proc_handler == proc_dointvec) ||
+                    (table->proc_handler == proc_douintvec) ||
                     (table->proc_handler == proc_dointvec_minmax) ||
                     (table->proc_handler == proc_dointvec_jiffies) ||
                     (table->proc_handler == proc_dointvec_userhz_jiffies) ||
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f08bd31c1081..312578089544 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -900,7 +900,14 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
 static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma,
                 unsigned long addr, pmd_t *pmdp)
 {
-        pmd_t pmd = pmdp_huge_get_and_clear(vma->vm_mm, addr, pmdp);
+        pmd_t pmd = *pmdp;
+
+        /* See comment in change_huge_pmd() */
+        pmdp_invalidate(vma, addr, pmdp);
+        if (pmd_dirty(*pmdp))
+                pmd = pmd_mkdirty(pmd);
+        if (pmd_young(*pmdp))
+                pmd = pmd_mkyoung(pmd);
 
         pmd = pmd_wrprotect(pmd);
         pmd = pmd_clear_soft_dirty(pmd);
diff --git a/fs/stat.c b/fs/stat.c
index fa0be59340cc..c6c963b2546b 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -130,9 +130,13 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_statx_fd(unsigned int fd, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct fd f = fdget_raw(fd);
+        struct fd f;
         int error = -EBADF;
 
+        if (query_flags & ~KSTAT_QUERY_FLAGS)
+                return -EINVAL;
+
+        f = fdget_raw(fd);
         if (f.file) {
                 error = vfs_getattr(&f.file->f_path, stat,
                                     request_mask, query_flags);
@@ -155,9 +159,6 @@ EXPORT_SYMBOL(vfs_statx_fd);
  * Additionally, the use of AT_SYMLINK_NOFOLLOW in flags will prevent a symlink
  * at the given name from being referenced.
  *
- * The caller must have preset stat->request_mask as for vfs_getattr().  The
- * flags are also used to load up stat->query_flags.
- *
  * 0 will be returned on success, and a -ve error code if unsuccessful.
  */
 int vfs_statx(int dfd, const char __user *filename, int flags,
@@ -509,46 +510,38 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, const char __user *, filename,
 }
 #endif /* __ARCH_WANT_STAT64 || __ARCH_WANT_COMPAT_STAT64 */
 
-static inline int __put_timestamp(struct timespec *kts,
-                                  struct statx_timestamp __user *uts)
-{
-        return (__put_user(kts->tv_sec,         &uts->tv_sec            ) ||
-                __put_user(kts->tv_nsec,        &uts->tv_nsec           ) ||
-                __put_user(0,                   &uts->__reserved        ));
-}
-
-/*
- * Set the statx results.
- */
-static long statx_set_result(struct kstat *stat, struct statx __user *buffer)
+static noinline_for_stack int
+cp_statx(const struct kstat *stat, struct statx __user *buffer)
 {
-        uid_t uid = from_kuid_munged(current_user_ns(), stat->uid);
-        gid_t gid = from_kgid_munged(current_user_ns(), stat->gid);
-
-        if (__put_user(stat->result_mask,       &buffer->stx_mask       ) ||
-            __put_user(stat->mode,              &buffer->stx_mode       ) ||
-            __clear_user(&buffer->__spare0, sizeof(buffer->__spare0))     ||
-            __put_user(stat->nlink,             &buffer->stx_nlink      ) ||
-            __put_user(uid,                     &buffer->stx_uid        ) ||
-            __put_user(gid,                     &buffer->stx_gid        ) ||
-            __put_user(stat->attributes,        &buffer->stx_attributes ) ||
-            __put_user(stat->blksize,           &buffer->stx_blksize    ) ||
-            __put_user(MAJOR(stat->rdev),       &buffer->stx_rdev_major ) ||
-            __put_user(MINOR(stat->rdev),       &buffer->stx_rdev_minor ) ||
-            __put_user(MAJOR(stat->dev),        &buffer->stx_dev_major  ) ||
-            __put_user(MINOR(stat->dev),        &buffer->stx_dev_minor  ) ||
-            __put_timestamp(&stat->atime,       &buffer->stx_atime      ) ||
-            __put_timestamp(&stat->btime,       &buffer->stx_btime      ) ||
-            __put_timestamp(&stat->ctime,       &buffer->stx_ctime      ) ||
-            __put_timestamp(&stat->mtime,       &buffer->stx_mtime      ) ||
-            __put_user(stat->ino,               &buffer->stx_ino        ) ||
-            __put_user(stat->size,              &buffer->stx_size       ) ||
-            __put_user(stat->blocks,            &buffer->stx_blocks     ) ||
-            __clear_user(&buffer->__spare1, sizeof(buffer->__spare1))     ||
-            __clear_user(&buffer->__spare2, sizeof(buffer->__spare2)))
-                return -EFAULT;
-
-        return 0;
+        struct statx tmp;
+
+        memset(&tmp, 0, sizeof(tmp));
+
+        tmp.stx_mask = stat->result_mask;
+        tmp.stx_blksize = stat->blksize;
+        tmp.stx_attributes = stat->attributes;
+        tmp.stx_nlink = stat->nlink;
+        tmp.stx_uid = from_kuid_munged(current_user_ns(), stat->uid);
+        tmp.stx_gid = from_kgid_munged(current_user_ns(), stat->gid);
+        tmp.stx_mode = stat->mode;
+        tmp.stx_ino = stat->ino;
+        tmp.stx_size = stat->size;
+        tmp.stx_blocks = stat->blocks;
+        tmp.stx_attributes_mask = stat->attributes_mask;
+        tmp.stx_atime.tv_sec = stat->atime.tv_sec;
+        tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
+        tmp.stx_btime.tv_sec = stat->btime.tv_sec;
+        tmp.stx_btime.tv_nsec = stat->btime.tv_nsec;
+        tmp.stx_ctime.tv_sec = stat->ctime.tv_sec;
+        tmp.stx_ctime.tv_nsec = stat->ctime.tv_nsec;
+        tmp.stx_mtime.tv_sec = stat->mtime.tv_sec;
+        tmp.stx_mtime.tv_nsec = stat->mtime.tv_nsec;
+        tmp.stx_rdev_major = MAJOR(stat->rdev);
+        tmp.stx_rdev_minor = MINOR(stat->rdev);
+        tmp.stx_dev_major = MAJOR(stat->dev);
+        tmp.stx_dev_minor = MINOR(stat->dev);
+
+        return copy_to_user(buffer, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
 /**
@@ -570,10 +563,10 @@ SYSCALL_DEFINE5(statx,
         struct kstat stat;
         int error;
 
+        if (mask & STATX__RESERVED)
+                return -EINVAL;
         if ((flags & AT_STATX_SYNC_TYPE) == AT_STATX_SYNC_TYPE)
                 return -EINVAL;
-        if (!access_ok(VERIFY_WRITE, buffer, sizeof(*buffer)))
-                return -EFAULT;
 
         if (filename)
                 error = vfs_statx(dfd, filename, flags, &stat, mask);
@@ -581,7 +574,8 @@ SYSCALL_DEFINE5(statx,
                 error = vfs_statx_fd(dfd, &stat, mask, flags);
         if (error)
                 return error;
-        return statx_set_result(&stat, buffer);
+
+        return cp_statx(&stat, buffer);
 }
 
 /* Caller is here responsible for sufficient locking (ie. inode->i_lock) */
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b803213d1307..39c75a86c67f 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -108,7 +108,7 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
 {
         const struct sysfs_ops *ops = sysfs_file_ops(of->kn);
         struct kobject *kobj = of->kn->parent->priv;
-        size_t len;
+        ssize_t len;
 
         /*
          * If buf != of->prealloc_buf, we don't know how
@@ -117,13 +117,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
         if (WARN_ON_ONCE(buf != of->prealloc_buf))
                 return 0;
         len = ops->show(kobj, of->kn->priv, buf);
+        if (len < 0)
+                return len;
         if (pos) {
                 if (len <= pos)
                         return 0;
                 len -= pos;
                 memmove(buf, buf + pos, len);
         }
-        return min(count, len);
+        return min_t(ssize_t, count, len);
 }
 
 /* kernfs write callback for regular sysfs files */
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 1e712a364680..718b749fa11a 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -32,6 +32,7 @@
 #include <linux/math64.h>
 #include <linux/uaccess.h>
 #include <linux/random.h>
+#include <linux/ctype.h>
 #include "ubifs.h"
 
 static DEFINE_SPINLOCK(dbg_lock);
@@ -286,8 +287,10 @@ void ubifs_dump_inode(struct ubifs_info *c, const struct inode *inode)
                         break;
                 }
 
-                pr_err("\t%d: %s (%s)\n",
-                       count++, dent->name, get_dent_type(dent->type));
+                pr_err("\t%d: inode %llu, type %s, len %d\n",
+                       count++, (unsigned long long) le64_to_cpu(dent->inum),
+                       get_dent_type(dent->type),
+                       le16_to_cpu(dent->nlen));
 
                 fname_name(&nm) = dent->name;
                 fname_len(&nm) = le16_to_cpu(dent->nlen);
@@ -464,7 +467,8 @@ void ubifs_dump_node(const struct ubifs_info *c, const void *node)
                         pr_err("(bad name length, not printing, bad or corrupted node)");
                 else {
                         for (i = 0; i < nlen && dent->name[i]; i++)
-                                pr_cont("%c", dent->name[i]);
+                                pr_cont("%c", isprint(dent->name[i]) ?
+                                        dent->name[i] : '?');
                 }
                 pr_cont("\n");
 
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 30825d882aa9..b777bddaa1dd 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -606,8 +606,8 @@ static int ubifs_readdir(struct file *file, struct dir_context *ctx)
         }
 
         while (1) {
-                dbg_gen("feed '%s', ino %llu, new f_pos %#x",
-                        dent->name, (unsigned long long)le64_to_cpu(dent->inum),
+                dbg_gen("ino %llu, new f_pos %#x",
+                        (unsigned long long)le64_to_cpu(dent->inum),
                         key_hash_flash(c, &dent->key));
                 ubifs_assert(le64_to_cpu(dent->ch.sqnum) >
                              ubifs_inode(dir)->creat_sqnum);
@@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
                 goto out_fname;
 
         lock_2_inodes(dir, inode);
+
+        /* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
+        if (inode->i_nlink == 0)
+                ubifs_delete_orphan(c, inode->i_ino);
+
         inc_nlink(inode);
         ihold(inode);
         inode->i_ctime = ubifs_current_time(inode);
@@ -768,6 +773,8 @@ out_cancel:
         dir->i_size -= sz_change;
         dir_ui->ui_size = dir->i_size;
         drop_nlink(inode);
+        if (inode->i_nlink == 0)
+                ubifs_add_orphan(c, inode->i_ino);
         unlock_2_inodes(dir, inode);
         ubifs_release_budget(c, &req);
         iput(inode);
@@ -1068,8 +1075,10 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry,
         }
 
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
-        if (err)
+        if (err) {
+                kfree(dev);
                 goto out_budg;
+        }
 
         sz_change = CALC_DENT_SIZE(fname_len(&nm));
 
@@ -1316,9 +1325,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
         unsigned int uninitialized_var(saved_nlink);
         struct fscrypt_name old_nm, new_nm;
 
-        if (flags & ~RENAME_NOREPLACE)
-                return -EINVAL;
-
         /*
          * Budget request settings: deletion direntry, new direntry, removing
          * the old inode, and changing old and new parent directory inodes.
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 1d227b0fcf49..f7555fc25877 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1756,7 +1756,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
          *      protocols: aa:... bb:...
          */
         seq_printf(m, "pending:\t%lu\ntotal:\t%lu\nAPI:\t%Lx:%x:%Lx\n",
-                   pending, total, UFFD_API, UFFD_API_FEATURES,
+                   pending, total, UFFD_API, ctx->features,
                    UFFD_API_IOCTLS|UFFD_API_RANGE_IOCTLS);
 }
 #endif
diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h
index eb00bc133bca..39f8604f764e 100644
--- a/fs/xfs/libxfs/xfs_dir2_priv.h
+++ b/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -125,8 +125,7 @@ extern int xfs_dir2_sf_create(struct xfs_da_args *args, xfs_ino_t pino);
 extern int xfs_dir2_sf_lookup(struct xfs_da_args *args);
 extern int xfs_dir2_sf_removename(struct xfs_da_args *args);
 extern int xfs_dir2_sf_replace(struct xfs_da_args *args);
-extern int xfs_dir2_sf_verify(struct xfs_mount *mp, struct xfs_dir2_sf_hdr *sfp,
-                int size);
+extern int xfs_dir2_sf_verify(struct xfs_inode *ip);
 
 /* xfs_dir2_readdir.c */
 extern int xfs_readdir(struct xfs_inode *dp, struct dir_context *ctx,
diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index 96b45cd6c63f..e84af093b2ab 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -632,36 +632,49 @@ xfs_dir2_sf_check(
 /* Verify the consistency of an inline directory. */
 int
 xfs_dir2_sf_verify(
-        struct xfs_mount                *mp,
-        struct xfs_dir2_sf_hdr          *sfp,
-        int                             size)
+        struct xfs_inode                *ip)
 {
+        struct xfs_mount                *mp = ip->i_mount;
+        struct xfs_dir2_sf_hdr          *sfp;
         struct xfs_dir2_sf_entry        *sfep;
         struct xfs_dir2_sf_entry        *next_sfep;
         char                            *endp;
         const struct xfs_dir_ops        *dops;
+        struct xfs_ifork                *ifp;
         xfs_ino_t                       ino;
         int                             i;
         int                             i8count;
         int                             offset;
+        int                             size;
+        int                             error;
         __uint8_t                       filetype;
 
+        ASSERT(ip->i_d.di_format == XFS_DINODE_FMT_LOCAL);
+        /*
+         * xfs_iread calls us before xfs_setup_inode sets up ip->d_ops,
+         * so we can only trust the mountpoint to have the right pointer.
+         */
         dops = xfs_dir_get_ops(mp, NULL);
 
+        ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        sfp = (struct xfs_dir2_sf_hdr *)ifp->if_u1.if_data;
+        size = ifp->if_bytes;
+
         /*
          * Give up if the directory is way too short.
          */
-        XFS_WANT_CORRUPTED_RETURN(mp, size >
-                        offsetof(struct xfs_dir2_sf_hdr, parent));
-        XFS_WANT_CORRUPTED_RETURN(mp, size >=
-                        xfs_dir2_sf_hdr_size(sfp->i8count));
+        if (size <= offsetof(struct xfs_dir2_sf_hdr, parent) ||
+            size < xfs_dir2_sf_hdr_size(sfp->i8count))
+                return -EFSCORRUPTED;
 
         endp = (char *)sfp + size;
 
         /* Check .. entry */
         ino = dops->sf_get_parent_ino(sfp);
         i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
-        XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+        error = xfs_dir_ino_validate(mp, ino);
+        if (error)
+                return error;
         offset = dops->data_first_offset;
 
         /* Check all reported entries */
@@ -672,12 +685,12 @@ xfs_dir2_sf_verify(
                  * Check the fixed-offset parts of the structure are
                  * within the data buffer.
                  */
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                                ((char *)sfep + sizeof(*sfep)) < endp);
+                if (((char *)sfep + sizeof(*sfep)) >= endp)
+                        return -EFSCORRUPTED;
 
                 /* Don't allow names with known bad length. */
-                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen > 0);
-                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen < MAXNAMELEN);
+                if (sfep->namelen == 0)
+                        return -EFSCORRUPTED;
 
                 /*
                  * Check that the variable-length part of the structure is
@@ -685,33 +698,39 @@ xfs_dir2_sf_verify(
                  * name component, so nextentry is an acceptable test.
                  */
                 next_sfep = dops->sf_nextentry(sfp, sfep);
-                XFS_WANT_CORRUPTED_RETURN(mp, endp >= (char *)next_sfep);
+                if (endp < (char *)next_sfep)
+                        return -EFSCORRUPTED;
 
                 /* Check that the offsets always increase. */
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                                xfs_dir2_sf_get_offset(sfep) >= offset);
+                if (xfs_dir2_sf_get_offset(sfep) < offset)
+                        return -EFSCORRUPTED;
 
                 /* Check the inode number. */
                 ino = dops->sf_get_ino(sfp, sfep);
                 i8count += ino > XFS_DIR2_MAX_SHORT_INUM;
-                XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+                error = xfs_dir_ino_validate(mp, ino);
+                if (error)
+                        return error;
 
                 /* Check the file type. */
                 filetype = dops->sf_get_ftype(sfep);
-                XFS_WANT_CORRUPTED_RETURN(mp, filetype < XFS_DIR3_FT_MAX);
+                if (filetype >= XFS_DIR3_FT_MAX)
+                        return -EFSCORRUPTED;
 
                 offset = xfs_dir2_sf_get_offset(sfep) +
                                 dops->data_entsize(sfep->namelen);
 
                 sfep = next_sfep;
         }
-        XFS_WANT_CORRUPTED_RETURN(mp, i8count == sfp->i8count);
-        XFS_WANT_CORRUPTED_RETURN(mp, (void *)sfep == (void *)endp);
+        if (i8count != sfp->i8count)
+                return -EFSCORRUPTED;
+        if ((void *)sfep != (void *)endp)
+                return -EFSCORRUPTED;
 
         /* Make sure this whole thing ought to be in local format. */
-        XFS_WANT_CORRUPTED_RETURN(mp, offset +
-               (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
-               (uint)sizeof(xfs_dir2_block_tail_t) <= mp->m_dir_geo->blksize);
+        if (offset + (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
+            (uint)sizeof(xfs_dir2_block_tail_t) > mp->m_dir_geo->blksize)
+                return -EFSCORRUPTED;
 
         return 0;
 }
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 9653e964eda4..8a37efe04de3 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -212,6 +212,16 @@ xfs_iformat_fork(
         if (error)
                 return error;
 
+        /* Check inline dir contents. */
+        if (S_ISDIR(VFS_I(ip)->i_mode) &&
+            dip->di_format == XFS_DINODE_FMT_LOCAL) {
+                error = xfs_dir2_sf_verify(ip);
+                if (error) {
+                        xfs_idestroy_fork(ip, XFS_DATA_FORK);
+                        return error;
+                }
+        }
+
         if (xfs_is_reflink_inode(ip)) {
                 ASSERT(ip->i_cowfp == NULL);
                 xfs_ifork_init_cow(ip);
@@ -322,8 +332,6 @@ xfs_iformat_local(
         int             whichfork,
         int             size)
 {
-        int             error;
-
         /*
          * If the size is unreasonable, then something
          * is wrong and we just bail out rather than crash in
@@ -339,14 +347,6 @@ xfs_iformat_local(
                 return -EFSCORRUPTED;
         }
 
-        if (S_ISDIR(VFS_I(ip)->i_mode) && whichfork == XFS_DATA_FORK) {
-                error = xfs_dir2_sf_verify(ip->i_mount,
-                                (struct xfs_dir2_sf_hdr *)XFS_DFORK_DPTR(dip),
-                                size);
-                if (error)
-                        return error;
-        }
-
         xfs_init_local_fork(ip, whichfork, XFS_DFORK_PTR(dip, whichfork), size);
         return 0;
 }
@@ -867,7 +867,7 @@ xfs_iextents_copy(
  * In these cases, the format always takes precedence, because the
  * format indicates the current state of the fork.
  */
-int
+void
 xfs_iflush_fork(
         xfs_inode_t             *ip,
         xfs_dinode_t            *dip,
@@ -877,7 +877,6 @@ xfs_iflush_fork(
         char                    *cp;
         xfs_ifork_t             *ifp;
         xfs_mount_t             *mp;
-        int                     error;
         static const short      brootflag[2] =
                 { XFS_ILOG_DBROOT, XFS_ILOG_ABROOT };
         static const short      dataflag[2] =
@@ -886,7 +885,7 @@ xfs_iflush_fork(
                 { XFS_ILOG_DEXT, XFS_ILOG_AEXT };
 
         if (!iip)
-                return 0;
+                return;
         ifp = XFS_IFORK_PTR(ip, whichfork);
         /*
          * This can happen if we gave up in iformat in an error path,
@@ -894,19 +893,12 @@ xfs_iflush_fork(
          */
         if (!ifp) {
                 ASSERT(whichfork == XFS_ATTR_FORK);
-                return 0;
+                return;
         }
         cp = XFS_DFORK_PTR(dip, whichfork);
         mp = ip->i_mount;
         switch (XFS_IFORK_FORMAT(ip, whichfork)) {
         case XFS_DINODE_FMT_LOCAL:
-                if (S_ISDIR(VFS_I(ip)->i_mode) && whichfork == XFS_DATA_FORK) {
-                        error = xfs_dir2_sf_verify(mp,
-                                        (struct xfs_dir2_sf_hdr *)ifp->if_u1.if_data,
-                                        ifp->if_bytes);
-                        if (error)
-                                return error;
-                }
                 if ((iip->ili_fields & dataflag[whichfork]) &&
                     (ifp->if_bytes > 0)) {
                         ASSERT(ifp->if_u1.if_data != NULL);
@@ -959,7 +951,6 @@ xfs_iflush_fork(
                 ASSERT(0);
                 break;
         }
-        return 0;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_inode_fork.h b/fs/xfs/libxfs/xfs_inode_fork.h
index 132dc59fdde6..7fb8365326d1 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.h
+++ b/fs/xfs/libxfs/xfs_inode_fork.h
@@ -140,7 +140,7 @@ typedef struct xfs_ifork {
 struct xfs_ifork *xfs_iext_state_to_fork(struct xfs_inode *ip, int state);
 
 int             xfs_iformat_fork(struct xfs_inode *, struct xfs_dinode *);
-int             xfs_iflush_fork(struct xfs_inode *, struct xfs_dinode *,
+void            xfs_iflush_fork(struct xfs_inode *, struct xfs_dinode *,
                                 struct xfs_inode_log_item *, int);
 void            xfs_idestroy_fork(struct xfs_inode *, int);
 void            xfs_idata_realloc(struct xfs_inode *, int, int);
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 8b75dcea5966..828532ce0adc 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1311,8 +1311,16 @@ xfs_free_file_space(
         /*
          * Now that we've unmap all full blocks we'll have to zero out any
          * partial block at the beginning and/or end.  xfs_zero_range is
-         * smart enough to skip any holes, including those we just created.
+         * smart enough to skip any holes, including those we just created,
+         * but we must take care not to zero beyond EOF and enlarge i_size.
          */
+
+        if (offset >= XFS_ISIZE(ip))
+                return 0;
+
+        if (offset + len > XFS_ISIZE(ip))
+                len = XFS_ISIZE(ip) - offset;
+
         return xfs_zero_range(ip, offset, len, NULL);
 }
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c7fe2c2123ab..7605d8396596 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -50,6 +50,7 @@
 #include "xfs_log.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_reflink.h"
+#include "xfs_dir2_priv.h"
 
 kmem_zone_t *xfs_inode_zone;
 
@@ -3475,7 +3476,6 @@ xfs_iflush_int(
         struct xfs_inode_log_item *iip = ip->i_itemp;
         struct xfs_dinode       *dip;
         struct xfs_mount        *mp = ip->i_mount;
-        int                     error;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
         ASSERT(xfs_isiflocked(ip));
@@ -3547,6 +3547,12 @@ xfs_iflush_int(
         if (ip->i_d.di_version < 3)
                 ip->i_d.di_flushiter++;
 
+        /* Check the inline directory data. */
+        if (S_ISDIR(VFS_I(ip)->i_mode) &&
+            ip->i_d.di_format == XFS_DINODE_FMT_LOCAL &&
+            xfs_dir2_sf_verify(ip))
+                goto corrupt_out;
+
         /*
          * Copy the dirty parts of the inode into the on-disk inode.  We always
          * copy out the core of the inode, because if the inode is dirty at all
@@ -3558,14 +3564,9 @@ xfs_iflush_int(
         if (ip->i_d.di_flushiter == DI_MAX_FLUSH)
                 ip->i_d.di_flushiter = 0;
 
-        error = xfs_iflush_fork(ip, dip, iip, XFS_DATA_FORK);
-        if (error)
-                return error;
-        if (XFS_IFORK_Q(ip)) {
-                error = xfs_iflush_fork(ip, dip, iip, XFS_ATTR_FORK);
-                if (error)
-                        return error;
-        }
+        xfs_iflush_fork(ip, dip, iip, XFS_DATA_FORK);
+        if (XFS_IFORK_Q(ip))
+                xfs_iflush_fork(ip, dip, iip, XFS_ATTR_FORK);
         xfs_inobp_check(mp, bp);
 
         /*
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 229cc6a6d8ef..ebfc13350f9a 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -516,6 +516,20 @@ xfs_vn_getattr(
         stat->blocks =
                 XFS_FSB_TO_BB(mp, ip->i_d.di_nblocks + ip->i_delayed_blks);
 
+        if (ip->i_d.di_version == 3) {
+                if (request_mask & STATX_BTIME) {
+                        stat->result_mask |= STATX_BTIME;
+                        stat->btime.tv_sec = ip->i_d.di_crtime.t_sec;
+                        stat->btime.tv_nsec = ip->i_d.di_crtime.t_nsec;
+                }
+        }
+
+        if (ip->i_d.di_flags & XFS_DIFLAG_IMMUTABLE)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (ip->i_d.di_flags & XFS_DIFLAG_NODUMP)
+                stat->attributes |= STATX_ATTR_NODUMP;
 
         switch (inode->i_mode & S_IFMT) {
         case S_IFBLK:
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 2a6d9b1558e0..26d67ce3c18d 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -583,7 +583,7 @@ xfs_inumbers(
                 return error;
 
         bcount = MIN(left, (int)(PAGE_SIZE / sizeof(*buffer)));
-        buffer = kmem_alloc(bcount * sizeof(*buffer), KM_SLEEP);
+        buffer = kmem_zalloc(bcount * sizeof(*buffer), KM_SLEEP);
         do {
                 struct xfs_inobt_rec_incore     r;
                 int                             stat;
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 4df64a1fc09e..532372c6cf15 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -14,8 +14,8 @@
  * [_sdata, _edata]: contains .data.* sections, may also contain .rodata.*
  *                   and/or .init.* sections.
  * [__start_rodata, __end_rodata]: contains .rodata.* sections
- * [__start_data_ro_after_init, __end_data_ro_after_init]:
- *                   contains data.ro_after_init section
+ * [__start_ro_after_init, __end_ro_after_init]:
+ *                   contains .data..ro_after_init section
  * [__init_begin, __init_end]: contains .init.* sections, but .init.text.*
  *                   may be out of this range on some architectures.
  * [_sinittext, _einittext]: contains .init.text.* sections
@@ -33,7 +33,7 @@ extern char _data[], _sdata[], _edata[];
 extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
-extern char __start_data_ro_after_init[], __end_data_ro_after_init[];
+extern char __start_ro_after_init[], __end_ro_after_init[];
 extern char _end[];
 extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
 extern char __kprobes_text_start[], __kprobes_text_end[];
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 0968d13b3885..143db9c523e2 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -173,6 +173,7 @@
         KEEP(*(__##name##_of_table_end))
 
 #define CLKSRC_OF_TABLES()      OF_TABLE(CONFIG_CLKSRC_OF, clksrc)
+#define CLKEVT_OF_TABLES()      OF_TABLE(CONFIG_CLKEVT_OF, clkevt)
 #define IRQCHIP_OF_MATCH_TABLE() OF_TABLE(CONFIG_IRQCHIP, irqchip)
 #define CLK_OF_TABLES()         OF_TABLE(CONFIG_COMMON_CLK, clk)
 #define IOMMU_OF_TABLES()       OF_TABLE(CONFIG_OF_IOMMU, iommu)
@@ -260,9 +261,9 @@
  */
 #ifndef RO_AFTER_INIT_DATA
 #define RO_AFTER_INIT_DATA                                              \
-        __start_data_ro_after_init = .;                                 \
+        VMLINUX_SYMBOL(__start_ro_after_init) = .;                      \
         *(.data..ro_after_init)                                         \
-        __end_data_ro_after_init = .;
+        VMLINUX_SYMBOL(__end_ro_after_init) = .;
 #endif
 
 /*
@@ -559,6 +560,7 @@
         CLK_OF_TABLES()                                                 \
         RESERVEDMEM_OF_TABLES()                                         \
         CLKSRC_OF_TABLES()                                              \
+        CLKEVT_OF_TABLES()                                              \
         IOMMU_OF_TABLES()                                               \
         CPU_METHOD_OF_TABLES()                                          \
         CPUIDLE_METHOD_OF_TABLES()                                      \
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 1d4f365d8f03..f6d9af3efa45 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
         return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
 }
 
+static inline void ahash_request_complete(struct ahash_request *req, int err)
+{
+        req->base.complete(&req->base, err);
+}
+
+static inline u32 ahash_request_flags(struct ahash_request *req)
+{
+        return req->base.flags;
+}
+
 static inline struct crypto_ahash *crypto_spawn_ahash(
         struct crypto_ahash_spawn *spawn)
 {
diff --git a/include/drm/ttm/ttm_object.h b/include/drm/ttm/ttm_object.h
index ed953f98f0e1..1487011fe057 100644
--- a/include/drm/ttm/ttm_object.h
+++ b/include/drm/ttm/ttm_object.h
@@ -229,6 +229,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base);
  * @ref_type: The type of reference.
  * @existed: Upon completion, indicates that an identical reference object
  * already existed, and the refcount was upped on that object instead.
+ * @require_existed: Fail with -EPERM if an identical ref object didn't
+ * already exist.
  *
  * Checks that the base object is shareable and adds a ref object to it.
  *
@@ -243,7 +245,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base);
  */
 extern int ttm_ref_object_add(struct ttm_object_file *tfile,
                               struct ttm_base_object *base,
-                              enum ttm_ref_type ref_type, bool *existed);
+                              enum ttm_ref_type ref_type, bool *existed,
+                              bool require_existed);
 
 extern bool ttm_ref_object_exists(struct ttm_object_file *tfile,
                                   struct ttm_base_object *base);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index b72dd2ad5f44..c0b3d999c266 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -295,6 +295,7 @@ void kvm_vgic_vcpu_early_init(struct kvm_vcpu *vcpu);
 void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu);
 int kvm_vgic_map_resources(struct kvm *kvm);
 int kvm_vgic_hyp_init(void);
+void kvm_vgic_init_cpu_hardware(void);
 
 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int intid,
                         bool level);
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index b296a9006117..9382c5da7a2e 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -51,6 +51,7 @@ struct blk_mq_hw_ctx {
 
         atomic_t                nr_active;
 
+        struct delayed_work     delayed_run_work;
         struct delayed_work     delay_work;
 
         struct hlist_node       cpuhp_dead;
@@ -238,6 +239,7 @@ void blk_mq_stop_hw_queues(struct request_queue *q);
 void blk_mq_start_hw_queues(struct request_queue *q);
 void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_start_stopped_hw_queues(struct request_queue *q, bool async);
+void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
 void blk_mq_run_hw_queues(struct request_queue *q, bool async);
 void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
 void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset,
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 5a7da607ca04..01a696b0a4d3 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -610,7 +610,6 @@ struct request_queue {
 #define QUEUE_FLAG_FLUSH_NQ    25       /* flush not queueuable */
 #define QUEUE_FLAG_DAX         26       /* device supports DAX */
 #define QUEUE_FLAG_STATS       27       /* track rq completion times */
-#define QUEUE_FLAG_RESTART     28       /* queue needs restart at completion */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
@@ -1673,12 +1672,36 @@ static inline bool bios_segs_mergeable(struct request_queue *q,
         return true;
 }
 
-static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
-                         struct bio *next)
+static inline bool bio_will_gap(struct request_queue *q,
+                                struct request *prev_rq,
+                                struct bio *prev,
+                                struct bio *next)
 {
         if (bio_has_data(prev) && queue_virt_boundary(q)) {
                 struct bio_vec pb, nb;
 
+                /*
+                 * don't merge if the 1st bio starts with non-zero
+                 * offset, otherwise it is quite difficult to respect
+                 * sg gap limit. We work hard to merge a huge number of small
+                 * single bios in case of mkfs.
+                 */
+                if (prev_rq)
+                        bio_get_first_bvec(prev_rq->bio, &pb);
+                else
+                        bio_get_first_bvec(prev, &pb);
+                if (pb.bv_offset)
+                        return true;
+
+                /*
+                 * We don't need to worry about the situation that the
+                 * merged segment ends in unaligned virt boundary:
+                 *
+                 * - if 'pb' ends aligned, the merged segment ends aligned
+                 * - if 'pb' ends unaligned, the next bio must include
+                 *   one single bvec of 'nb', otherwise the 'nb' can't
+                 *   merge with 'pb'
+                 */
                 bio_get_last_bvec(prev, &pb);
                 bio_get_first_bvec(next, &nb);
 
@@ -1691,12 +1714,12 @@ static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
 
 static inline bool req_gap_back_merge(struct request *req, struct bio *bio)
 {
-        return bio_will_gap(req->q, req->biotail, bio);
+        return bio_will_gap(req->q, req, req->biotail, bio);
 }
 
 static inline bool req_gap_front_merge(struct request *req, struct bio *bio)
 {
-        return bio_will_gap(req->q, bio, req->bio);
+        return bio_will_gap(req->q, NULL, bio, req->bio);
 }
 
 int kblockd_schedule_work(struct work_struct *work);
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index c71dd8fa5764..c41b8d99dd0e 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -556,7 +556,7 @@ enum ccp_engine {
  * struct ccp_cmd - CCP operation request
  * @entry: list element (ccp driver use only)
  * @work: work element used for callbacks (ccp driver use only)
- * @ccp: CCP device to be run on (ccp driver use only)
+ * @ccp: CCP device to be run on
  * @ret: operation return code (ccp driver use only)
  * @flags: cmd processing flags
  * @engine: CCP operation to perform
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index f6b43fbb141c..af9c86e958bd 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -570,6 +570,25 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp)
         pr_cont_kernfs_path(cgrp->kn);
 }
 
+static inline void cgroup_init_kthreadd(void)
+{
+        /*
+         * kthreadd is inherited by all kthreads, keep it in the root so
+         * that the new kthreads are guaranteed to stay in the root until
+         * initialization is finished.
+         */
+        current->no_cgroup_migration = 1;
+}
+
+static inline void cgroup_kthread_ready(void)
+{
+        /*
+         * This kthread finished initialization.  The creator should have
+         * set PF_NO_SETAFFINITY if this kthread should stay in the root.
+         */
+        current->no_cgroup_migration = 0;
+}
+
 #else /* !CONFIG_CGROUPS */
 
 struct cgroup_subsys_state;
@@ -590,6 +609,8 @@ static inline void cgroup_free(struct task_struct *p) {}
 
 static inline int cgroup_init_early(void) { return 0; }
 static inline int cgroup_init(void) { return 0; }
+static inline void cgroup_init_kthreadd(void) {}
+static inline void cgroup_kthread_ready(void) {}
 
 static inline bool task_under_cgroup_hierarchy(struct task_struct *task,
                                                struct cgroup *ancestor)
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 5d3053c34fb3..6d7edc3082f9 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -229,7 +229,7 @@ static inline void tick_setup_hrtimer_broadcast(void) { }
 
 #ifdef CONFIG_CLKEVT_PROBE
 extern int clockevent_probe(void);
-#els
+#else
 static inline int clockevent_probe(void) { return 0; }
 #endif
 
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index aebecc4ed088..22d39e8d4de1 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -211,7 +211,7 @@ extern ssize_t elv_iosched_show(struct request_queue *, char *);
 extern ssize_t elv_iosched_store(struct request_queue *, const char *, size_t);
 
 extern int elevator_init(struct request_queue *, char *);
-extern void elevator_exit(struct elevator_queue *);
+extern void elevator_exit(struct request_queue *, struct elevator_queue *);
 extern int elevator_change(struct request_queue *, const char *);
 extern bool elv_bio_merge_ok(struct request *, struct bio *);
 extern struct elevator_queue *elevator_alloc(struct request_queue *,
diff --git a/include/linux/errqueue.h b/include/linux/errqueue.h
index 9ca23fcfb5d7..6fdfc884fdeb 100644
--- a/include/linux/errqueue.h
+++ b/include/linux/errqueue.h
@@ -20,6 +20,8 @@ struct sock_exterr_skb {
         struct sock_extended_err        ee;
         u16                             addr_offset;
         __be16                          port;
+        u8                              opt_stats:1,
+                                        unused:7;
 };
 
 #endif
diff --git a/include/linux/fscrypt_common.h b/include/linux/fscrypt_common.h
index 547f81592ba1..10c1abfbac6c 100644
--- a/include/linux/fscrypt_common.h
+++ b/include/linux/fscrypt_common.h
@@ -87,7 +87,6 @@ struct fscrypt_operations {
         unsigned int flags;
         const char *key_prefix;
         int (*get_context)(struct inode *, void *, size_t);
-        int (*prepare_context)(struct inode *);
         int (*set_context)(struct inode *, const void *, size_t, void *);
         int (*dummy_context)(struct inode *);
         bool (*is_encrypted)(struct inode *);
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index 2484b2fcc6eb..933d93656605 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -143,15 +143,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
                                                 struct fwnode_handle *child,
                                                 enum gpiod_flags flags,
                                                 const char *label);
-/* FIXME: delete this helper when users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return devm_fwnode_get_index_gpiod_from_child(dev, con_id,
-                                                      0, child,
-                                                      GPIOD_ASIS,
-                                                      "?");
-}
 
 #else /* CONFIG_GPIOLIB */
 
@@ -444,13 +435,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
         return ERR_PTR(-ENOSYS);
 }
 
-/* FIXME: delete this when all users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return ERR_PTR(-ENOSYS);
-}
-
 #endif /* CONFIG_GPIOLIB */
 
 static inline
diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h
index 78d59dba563e..88b673749121 100644
--- a/include/linux/hwmon.h
+++ b/include/linux/hwmon.h
@@ -88,6 +88,7 @@ enum hwmon_temp_attributes {
 #define HWMON_T_CRIT_HYST       BIT(hwmon_temp_crit_hyst)
 #define HWMON_T_EMERGENCY       BIT(hwmon_temp_emergency)
 #define HWMON_T_EMERGENCY_HYST  BIT(hwmon_temp_emergency_hyst)
+#define HWMON_T_ALARM           BIT(hwmon_temp_alarm)
 #define HWMON_T_MIN_ALARM       BIT(hwmon_temp_min_alarm)
 #define HWMON_T_MAX_ALARM       BIT(hwmon_temp_max_alarm)
 #define HWMON_T_CRIT_ALARM      BIT(hwmon_temp_crit_alarm)
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 62bbf3c1aa4a..970771a5f739 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -845,6 +845,13 @@ struct vmbus_channel {
          * link up channels based on their CPU affinity.
          */
         struct list_head percpu_list;
+
+        /*
+         * Defer freeing channel until after all cpu's have
+         * gone through grace period.
+         */
+        struct rcu_head rcu;
+
         /*
          * For performance critical channels (storage, networking
          * etc,), Hyper-V has a mechanism to enhance the throughput
@@ -1430,9 +1437,6 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
                                 const int *srv_version, int srv_vercnt,
                                 int *nego_fw_version, int *nego_srv_version);
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel);
-void hv_event_tasklet_enable(struct vmbus_channel *channel);
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
 
 void vmbus_setevent(struct vmbus_channel *channel);
diff --git a/include/linux/iio/sw_device.h b/include/linux/iio/sw_device.h
index 23ca41515527..fa7931933067 100644
--- a/include/linux/iio/sw_device.h
+++ b/include/linux/iio/sw_device.h
@@ -62,7 +62,7 @@ void iio_swd_group_init_type_name(struct iio_sw_device *d,
                                   const char *name,
                                   struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
         config_group_init_type_name(&d->group, name, type);
 #endif
 }
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 6a6de187ddc0..2e4de0deee53 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -125,9 +125,16 @@ enum iommu_attr {
 };
 
 /* These are the possible reserved region types */
-#define IOMMU_RESV_DIRECT       (1 << 0)
-#define IOMMU_RESV_RESERVED     (1 << 1)
-#define IOMMU_RESV_MSI          (1 << 2)
+enum iommu_resv_type {
+        /* Memory regions which must be mapped 1:1 at all times */
+        IOMMU_RESV_DIRECT,
+        /* Arbitrary "never map this or give it to a device" address ranges */
+        IOMMU_RESV_RESERVED,
+        /* Hardware MSI region (untranslated) */
+        IOMMU_RESV_MSI,
+        /* Software-managed MSI translation window */
+        IOMMU_RESV_SW_MSI,
+};
 
 /**
  * struct iommu_resv_region - descriptor for a reserved memory region
@@ -142,7 +149,7 @@ struct iommu_resv_region {
         phys_addr_t             start;
         size_t                  length;
         int                     prot;
-        int                     type;
+        enum iommu_resv_type    type;
 };
 
 #ifdef CONFIG_IOMMU_API
@@ -288,7 +295,8 @@ extern void iommu_get_resv_regions(struct device *dev, struct list_head *list);
 extern void iommu_put_resv_regions(struct device *dev, struct list_head *list);
 extern int iommu_request_dm_for_dev(struct device *dev);
 extern struct iommu_resv_region *
-iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot, int type);
+iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot,
+                        enum iommu_resv_type type);
 extern int iommu_get_group_resv_regions(struct iommu_group *group,
                                         struct list_head *head);
 
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index eafc965b3eb8..dc30f3d057eb 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -96,6 +96,9 @@
 #define GICH_MISR_EOI                   (1 << 0)
 #define GICH_MISR_U                     (1 << 1)
 
+#define GICV_PMR_PRIORITY_SHIFT         3
+#define GICV_PMR_PRIORITY_MASK          (0x1f << GICV_PMR_PRIORITY_SHIFT)
+
 #ifndef __ASSEMBLY__
 
 #include <linux/irqdomain.h>
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 5734480c9590..a5c7046f26b4 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -76,6 +76,9 @@ size_t ksize(const void *);
 static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
 size_t kasan_metadata_size(struct kmem_cache *cache);
 
+bool kasan_save_enable_multi_shot(void);
+void kasan_restore_multi_shot(bool enabled);
+
 #else /* CONFIG_KASAN */
 
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 2c14ad9809da..d0250744507a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -162,8 +162,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
                     int len, void *val);
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
                             int len, struct kvm_io_device *dev);
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev);
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev);
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
                                          gpa_t addr);
 
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5af377303880..bb7250c45cb8 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -740,6 +740,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait)
         return false;
 }
 
+static inline void mem_cgroup_update_page_stat(struct page *page,
+                                               enum mem_cgroup_stat_index idx,
+                                               int nr)
+{
+}
+
 static inline void mem_cgroup_inc_page_stat(struct page *page,
                                             enum mem_cgroup_stat_index idx)
 {
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 7a01c94496f1..3eef9fb9968a 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -35,10 +35,11 @@
  * Max bus-specific overhead incurred by request/responses.
  * I2C requires 1 additional byte for requests.
  * I2C requires 2 additional bytes for responses.
+ * SPI requires up to 32 additional bytes for responses.
  * */
 #define EC_PROTO_VERSION_UNKNOWN        0
 #define EC_MAX_REQUEST_OVERHEAD         1
-#define EC_MAX_RESPONSE_OVERHEAD        2
+#define EC_MAX_RESPONSE_OVERHEAD        32
 
 /*
  * Command interface between EC and AP, for LPC, I2C and SPI interfaces.
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 7e66e4f62858..1beb1ec2fbdf 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -476,6 +476,7 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+        MLX4_INTERFACE_STATE_NOWAIT     = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 5f01c88f0800..00a8fa7e366a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -32,6 +32,8 @@ struct user_struct;
 struct writeback_control;
 struct bdi_writeback;
 
+void init_mm_internals(void);
+
 #ifndef CONFIG_NEED_MULTIPLE_NODES      /* Don't use mapnrs, do it properly */
 extern unsigned long max_mapnr;
 
diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
index aab032a6ae61..97ca105347a6 100644
--- a/include/linux/mmc/sdio_func.h
+++ b/include/linux/mmc/sdio_func.h
@@ -53,7 +53,7 @@ struct sdio_func {
         unsigned int            state;          /* function state */
 #define SDIO_STATE_PRESENT      (1<<0)          /* present in sysfs */
 
-        u8                      tmpbuf[4];      /* DMA:able scratch buffer */
+        u8                      *tmpbuf;        /* DMA:able scratch buffer */
 
         unsigned                num_info;       /* number of info strings */
         const char              **info;         /* info strings */
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index 51891fb0d3ce..c91b3bcd158f 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -394,18 +394,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
         ___pud;                                                         \
 })
 
-#define pmdp_huge_get_and_clear_notify(__mm, __haddr, __pmd)            \
-({                                                                      \
-        unsigned long ___haddr = __haddr & HPAGE_PMD_MASK;              \
-        pmd_t ___pmd;                                                   \
-                                                                        \
-        ___pmd = pmdp_huge_get_and_clear(__mm, __haddr, __pmd);         \
-        mmu_notifier_invalidate_range(__mm, ___haddr,                   \
-                                      ___haddr + HPAGE_PMD_SIZE);       \
-                                                                        \
-        ___pmd;                                                         \
-})
-
 /*
  * set_pte_at_notify() sets the pte _after_ running the notifier.
  * This is safe to start by updating the secondary MMUs, because the primary MMU
@@ -489,7 +477,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
 #define ptep_clear_flush_notify ptep_clear_flush
 #define pmdp_huge_clear_flush_notify pmdp_huge_clear_flush
 #define pudp_huge_clear_flush_notify pudp_huge_clear_flush
-#define pmdp_huge_get_and_clear_notify pmdp_huge_get_and_clear
 #define set_pte_at_notify set_pte_at
 
 #endif /* CONFIG_MMU_NOTIFIER */
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index c43d435d4225..9061780b141f 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -64,26 +64,26 @@ enum {
  * RDMA_QPTYPE field
  */
 enum {
-        NVMF_RDMA_QPTYPE_CONNECTED      = 0, /* Reliable Connected */
-        NVMF_RDMA_QPTYPE_DATAGRAM       = 1, /* Reliable Datagram */
+        NVMF_RDMA_QPTYPE_CONNECTED      = 1, /* Reliable Connected */
+        NVMF_RDMA_QPTYPE_DATAGRAM       = 2, /* Reliable Datagram */
 };
 
 /* RDMA QP Service Type codes for Discovery Log Page entry TSAS
  * RDMA_QPTYPE field
  */
 enum {
-        NVMF_RDMA_PRTYPE_NOT_SPECIFIED  = 0, /* No Provider Specified */
-        NVMF_RDMA_PRTYPE_IB             = 1, /* InfiniBand */
-        NVMF_RDMA_PRTYPE_ROCE           = 2, /* InfiniBand RoCE */
-        NVMF_RDMA_PRTYPE_ROCEV2         = 3, /* InfiniBand RoCEV2 */
-        NVMF_RDMA_PRTYPE_IWARP          = 4, /* IWARP */
+        NVMF_RDMA_PRTYPE_NOT_SPECIFIED  = 1, /* No Provider Specified */
+        NVMF_RDMA_PRTYPE_IB             = 2, /* InfiniBand */
+        NVMF_RDMA_PRTYPE_ROCE           = 3, /* InfiniBand RoCE */
+        NVMF_RDMA_PRTYPE_ROCEV2         = 4, /* InfiniBand RoCEV2 */
+        NVMF_RDMA_PRTYPE_IWARP          = 5, /* IWARP */
 };
 
 /* RDMA Connection Management Service Type codes for Discovery Log Page
  * entry TSAS RDMA_CMS field
  */
 enum {
-        NVMF_RDMA_CMS_RDMA_CM   = 0, /* Sockets based enpoint addressing */
+        NVMF_RDMA_CMS_RDMA_CM   = 1, /* Sockets based endpoint addressing */
 };
 
 #define NVMF_AQ_DEPTH           32
diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h
index 35d0fd7a4948..fd0de00c0d77 100644
--- a/include/linux/omap-gpmc.h
+++ b/include/linux/omap-gpmc.h
@@ -76,22 +76,12 @@ struct gpmc_timings;
 struct omap_nand_platform_data;
 struct omap_onenand_platform_data;
 
-#if IS_ENABLED(CONFIG_MTD_NAND_OMAP2)
-extern int gpmc_nand_init(struct omap_nand_platform_data *d,
-                          struct gpmc_timings *gpmc_t);
-#else
-static inline int gpmc_nand_init(struct omap_nand_platform_data *d,
-                                 struct gpmc_timings *gpmc_t)
-{
-        return 0;
-}
-#endif
-
 #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2)
-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d);
+extern int gpmc_onenand_init(struct omap_onenand_platform_data *d);
 #else
 #define board_onenand_data      NULL
-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d)
+static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d)
 {
+        return 0;
 }
 #endif
diff --git a/include/linux/pinctrl/pinctrl.h b/include/linux/pinctrl/pinctrl.h
index 8ce2d87a238b..5e45385c5bdc 100644
--- a/include/linux/pinctrl/pinctrl.h
+++ b/include/linux/pinctrl/pinctrl.h
@@ -145,8 +145,9 @@ struct pinctrl_desc {
 extern int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
                                      struct device *dev, void *driver_data,
                                      struct pinctrl_dev **pctldev);
+extern int pinctrl_enable(struct pinctrl_dev *pctldev);
 
-/* Please use pinctrl_register_and_init() instead */
+/* Please use pinctrl_register_and_init() and pinctrl_enable() instead */
 extern struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
                                 struct device *dev, void *driver_data);
 
diff --git a/include/linux/reset.h b/include/linux/reset.h
index 86b4ed75359e..13d8681210d5 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -15,6 +15,9 @@ int reset_control_status(struct reset_control *rstc);
 struct reset_control *__of_reset_control_get(struct device_node *node,
                                      const char *id, int index, bool shared,
                                      bool optional);
+struct reset_control *__reset_control_get(struct device *dev, const char *id,
+                                          int index, bool shared,
+                                          bool optional);
 void reset_control_put(struct reset_control *rstc);
 struct reset_control *__devm_reset_control_get(struct device *dev,
                                      const char *id, int index, bool shared,
@@ -31,31 +34,26 @@ static inline int device_reset_optional(struct device *dev)
 
 static inline int reset_control_reset(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_assert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_deassert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_status(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline void reset_control_put(struct reset_control *rstc)
 {
-        WARN_ON(1);
 }
 
 static inline int __must_check device_reset(struct device *dev)
@@ -74,14 +72,21 @@ static inline struct reset_control *__of_reset_control_get(
                                         const char *id, int index, bool shared,
                                         bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
+}
+
+static inline struct reset_control *__reset_control_get(
+                                        struct device *dev, const char *id,
+                                        int index, bool shared, bool optional)
+{
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 static inline struct reset_control *__devm_reset_control_get(
                                         struct device *dev, const char *id,
                                         int index, bool shared, bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 #endif /* CONFIG_RESET_CONTROLLER */
@@ -107,8 +112,7 @@ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
 #ifndef CONFIG_RESET_CONTROLLER
         WARN_ON(1);
 #endif
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, false,
-                                                                        false);
+        return __reset_control_get(dev, id, 0, false, false);
 }
 
 /**
@@ -136,22 +140,19 @@ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
 static inline struct reset_control *reset_control_get_shared(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, true,
-                                                                        false);
+        return __reset_control_get(dev, id, 0, true, false);
 }
 
 static inline struct reset_control *reset_control_get_optional_exclusive(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, false,
-                                                                        true);
+        return __reset_control_get(dev, id, 0, false, true);
 }
 
 static inline struct reset_control *reset_control_get_optional_shared(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, true,
-                                                                        true);
+        return __reset_control_get(dev, id, 0, true, true);
 }
 
 /**
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d67eee84fd43..4cf9a59a4d08 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -604,6 +604,10 @@ struct task_struct {
 #ifdef CONFIG_COMPAT_BRK
         unsigned                        brk_randomized:1;
 #endif
+#ifdef CONFIG_CGROUPS
+        /* disallow userland-initiated cgroup migration */
+        unsigned                        no_cgroup_migration:1;
+#endif
 
         unsigned long                   atomic_flags; /* Flags requiring atomic access. */
 
diff --git a/include/linux/sched/clock.h b/include/linux/sched/clock.h
index 4a68c6791207..34fe92ce1ebd 100644
--- a/include/linux/sched/clock.h
+++ b/include/linux/sched/clock.h
@@ -54,15 +54,16 @@ static inline u64 local_clock(void)
 }
 #else
 extern void sched_clock_init_late(void);
-/*
- * Architectures can set this to 1 if they have specified
- * CONFIG_HAVE_UNSTABLE_SCHED_CLOCK in their arch Kconfig,
- * but then during bootup it turns out that sched_clock()
- * is reliable after all:
- */
 extern int sched_clock_stable(void);
 extern void clear_sched_clock_stable(void);
 
+/*
+ * When sched_clock_stable(), __sched_clock_offset provides the offset
+ * between local_clock() and sched_clock().
+ */
+extern u64 __sched_clock_offset;
+
+
 extern void sched_clock_tick(void);
 extern void sched_clock_idle_sleep_event(void);
 extern void sched_clock_idle_wakeup_event(u64 delta_ns);
diff --git a/include/linux/stat.h b/include/linux/stat.h
index c76e524fb34b..64b6b3aece21 100644
--- a/include/linux/stat.h
+++ b/include/linux/stat.h
@@ -26,6 +26,7 @@ struct kstat {
         unsigned int    nlink;
         uint32_t        blksize;        /* Preferred I/O size */
         u64             attributes;
+        u64             attributes_mask;
 #define KSTAT_ATTR_FS_IOC_FLAGS                         \
         (STATX_ATTR_COMPRESSED |                        \
          STATX_ATTR_IMMUTABLE |                         \
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 804e34c6f981..f2d36a3d3005 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -39,7 +39,10 @@ struct iov_iter {
         };
         union {
                 unsigned long nr_segs;
-                int idx;
+                struct {
+                        int idx;
+                        int start_idx;
+                };
         };
 };
 
@@ -81,6 +84,7 @@ unsigned long iov_shorten(struct iovec *iov, unsigned long nr_segs, size_t to);
 size_t iov_iter_copy_from_user_atomic(struct page *page,
                 struct iov_iter *i, unsigned long offset, size_t bytes);
 void iov_iter_advance(struct iov_iter *i, size_t bytes);
+void iov_iter_revert(struct iov_iter *i, size_t bytes);
 int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
 size_t iov_iter_single_seg_count(const struct iov_iter *i);
 size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index 1d0043dc34e4..de2a722fe3cf 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -50,4 +50,10 @@
 /* device can't handle Link Power Management */
 #define USB_QUIRK_NO_LPM                        BIT(10)
 
+/*
+ * Device reports its bInterval as linear frames instead of the
+ * USB 2.0 calculation.
+ */
+#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL   BIT(11)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 04b0d3f95043..7edfbdb55a99 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -167,6 +167,7 @@ struct virtio_driver {
         unsigned int feature_table_size;
         const unsigned int *feature_table_legacy;
         unsigned int feature_table_size_legacy;
+        int (*validate)(struct virtio_device *dev);
         int (*probe)(struct virtio_device *dev);
         void (*scan)(struct virtio_device *dev);
         void (*remove)(struct virtio_device *dev);
diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
index 9638bfeb0d1f..584f9a647ad4 100644
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -48,6 +48,8 @@ struct virtio_vsock_pkt {
         struct virtio_vsock_hdr hdr;
         struct work_struct work;
         struct list_head list;
+        /* socket refcnt not held, only use for cancellation */
+        struct vsock_sock *vsk;
         void *buf;
         u32 len;
         u32 off;
@@ -56,6 +58,7 @@ struct virtio_vsock_pkt {
 
 struct virtio_vsock_pkt_info {
         u32 remote_cid, remote_port;
+        struct vsock_sock *vsk;
         struct msghdr *msg;
         u32 pkt_len;
         u16 type;
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index f2758964ce6f..f32ed9ac181a 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -100,6 +100,9 @@ struct vsock_transport {
         void (*destruct)(struct vsock_sock *);
         void (*release)(struct vsock_sock *);
 
+        /* Cancel all pending packets sent on vsock. */
+        int (*cancel_pkt)(struct vsock_sock *vsk);
+
         /* Connections. */
         int (*connect)(struct vsock_sock *);
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f540f9ad2af4..19605878da47 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -244,7 +244,7 @@ extern s32 (*nf_ct_nat_offset)(const struct nf_conn *ct,
                                u32 seq);
 
 /* Fake conntrack entry for untracked connections */
-DECLARE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+DECLARE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 static inline struct nf_conn *nf_ct_untracked_get(void)
 {
         return raw_cpu_ptr(&nf_conntrack_untracked);
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2aa8a9d80fbe..0136028652bd 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -103,6 +103,35 @@ struct nft_regs {
         };
 };
 
+/* Store/load an u16 or u8 integer to/from the u32 data register.
+ *
+ * Note, when using concatenations, register allocation happens at 32-bit
+ * level. So for store instruction, pad the rest part with zero to avoid
+ * garbage values.
+ */
+
+static inline void nft_reg_store16(u32 *dreg, u16 val)
+{
+        *dreg = 0;
+        *(u16 *)dreg = val;
+}
+
+static inline void nft_reg_store8(u32 *dreg, u8 val)
+{
+        *dreg = 0;
+        *(u8 *)dreg = val;
+}
+
+static inline u16 nft_reg_load16(u32 *sreg)
+{
+        return *(u16 *)sreg;
+}
+
+static inline u8 nft_reg_load8(u32 *sreg)
+{
+        return *(u8 *)sreg;
+}
+
 static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
                                  unsigned int len)
 {
@@ -203,7 +232,6 @@ struct nft_set_elem {
 struct nft_set;
 struct nft_set_iter {
         u8              genmask;
-        bool            flush;
         unsigned int    count;
         unsigned int    skip;
         int             err;
diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index d150b5066201..97983d1c05e4 100644
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -9,12 +9,13 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
                      struct sk_buff *skb,
                      const struct nf_hook_state *state)
 {
+        unsigned int flags = IP6_FH_F_AUTH;
         int protohdr, thoff = 0;
         unsigned short frag_off;
 
         nft_set_pktinfo(pkt, skb, state);
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0) {
                 nft_set_pktinfo_proto_unspec(pkt, skb);
                 return;
@@ -32,6 +33,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
                                 const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+        unsigned int flags = IP6_FH_F_AUTH;
         struct ipv6hdr *ip6h, _ip6h;
         unsigned int thoff = 0;
         unsigned short frag_off;
@@ -50,7 +52,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
         if (pkt_len + sizeof(*ip6h) > skb->len)
                 return -1;
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0)
                 return -1;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 1f71ee5ab518..069582ee5d7f 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -448,10 +448,9 @@ static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
         return frag;
 }
 
-static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_association *asoc)
+static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
 {
-
-        sctp_assoc_sync_pmtu(sk, asoc);
+        sctp_assoc_sync_pmtu(asoc);
         asoc->pmtu_pending = 0;
 }
 
@@ -596,12 +595,23 @@ static inline void sctp_v4_map_v6(union sctp_addr *addr)
  */
 static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
 {
-        if (t->dst && (!dst_check(t->dst, t->dst_cookie) ||
-                       t->pathmtu != max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
-                                           SCTP_DEFAULT_MINSEGMENT)))
+        if (t->dst && !dst_check(t->dst, t->dst_cookie))
                 sctp_transport_dst_release(t);
 
         return t->dst;
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
+                           SCTP_DEFAULT_MINSEGMENT);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 07a0b128625a..138f8615acf0 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -83,6 +83,7 @@ struct sctp_bind_addr;
 struct sctp_ulpq;
 struct sctp_ep_common;
 struct crypto_shash;
+struct sctp_stream;
 
 
 #include <net/sctp/tsnmap.h>
@@ -376,7 +377,8 @@ typedef struct sctp_sender_hb_info {
         __u64 hb_nonce;
 } sctp_sender_hb_info_t;
 
-struct sctp_stream *sctp_stream_new(__u16 incnt, __u16 outcnt, gfp_t gfp);
+int sctp_stream_new(struct sctp_association *asoc, gfp_t gfp);
+int sctp_stream_init(struct sctp_association *asoc, gfp_t gfp);
 void sctp_stream_free(struct sctp_stream *stream);
 void sctp_stream_clear(struct sctp_stream *stream);
 
@@ -498,7 +500,6 @@ struct sctp_datamsg {
         /* Did the messenge fail to send? */
         int send_error;
         u8 send_failed:1,
-           force_delay:1,
            can_delay;       /* should this message be Nagle delayed */
 };
 
@@ -753,6 +754,8 @@ struct sctp_transport {
                 /* Is the Path MTU update pending on this tranport */
                 pmtu_pending:1,
 
+                dst_pending_confirm:1,  /* need to confirm neighbour */
+
                 /* Has this transport moved the ctsn since we last sacked */
                 sack_generation:1;
         u32 dst_cookie;
@@ -806,8 +809,6 @@ struct sctp_transport {
 
         __u32 burst_limited;    /* Holds old cwnd when max.burst is applied */
 
-        __u32 dst_pending_confirm;      /* need to confirm neighbour */
-
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
@@ -951,8 +952,8 @@ void sctp_transport_lower_cwnd(struct sctp_transport *, sctp_lower_cwnd_t);
 void sctp_transport_burst_limited(struct sctp_transport *);
 void sctp_transport_burst_reset(struct sctp_transport *);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
-void sctp_transport_reset(struct sctp_transport *);
-void sctp_transport_update_pmtu(struct sock *, struct sctp_transport *, u32);
+void sctp_transport_reset(struct sctp_transport *t);
+void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu);
 void sctp_transport_immediate_rtx(struct sctp_transport *);
 void sctp_transport_dst_release(struct sctp_transport *t);
 void sctp_transport_dst_confirm(struct sctp_transport *t);
@@ -1877,6 +1878,7 @@ struct sctp_association {
 
         __u8 need_ecne:1,       /* Need to send an ECNE Chunk? */
              temp:1,            /* Is it a temporary association? */
+             force_delay:1,
              prsctp_enable:1,
              reconf_enable:1;
 
@@ -1952,7 +1954,7 @@ void sctp_assoc_update(struct sctp_association *old,
 
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
-void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
+void sctp_assoc_sync_pmtu(struct sctp_association *asoc);
 void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
 void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
 void sctp_assoc_set_primary(struct sctp_association *,
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 0f1813c13687..99e4423eb2b8 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1863,6 +1863,9 @@ struct ib_port_immutable {
 };
 
 struct ib_device {
+        /* Do not access @dma_device directly from ULP nor from HW drivers. */
+        struct device                *dma_device;
+
         char                          name[IB_DEVICE_NAME_MAX];
 
         struct list_head              event_handler_list;
@@ -3007,7 +3010,7 @@ static inline int ib_req_ncomp_notif(struct ib_cq *cq, int wc_cnt)
  */
 static inline int ib_dma_mapping_error(struct ib_device *dev, u64 dma_addr)
 {
-        return dma_mapping_error(&dev->dev, dma_addr);
+        return dma_mapping_error(dev->dma_device, dma_addr);
 }
 
 /**
@@ -3021,7 +3024,7 @@ static inline u64 ib_dma_map_single(struct ib_device *dev,
                                     void *cpu_addr, size_t size,
                                     enum dma_data_direction direction)
 {
-        return dma_map_single(&dev->dev, cpu_addr, size, direction);
+        return dma_map_single(dev->dma_device, cpu_addr, size, direction);
 }
 
 /**
@@ -3035,7 +3038,7 @@ static inline void ib_dma_unmap_single(struct ib_device *dev,
                                        u64 addr, size_t size,
                                        enum dma_data_direction direction)
 {
-        dma_unmap_single(&dev->dev, addr, size, direction);
+        dma_unmap_single(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3052,7 +3055,7 @@ static inline u64 ib_dma_map_page(struct ib_device *dev,
                                   size_t size,
                                          enum dma_data_direction direction)
 {
-        return dma_map_page(&dev->dev, page, offset, size, direction);
+        return dma_map_page(dev->dma_device, page, offset, size, direction);
 }
 
 /**
@@ -3066,7 +3069,7 @@ static inline void ib_dma_unmap_page(struct ib_device *dev,
                                      u64 addr, size_t size,
                                      enum dma_data_direction direction)
 {
-        dma_unmap_page(&dev->dev, addr, size, direction);
+        dma_unmap_page(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3080,7 +3083,7 @@ static inline int ib_dma_map_sg(struct ib_device *dev,
                                 struct scatterlist *sg, int nents,
                                 enum dma_data_direction direction)
 {
-        return dma_map_sg(&dev->dev, sg, nents, direction);
+        return dma_map_sg(dev->dma_device, sg, nents, direction);
 }
 
 /**
@@ -3094,7 +3097,7 @@ static inline void ib_dma_unmap_sg(struct ib_device *dev,
                                    struct scatterlist *sg, int nents,
                                    enum dma_data_direction direction)
 {
-        dma_unmap_sg(&dev->dev, sg, nents, direction);
+        dma_unmap_sg(dev->dma_device, sg, nents, direction);
 }
 
 static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
@@ -3102,7 +3105,8 @@ static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
                                       enum dma_data_direction direction,
                                       unsigned long dma_attrs)
 {
-        return dma_map_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        return dma_map_sg_attrs(dev->dma_device, sg, nents, direction,
+                                dma_attrs);
 }
 
 static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
@@ -3110,7 +3114,7 @@ static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
                                          enum dma_data_direction direction,
                                          unsigned long dma_attrs)
 {
-        dma_unmap_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction, dma_attrs);
 }
 /**
  * ib_sg_dma_address - Return the DMA address from a scatter/gather entry
@@ -3152,7 +3156,7 @@ static inline void ib_dma_sync_single_for_cpu(struct ib_device *dev,
                                               size_t size,
                                               enum dma_data_direction dir)
 {
-        dma_sync_single_for_cpu(&dev->dev, addr, size, dir);
+        dma_sync_single_for_cpu(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3167,7 +3171,7 @@ static inline void ib_dma_sync_single_for_device(struct ib_device *dev,
                                                  size_t size,
                                                  enum dma_data_direction dir)
 {
-        dma_sync_single_for_device(&dev->dev, addr, size, dir);
+        dma_sync_single_for_device(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3182,7 +3186,7 @@ static inline void *ib_dma_alloc_coherent(struct ib_device *dev,
                                            dma_addr_t *dma_handle,
                                            gfp_t flag)
 {
-        return dma_alloc_coherent(&dev->dev, size, dma_handle, flag);
+        return dma_alloc_coherent(dev->dma_device, size, dma_handle, flag);
 }
 
 /**
@@ -3196,7 +3200,7 @@ static inline void ib_dma_free_coherent(struct ib_device *dev,
                                         size_t size, void *cpu_addr,
                                         dma_addr_t dma_handle)
 {
-        dma_free_coherent(&dev->dev, size, cpu_addr, dma_handle);
+        dma_free_coherent(dev->dma_device, size, cpu_addr, dma_handle);
 }
 
 /**
diff --git a/include/sound/cs35l35.h b/include/sound/cs35l35.h
new file mode 100644
index 000000000000..29da899e17e4
--- /dev/null
+++ b/include/sound/cs35l35.h
@@ -0,0 +1,108 @@
+/*
+ * linux/sound/cs35l35.h -- Platform data for CS35l35
+ *
+ * Copyright (c) 2016 Cirrus Logic Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __CS35L35_H
+#define __CS35L35_H
+
+struct classh_cfg {
+        /*
+         * Class H Algorithm Control Variables
+         * You can either have it done
+         * automatically or you can adjust
+         * these variables for tuning
+         *
+         * if you do not enable the internal algorithm
+         * you will get a set of mixer controls for
+         * Class H tuning
+         *
+         * Section 4.3 of the datasheet
+         */
+        bool classh_bst_override;
+        bool classh_algo_enable;
+        int classh_bst_max_limit;
+        int classh_mem_depth;
+        int classh_release_rate;
+        int classh_headroom;
+        int classh_wk_fet_disable;
+        int classh_wk_fet_delay;
+        int classh_wk_fet_thld;
+        int classh_vpch_auto;
+        int classh_vpch_rate;
+        int classh_vpch_man;
+};
+
+struct monitor_cfg {
+        /*
+         * Signal Monitor Data
+         * highly configurable signal monitoring
+         * data positioning and different types of
+         * monitoring data.
+         *
+         * Section 4.8.2 - 4.8.4 of the datasheet
+         */
+        bool is_present;
+        bool imon_specs;
+        bool vmon_specs;
+        bool vpmon_specs;
+        bool vbstmon_specs;
+        bool vpbrstat_specs;
+        bool zerofill_specs;
+        u8 imon_dpth;
+        u8 imon_loc;
+        u8 imon_frm;
+        u8 imon_scale;
+        u8 vmon_dpth;
+        u8 vmon_loc;
+        u8 vmon_frm;
+        u8 vpmon_dpth;
+        u8 vpmon_loc;
+        u8 vpmon_frm;
+        u8 vbstmon_dpth;
+        u8 vbstmon_loc;
+        u8 vbstmon_frm;
+        u8 vpbrstat_dpth;
+        u8 vpbrstat_loc;
+        u8 vpbrstat_frm;
+        u8 zerofill_dpth;
+        u8 zerofill_loc;
+        u8 zerofill_frm;
+};
+
+struct cs35l35_platform_data {
+
+        /* Stereo (2 Device) */
+        bool stereo;
+        /* serial port drive strength */
+        int sp_drv_str;
+        /* serial port drive in unused slots */
+        int sp_drv_unused;
+        /* Boost Power Down with FET */
+        bool bst_pdn_fet_on;
+        /* Boost Voltage : used if ClassH Algo Enabled */
+        int bst_vctl;
+        /* Boost Converter Peak Current CTRL */
+        int bst_ipk;
+        /* Amp Gain Zero Cross */
+        bool gain_zc;
+        /* Audio Input Location */
+        int aud_channel;
+        /* Advisory Input Location */
+        int adv_channel;
+        /* Shared Boost for stereo */
+        bool shared_bst;
+        /* Specifies this amp is using an external boost supply */
+        bool ext_bst;
+        /* ClassH Algorithm */
+        struct classh_cfg classh_algo;
+        /* Monitor Config */
+        struct monitor_cfg mon_cfg;
+};
+
+#endif /* __CS35L35_H */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index cdfb55f7aede..5170fd81e1fd 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -434,6 +434,8 @@ int snd_soc_codec_set_sysclk(struct snd_soc_codec *codec, int clk_id,
                              int source, unsigned int freq, int dir);
 int snd_soc_codec_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
                           unsigned int freq_in, unsigned int freq_out);
+int snd_soc_codec_set_jack(struct snd_soc_codec *codec,
+                           struct snd_soc_jack *jack, void *data);
 
 int snd_soc_register_card(struct snd_soc_card *card);
 int snd_soc_unregister_card(struct snd_soc_card *card);
@@ -497,7 +499,15 @@ void snd_soc_runtime_deactivate(struct snd_soc_pcm_runtime *rtd, int stream);
 int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
         unsigned int dai_fmt);
 
+#ifdef CONFIG_DMI
 int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour);
+#else
+static inline int snd_soc_set_dmi_name(struct snd_soc_card *card,
+                                       const char *flavour)
+{
+        return 0;
+}
+#endif
 
 /* Utility functions to get clock rates from various things */
 int snd_soc_calc_frame_size(int sample_size, int channels, int tdm_slots);
@@ -721,6 +731,7 @@ struct snd_soc_jack_gpio {
         /* private: */
         struct snd_soc_jack *jack;
         struct delayed_work work;
+        struct notifier_block pm_notifier;
         struct gpio_desc *desc;
 
         void *data;
@@ -812,7 +823,6 @@ struct snd_soc_component {
 
         unsigned int ignore_pmdown_time:1; /* pmdown_time is ignored at stop */
         unsigned int registered_as_component:1;
-        unsigned int auxiliary:1; /* for auxiliary component of the card */
         unsigned int suspended:1; /* is in suspend PM state */
 
         struct list_head list;
@@ -913,6 +923,8 @@ struct snd_soc_codec_driver {
                           int clk_id, int source, unsigned int freq, int dir);
         int (*set_pll)(struct snd_soc_codec *codec, int pll_id, int source,
                 unsigned int freq_in, unsigned int freq_out);
+        int (*set_jack)(struct snd_soc_codec *codec,
+                        struct snd_soc_jack *jack,  void *data);
 
         /* codec IO */
         struct regmap *(*get_regmap)(struct device *);
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 4b784b6e21c0..ccfad0e9c2cd 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -117,6 +117,7 @@ enum transport_state_table {
         TRANSPORT_ISTATE_PROCESSING = 11,
         TRANSPORT_COMPLETE_QF_WP = 18,
         TRANSPORT_COMPLETE_QF_OK = 19,
+        TRANSPORT_COMPLETE_QF_ERR = 20,
 };
 
 /* Used for struct se_cmd->se_cmd_flags */
@@ -279,8 +280,6 @@ struct t10_alua_tg_pt_gp {
         u16     tg_pt_gp_id;
         int     tg_pt_gp_valid_id;
         int     tg_pt_gp_alua_supported_states;
-        int     tg_pt_gp_alua_pending_state;
-        int     tg_pt_gp_alua_previous_state;
         int     tg_pt_gp_alua_access_status;
         int     tg_pt_gp_alua_access_type;
         int     tg_pt_gp_nonop_delay_msecs;
@@ -289,18 +288,16 @@ struct t10_alua_tg_pt_gp {
         int     tg_pt_gp_pref;
         int     tg_pt_gp_write_metadata;
         u32     tg_pt_gp_members;
-        atomic_t tg_pt_gp_alua_access_state;
+        int     tg_pt_gp_alua_access_state;
         atomic_t tg_pt_gp_ref_cnt;
         spinlock_t tg_pt_gp_lock;
-        struct mutex tg_pt_gp_md_mutex;
+        struct mutex tg_pt_gp_transition_mutex;
         struct se_device *tg_pt_gp_dev;
         struct config_group tg_pt_gp_group;
         struct list_head tg_pt_gp_list;
         struct list_head tg_pt_gp_lun_list;
         struct se_lun *tg_pt_gp_alua_lun;
         struct se_node_acl *tg_pt_gp_alua_nacl;
-        struct work_struct tg_pt_gp_transition_work;
-        struct completion *tg_pt_gp_transition_complete;
 };
 
 struct t10_vpd {
@@ -705,6 +702,7 @@ struct se_lun {
         u64                     unpacked_lun;
 #define SE_LUN_LINK_MAGIC                       0xffff7771
         u32                     lun_link_magic;
+        bool                    lun_shutdown;
         bool                    lun_access_ro;
         u32                     lun_index;
 
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 9b1462e38b82..a076cf1a3a23 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -730,9 +730,11 @@ __SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
 __SYSCALL(__NR_pkey_alloc,    sys_pkey_alloc)
 #define __NR_pkey_free 290
 __SYSCALL(__NR_pkey_free,     sys_pkey_free)
+#define __NR_statx 291
+__SYSCALL(__NR_statx,     sys_statx)
 
 #undef __NR_syscalls
-#define __NR_syscalls 291
+#define __NR_syscalls 292
 
 /*
  * All syscalls below here should go away really,
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index dd9820b1c779..f8d9fed17ba9 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -445,6 +445,7 @@ header-y += unistd.h
 header-y += unix_diag.h
 header-y += usbdevice_fs.h
 header-y += usbip.h
+header-y += userio.h
 header-y += utime.h
 header-y += utsname.h
 header-y += uuid.h
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index db4c253f8011..dcfc3a5a9cb1 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -713,33 +713,6 @@ enum btrfs_err_code {
         BTRFS_ERROR_DEV_ONLY_WRITABLE,
         BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS
 };
-/* An error code to error string mapping for the kernel
-*  error codes
-*/
-static inline char *btrfs_err_str(enum btrfs_err_code err_code)
-{
-        switch (err_code) {
-                case BTRFS_ERROR_DEV_RAID1_MIN_NOT_MET:
-                        return "unable to go below two devices on raid1";
-                case BTRFS_ERROR_DEV_RAID10_MIN_NOT_MET:
-                        return "unable to go below four devices on raid10";
-                case BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET:
-                        return "unable to go below two devices on raid5";
-                case BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET:
-                        return "unable to go below three devices on raid6";
-                case BTRFS_ERROR_DEV_TGT_REPLACE:
-                        return "unable to remove the dev_replace target dev";
-                case BTRFS_ERROR_DEV_MISSING_NOT_FOUND:
-                        return "no missing devices found to remove";
-                case BTRFS_ERROR_DEV_ONLY_WRITABLE:
-                        return "unable to remove the only writeable device";
-                case BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS:
-                        return "add/delete/balance/replace/resize operation "\
-                                "in progress";
-                default:
-                        return NULL;
-        }
-}
 
 #define BTRFS_IOC_SNAP_CREATE _IOW(BTRFS_IOCTL_MAGIC, 1, \
                                    struct btrfs_ioctl_vol_args)
diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h
index 85bbb1799df3..d496c02e14bc 100644
--- a/include/uapi/linux/ipv6_route.h
+++ b/include/uapi/linux/ipv6_route.h
@@ -35,7 +35,7 @@
 #define RTF_PREF(pref)  ((pref) << 27)
 #define RTF_PREF_MASK   0x18000000
 
-#define RTF_PCPU        0x40000000
+#define RTF_PCPU        0x40000000      /* read-only: can not be set by user */
 #define RTF_LOCAL       0x80000000
 
 
diff --git a/include/uapi/linux/stat.h b/include/uapi/linux/stat.h
index 51a6b86e3700..d538897b8e08 100644
--- a/include/uapi/linux/stat.h
+++ b/include/uapi/linux/stat.h
@@ -114,7 +114,7 @@ struct statx {
         __u64   stx_ino;        /* Inode number */
         __u64   stx_size;       /* File size */
         __u64   stx_blocks;     /* Number of 512-byte blocks allocated */
-        __u64   __spare1[1];
+        __u64   stx_attributes_mask; /* Mask to show what's supported in stx_attributes */
         /* 0x40 */
         struct statx_timestamp  stx_atime;      /* Last access time */
         struct statx_timestamp  stx_btime;      /* File creation time */
@@ -152,9 +152,10 @@ struct statx {
 #define STATX_BASIC_STATS       0x000007ffU     /* The stuff in the normal stat struct */
 #define STATX_BTIME             0x00000800U     /* Want/got stx_btime */
 #define STATX_ALL               0x00000fffU     /* All currently supported flags */
+#define STATX__RESERVED         0x80000000U     /* Reserved for future struct statx expansion */
 
 /*
- * Attributes to be found in stx_attributes
+ * Attributes to be found in stx_attributes and masked in stx_attributes_mask.
  *
  * These give information about the features or the state of a file that might
  * be of use to ordinary userspace programs such as GUIs or ls rather than
diff --git a/include/uapi/linux/virtio_pci.h b/include/uapi/linux/virtio_pci.h
index 15b4385a2be1..90007a1abcab 100644
--- a/include/uapi/linux/virtio_pci.h
+++ b/include/uapi/linux/virtio_pci.h
@@ -79,7 +79,7 @@
  * configuration space */
 #define VIRTIO_PCI_CONFIG_OFF(msix_enabled)     ((msix_enabled) ? 24 : 20)
 /* Deprecated: please use VIRTIO_PCI_CONFIG_OFF instead */
-#define VIRTIO_PCI_CONFIG(dev)  VIRTIO_PCI_CONFIG_OFF((dev)->pci_dev->msix_enabled)
+#define VIRTIO_PCI_CONFIG(dev)  VIRTIO_PCI_CONFIG_OFF((dev)->msix_enabled)
 
 /* Virtio ABI version, this must match exactly */
 #define VIRTIO_PCI_ABI_VERSION          0
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index da7cd62bace7..0b3d30837a9f 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -34,6 +34,7 @@
 #define MLX5_ABI_USER_H
 
 #include <linux/types.h>
+#include <linux/if_ether.h>     /* For ETH_ALEN. */
 
 enum {
         MLX5_QP_FLAG_SIGNATURE          = 1 << 0,
@@ -66,7 +67,7 @@ struct mlx5_ib_alloc_ucontext_req {
 };
 
 enum mlx5_lib_caps {
-        MLX5_LIB_CAP_4K_UAR     = (u64)1 << 0,
+        MLX5_LIB_CAP_4K_UAR     = (__u64)1 << 0,
 };
 
 struct mlx5_ib_alloc_ucontext_req_v2 {
diff --git a/include/video/exynos5433_decon.h b/include/video/exynos5433_decon.h
index ef8e2a8ad0af..6b083d327e98 100644
--- a/include/video/exynos5433_decon.h
+++ b/include/video/exynos5433_decon.h
@@ -46,6 +46,7 @@
 #define DECON_FRAMEFIFO_STATUS          0x0524
 #define DECON_CMU                       0x1404
 #define DECON_UPDATE                    0x1410
+#define DECON_CRFMID                    0x1414
 #define DECON_UPDATE_SCHEME             0x1438
 #define DECON_VIDCON1                   0x2000
 #define DECON_VIDCON2                   0x2004
@@ -126,6 +127,10 @@
 
 /* VIDINTCON0 */
 #define VIDINTCON0_FRAMEDONE            (1 << 17)
+#define VIDINTCON0_FRAMESEL_BP          (0 << 15)
+#define VIDINTCON0_FRAMESEL_VS          (1 << 15)
+#define VIDINTCON0_FRAMESEL_AC          (2 << 15)
+#define VIDINTCON0_FRAMESEL_FP          (3 << 15)
 #define VIDINTCON0_INTFRMEN             (1 << 12)
 #define VIDINTCON0_INTEN                (1 << 0)
 
@@ -142,6 +147,13 @@
 #define STANDALONE_UPDATE_F             (1 << 0)
 
 /* DECON_VIDCON1 */
+#define VIDCON1_LINECNT_MASK            (0x0fff << 16)
+#define VIDCON1_I80_ACTIVE              (1 << 15)
+#define VIDCON1_VSTATUS_MASK            (0x3 << 13)
+#define VIDCON1_VSTATUS_VS              (0 << 13)
+#define VIDCON1_VSTATUS_BP              (1 << 13)
+#define VIDCON1_VSTATUS_AC              (2 << 13)
+#define VIDCON1_VSTATUS_FP              (3 << 13)
 #define VIDCON1_VCLK_MASK               (0x3 << 9)
 #define VIDCON1_VCLK_RUN_VDEN_DISABLE   (0x3 << 9)
 #define VIDCON1_VCLK_HOLD               (0x0 << 9)
diff --git a/init/main.c b/init/main.c
index f9c9d9948203..b0c11cbf5ddf 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1022,6 +1022,8 @@ static noinline void __init kernel_init_freeable(void)
 
         workqueue_init();
 
+        init_mm_internals();
+
         do_pre_smp_initcalls();
         lockup_detector_init();
 
diff --git a/kernel/audit.c b/kernel/audit.c
index e794544f5e63..a871bf80fde1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -54,6 +54,10 @@
 #include <linux/kthread.h>
 #include <linux/kernel.h>
 #include <linux/syscalls.h>
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+#include <linux/mutex.h>
+#include <linux/gfp.h>
 
 #include <linux/audit.h>
 
@@ -90,13 +94,34 @@ static u32	audit_default;
 /* If auditing cannot proceed, audit_failure selects what happens. */
 static u32      audit_failure = AUDIT_FAIL_PRINTK;
 
-/*
- * If audit records are to be written to the netlink socket, audit_pid
- * contains the pid of the auditd process and audit_nlk_portid contains
- * the portid to use to send netlink messages to that process.
+/* private audit network namespace index */
+static unsigned int audit_net_id;
+
+/**
+ * struct audit_net - audit private network namespace data
+ * @sk: communication socket
  */
-int             audit_pid;
-static __u32    audit_nlk_portid;
+struct audit_net {
+        struct sock *sk;
+};
+
+/**
+ * struct auditd_connection - kernel/auditd connection state
+ * @pid: auditd PID
+ * @portid: netlink portid
+ * @net: the associated network namespace
+ * @lock: spinlock to protect write access
+ *
+ * Description:
+ * This struct is RCU protected; you must either hold the RCU lock for reading
+ * or the included spinlock for writing.
+ */
+static struct auditd_connection {
+        int pid;
+        u32 portid;
+        struct net *net;
+        spinlock_t lock;
+} auditd_conn;
 
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -123,10 +148,6 @@ u32		audit_sig_sid = 0;
 */
 static atomic_t audit_lost = ATOMIC_INIT(0);
 
-/* The netlink socket. */
-static struct sock *audit_sock;
-static unsigned int audit_net_id;
-
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
 
@@ -192,6 +213,43 @@ struct audit_reply {
         struct sk_buff *skb;
 };
 
+/**
+ * auditd_test_task - Check to see if a given task is an audit daemon
+ * @task: the task to check
+ *
+ * Description:
+ * Return 1 if the task is a registered audit daemon, 0 otherwise.
+ */
+int auditd_test_task(const struct task_struct *task)
+{
+        int rc;
+
+        rcu_read_lock();
+        rc = (auditd_conn.pid && task->tgid == auditd_conn.pid ? 1 : 0);
+        rcu_read_unlock();
+
+        return rc;
+}
+
+/**
+ * audit_get_sk - Return the audit socket for the given network namespace
+ * @net: the destination network namespace
+ *
+ * Description:
+ * Returns the sock pointer if valid, NULL otherwise.  The caller must ensure
+ * that a reference is held for the network namespace while the sock is in use.
+ */
+static struct sock *audit_get_sk(const struct net *net)
+{
+        struct audit_net *aunet;
+
+        if (!net)
+                return NULL;
+
+        aunet = net_generic(net, audit_net_id);
+        return aunet->sk;
+}
+
 static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
 {
         if (ab) {
@@ -210,9 +268,7 @@ void audit_panic(const char *message)
                         pr_err("%s\n", message);
                 break;
         case AUDIT_FAIL_PANIC:
-                /* test audit_pid since printk is always losey, why bother? */
-                if (audit_pid)
-                        panic("audit: %s\n", message);
+                panic("audit: %s\n", message);
                 break;
         }
 }
@@ -370,21 +426,60 @@ static int audit_set_failure(u32 state)
         return audit_do_config_change("audit_failure", &audit_failure, state);
 }
 
-/*
- * For one reason or another this nlh isn't getting delivered to the userspace
- * audit daemon, just send it to printk.
+/**
+ * auditd_set - Set/Reset the auditd connection state
+ * @pid: auditd PID
+ * @portid: auditd netlink portid
+ * @net: auditd network namespace pointer
+ *
+ * Description:
+ * This function will obtain and drop network namespace references as
+ * necessary.
+ */
+static void auditd_set(int pid, u32 portid, struct net *net)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&auditd_conn.lock, flags);
+        auditd_conn.pid = pid;
+        auditd_conn.portid = portid;
+        if (auditd_conn.net)
+                put_net(auditd_conn.net);
+        if (net)
+                auditd_conn.net = get_net(net);
+        else
+                auditd_conn.net = NULL;
+        spin_unlock_irqrestore(&auditd_conn.lock, flags);
+}
+
+/**
+ * kauditd_print_skb - Print the audit record to the ring buffer
+ * @skb: audit record
+ *
+ * Whatever the reason, this packet may not make it to the auditd connection
+ * so write it via printk so the information isn't completely lost.
  */
 static void kauditd_printk_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
         char *data = nlmsg_data(nlh);
 
-        if (nlh->nlmsg_type != AUDIT_EOE) {
-                if (printk_ratelimit())
-                        pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
-                else
-                        audit_log_lost("printk limit exceeded");
-        }
+        if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())
+                pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
+}
+
+/**
+ * kauditd_rehold_skb - Handle a audit record send failure in the hold queue
+ * @skb: audit record
+ *
+ * Description:
+ * This should only be used by the kauditd_thread when it fails to flush the
+ * hold queue.
+ */
+static void kauditd_rehold_skb(struct sk_buff *skb)
+{
+        /* put the record back in the queue at the same place */
+        skb_queue_head(&audit_hold_queue, skb);
 }
 
 /**
@@ -444,65 +539,163 @@ static void kauditd_retry_skb(struct sk_buff *skb)
  * auditd_reset - Disconnect the auditd connection
  *
  * Description:
- * Break the auditd/kauditd connection and move all the records in the retry
- * queue into the hold queue in case auditd reconnects.  The audit_cmd_mutex
- * must be held when calling this function.
+ * Break the auditd/kauditd connection and move all the queued records into the
+ * hold queue in case auditd reconnects.
  */
 static void auditd_reset(void)
 {
         struct sk_buff *skb;
 
-        /* break the connection */
-        if (audit_sock) {
-                sock_put(audit_sock);
-                audit_sock = NULL;
-        }
-        audit_pid = 0;
-        audit_nlk_portid = 0;
+        /* if it isn't already broken, break the connection */
+        rcu_read_lock();
+        if (auditd_conn.pid)
+                auditd_set(0, 0, NULL);
+        rcu_read_unlock();
 
-        /* flush all of the retry queue to the hold queue */
+        /* flush all of the main and retry queues to the hold queue */
         while ((skb = skb_dequeue(&audit_retry_queue)))
                 kauditd_hold_skb(skb);
+        while ((skb = skb_dequeue(&audit_queue)))
+                kauditd_hold_skb(skb);
 }
 
 /**
- * kauditd_send_unicast_skb - Send a record via unicast to auditd
+ * auditd_send_unicast_skb - Send a record via unicast to auditd
  * @skb: audit record
+ *
+ * Description:
+ * Send a skb to the audit daemon, returns positive/zero values on success and
+ * negative values on failure; in all cases the skb will be consumed by this
+ * function.  If the send results in -ECONNREFUSED the connection with auditd
+ * will be reset.  This function may sleep so callers should not hold any locks
+ * where this would cause a problem.
  */
-static int kauditd_send_unicast_skb(struct sk_buff *skb)
+static int auditd_send_unicast_skb(struct sk_buff *skb)
 {
         int rc;
+        u32 portid;
+        struct net *net;
+        struct sock *sk;
+
+        /* NOTE: we can't call netlink_unicast while in the RCU section so
+         *       take a reference to the network namespace and grab local
+         *       copies of the namespace, the sock, and the portid; the
+         *       namespace and sock aren't going to go away while we hold a
+         *       reference and if the portid does become invalid after the RCU
+         *       section netlink_unicast() should safely return an error */
+
+        rcu_read_lock();
+        if (!auditd_conn.pid) {
+                rcu_read_unlock();
+                rc = -ECONNREFUSED;
+                goto err;
+        }
+        net = auditd_conn.net;
+        get_net(net);
+        sk = audit_get_sk(net);
+        portid = auditd_conn.portid;
+        rcu_read_unlock();
 
-        /* if we know nothing is connected, don't even try the netlink call */
-        if (!audit_pid)
-                return -ECONNREFUSED;
+        rc = netlink_unicast(sk, skb, portid, 0);
+        put_net(net);
+        if (rc < 0)
+                goto err;
 
-        /* get an extra skb reference in case we fail to send */
-        skb_get(skb);
-        rc = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
-        if (rc >= 0) {
-                consume_skb(skb);
-                rc = 0;
-        }
+        return rc;
 
+err:
+        if (rc == -ECONNREFUSED)
+                auditd_reset();
         return rc;
 }
 
+/**
+ * kauditd_send_queue - Helper for kauditd_thread to flush skb queues
+ * @sk: the sending sock
+ * @portid: the netlink destination
+ * @queue: the skb queue to process
+ * @retry_limit: limit on number of netlink unicast failures
+ * @skb_hook: per-skb hook for additional processing
+ * @err_hook: hook called if the skb fails the netlink unicast send
+ *
+ * Description:
+ * Run through the given queue and attempt to send the audit records to auditd,
+ * returns zero on success, negative values on failure.  It is up to the caller
+ * to ensure that the @sk is valid for the duration of this function.
+ *
+ */
+static int kauditd_send_queue(struct sock *sk, u32 portid,
+                              struct sk_buff_head *queue,
+                              unsigned int retry_limit,
+                              void (*skb_hook)(struct sk_buff *skb),
+                              void (*err_hook)(struct sk_buff *skb))
+{
+        int rc = 0;
+        struct sk_buff *skb;
+        static unsigned int failed = 0;
+
+        /* NOTE: kauditd_thread takes care of all our locking, we just use
+         *       the netlink info passed to us (e.g. sk and portid) */
+
+        while ((skb = skb_dequeue(queue))) {
+                /* call the skb_hook for each skb we touch */
+                if (skb_hook)
+                        (*skb_hook)(skb);
+
+                /* can we send to anyone via unicast? */
+                if (!sk) {
+                        if (err_hook)
+                                (*err_hook)(skb);
+                        continue;
+                }
+
+                /* grab an extra skb reference in case of error */
+                skb_get(skb);
+                rc = netlink_unicast(sk, skb, portid, 0);
+                if (rc < 0) {
+                        /* fatal failure for our queue flush attempt? */
+                        if (++failed >= retry_limit ||
+                            rc == -ECONNREFUSED || rc == -EPERM) {
+                                /* yes - error processing for the queue */
+                                sk = NULL;
+                                if (err_hook)
+                                        (*err_hook)(skb);
+                                if (!skb_hook)
+                                        goto out;
+                                /* keep processing with the skb_hook */
+                                continue;
+                        } else
+                                /* no - requeue to preserve ordering */
+                                skb_queue_head(queue, skb);
+                } else {
+                        /* it worked - drop the extra reference and continue */
+                        consume_skb(skb);
+                        failed = 0;
+                }
+        }
+
+out:
+        return (rc >= 0 ? 0 : rc);
+}
+
 /*
  * kauditd_send_multicast_skb - Send a record to any multicast listeners
  * @skb: audit record
  *
  * Description:
- * This function doesn't consume an skb as might be expected since it has to
- * copy it anyways.
+ * Write a multicast message to anyone listening in the initial network
+ * namespace.  This function doesn't consume an skb as might be expected since
+ * it has to copy it anyways.
  */
 static void kauditd_send_multicast_skb(struct sk_buff *skb)
 {
         struct sk_buff *copy;
-        struct audit_net *aunet = net_generic(&init_net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
+        struct sock *sock = audit_get_sk(&init_net);
         struct nlmsghdr *nlh;
 
+        /* NOTE: we are not taking an additional reference for init_net since
+         *       we don't have to worry about it going away */
+
         if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
                 return;
 
@@ -526,149 +719,79 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
 }
 
 /**
- * kauditd_wake_condition - Return true when it is time to wake kauditd_thread
- *
- * Description:
- * This function is for use by the wait_event_freezable() call in
- * kauditd_thread().
+ * kauditd_thread - Worker thread to send audit records to userspace
+ * @dummy: unused
  */
-static int kauditd_wake_condition(void)
-{
-        static int pid_last = 0;
-        int rc;
-        int pid = audit_pid;
-
-        /* wake on new messages or a change in the connected auditd */
-        rc = skb_queue_len(&audit_queue) || (pid && pid != pid_last);
-        if (rc)
-                pid_last = pid;
-
-        return rc;
-}
-
 static int kauditd_thread(void *dummy)
 {
         int rc;
-        int auditd = 0;
-        int reschedule = 0;
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
+        u32 portid = 0;
+        struct net *net = NULL;
+        struct sock *sk = NULL;
 
 #define UNICAST_RETRIES 5
-#define AUDITD_BAD(x,y) \
-        ((x) == -ECONNREFUSED || (x) == -EPERM || ++(y) >= UNICAST_RETRIES)
-
-        /* NOTE: we do invalidate the auditd connection flag on any sending
-         * errors, but we only "restore" the connection flag at specific places
-         * in the loop in order to help ensure proper ordering of audit
-         * records */
 
         set_freezable();
         while (!kthread_should_stop()) {
-                /* NOTE: possible area for future improvement is to look at
-                 *       the hold and retry queues, since only this thread
-                 *       has access to these queues we might be able to do
-                 *       our own queuing and skip some/all of the locking */
-
-                /* NOTE: it might be a fun experiment to split the hold and
-                 *       retry queue handling to another thread, but the
-                 *       synchronization issues and other overhead might kill
-                 *       any performance gains */
+                /* NOTE: see the lock comments in auditd_send_unicast_skb() */
+                rcu_read_lock();
+                if (!auditd_conn.pid) {
+                        rcu_read_unlock();
+                        goto main_queue;
+                }
+                net = auditd_conn.net;
+                get_net(net);
+                sk = audit_get_sk(net);
+                portid = auditd_conn.portid;
+                rcu_read_unlock();
 
                 /* attempt to flush the hold queue */
-                while (auditd && (skb = skb_dequeue(&audit_hold_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                /* requeue to the same spot */
-                                skb_queue_head(&audit_hold_queue, skb);
-
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                }
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_hold_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_rehold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        auditd_reset();
+                        goto main_queue;
                 }
 
                 /* attempt to flush the retry queue */
-                while (auditd && (skb = skb_dequeue(&audit_retry_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        kauditd_hold_skb(skb);
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                } else
-                                        /* temporary problem (we hope), queue
-                                         * to the same spot and retry */
-                                        skb_queue_head(&audit_retry_queue, skb);
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_retry_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_hold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        auditd_reset();
+                        goto main_queue;
                 }
 
-                /* standard queue processing, try to be as quick as possible */
-quick_loop:
-                skb = skb_dequeue(&audit_queue);
-                if (skb) {
-                        /* setup the netlink header, see the comments in
-                         * kauditd_send_multicast_skb() for length quirks */
-                        nlh = nlmsg_hdr(skb);
-                        nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
-
-                        /* attempt to send to any multicast listeners */
-                        kauditd_send_multicast_skb(skb);
-
-                        /* attempt to send to auditd, queue on failure */
-                        if (auditd) {
-                                rc = kauditd_send_unicast_skb(skb);
-                                if (rc) {
-                                        auditd = 0;
-                                        if (AUDITD_BAD(rc, reschedule)) {
-                                                mutex_lock(&audit_cmd_mutex);
-                                                auditd_reset();
-                                                mutex_unlock(&audit_cmd_mutex);
-                                                reschedule = 0;
-                                        }
-
-                                        /* move to the retry queue */
-                                        kauditd_retry_skb(skb);
-                                } else
-                                        /* everything is working so go fast! */
-                                        goto quick_loop;
-                        } else if (reschedule)
-                                /* we are currently having problems, move to
-                                 * the retry queue */
-                                kauditd_retry_skb(skb);
-                        else
-                                /* dump the message via printk and hold it */
-                                kauditd_hold_skb(skb);
-                } else {
-                        /* we have flushed the backlog so wake everyone */
-                        wake_up(&audit_backlog_wait);
-
-                        /* if everything is okay with auditd (if present), go
-                         * to sleep until there is something new in the queue
-                         * or we have a change in the connected auditd;
-                         * otherwise simply reschedule to give things a chance
-                         * to recover */
-                        if (reschedule) {
-                                set_current_state(TASK_INTERRUPTIBLE);
-                                schedule();
-                        } else
-                                wait_event_freezable(kauditd_wait,
-                                                     kauditd_wake_condition());
-
-                        /* update the auditd connection status */
-                        auditd = (audit_pid ? 1 : 0);
+main_queue:
+                /* process the main queue - do the multicast send and attempt
+                 * unicast, dump failed record sends to the retry queue; if
+                 * sk == NULL due to previous failures we will just do the
+                 * multicast send and move the record to the retry queue */
+                rc = kauditd_send_queue(sk, portid, &audit_queue, 1,
+                                        kauditd_send_multicast_skb,
+                                        kauditd_retry_skb);
+                if (sk == NULL || rc < 0)
+                        auditd_reset();
+                sk = NULL;
+
+                /* drop our netns reference, no auditd sends past this line */
+                if (net) {
+                        put_net(net);
+                        net = NULL;
                 }
+
+                /* we have processed all the queues so wake everyone */
+                wake_up(&audit_backlog_wait);
+
+                /* NOTE: we want to wake up if there is anything on the queue,
+                 *       regardless of if an auditd is connected, as we need to
+                 *       do the multicast send and rotate records from the
+                 *       main queue to the retry/hold queues */
+                wait_event_freezable(kauditd_wait,
+                                     (skb_queue_len(&audit_queue) ? 1 : 0));
         }
 
         return 0;
@@ -678,17 +801,16 @@ int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
         struct sk_buff *skb;
-        struct net *net = dest->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(dest->net);
 
         /* wait for parent to finish and send an ACK */
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         while ((skb = __skb_dequeue(&dest->q)) != NULL)
-                netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
+                netlink_unicast(sk, skb, dest->portid, 0);
 
-        put_net(net);
+        put_net(dest->net);
         kfree(dest);
 
         return 0;
@@ -722,16 +844,15 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
         struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = reply->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(reply->net);
 
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         /* Ignore failure. It'll only happen if the sender goes away,
            because our timeout is set to infinite. */
-        netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
-        put_net(net);
+        netlink_unicast(sk, reply->skb, reply->portid, 0);
+        put_net(reply->net);
         kfree(reply);
         return 0;
 }
@@ -949,12 +1070,12 @@ static int audit_set_feature(struct sk_buff *skb)
 
 static int audit_replace(pid_t pid)
 {
-        struct sk_buff *skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0,
-                                               &pid, sizeof(pid));
+        struct sk_buff *skb;
 
+        skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0, &pid, sizeof(pid));
         if (!skb)
                 return -ENOMEM;
-        return netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
+        return auditd_send_unicast_skb(skb);
 }
 
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
@@ -981,7 +1102,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 memset(&s, 0, sizeof(s));
                 s.enabled               = audit_enabled;
                 s.failure               = audit_failure;
-                s.pid                   = audit_pid;
+                rcu_read_lock();
+                s.pid                   = auditd_conn.pid;
+                rcu_read_unlock();
                 s.rate_limit            = audit_rate_limit;
                 s.backlog_limit         = audit_backlog_limit;
                 s.lost                  = atomic_read(&audit_lost);
@@ -1014,30 +1137,44 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                          *       from the initial pid namespace, but something
                          *       to keep in mind if this changes */
                         int new_pid = s.pid;
+                        pid_t auditd_pid;
                         pid_t requesting_pid = task_tgid_vnr(current);
 
-                        if ((!new_pid) && (requesting_pid != audit_pid)) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* test the auditd connection */
+                        audit_replace(requesting_pid);
+
+                        rcu_read_lock();
+                        auditd_pid = auditd_conn.pid;
+                        /* only the current auditd can unregister itself */
+                        if ((!new_pid) && (requesting_pid != auditd_pid)) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EACCES;
                         }
-                        if (audit_pid && new_pid &&
-                            audit_replace(requesting_pid) != -ECONNREFUSED) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* replacing a healthy auditd is not allowed */
+                        if (auditd_pid && new_pid) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EEXIST;
                         }
+                        rcu_read_unlock();
+
                         if (audit_enabled != AUDIT_OFF)
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 1);
+
                         if (new_pid) {
-                                if (audit_sock)
-                                        sock_put(audit_sock);
-                                audit_pid = new_pid;
-                                audit_nlk_portid = NETLINK_CB(skb).portid;
-                                sock_hold(skb->sk);
-                                audit_sock = skb->sk;
-                        } else {
+                                /* register a new auditd connection */
+                                auditd_set(new_pid,
+                                           NETLINK_CB(skb).portid,
+                                           sock_net(NETLINK_CB(skb).sk));
+                                /* try to process any backlog */
+                                wake_up_interruptible(&kauditd_wait);
+                        } else
+                                /* unregister the auditd connection */
                                 auditd_reset();
-                        }
-                        wake_up_interruptible(&kauditd_wait);
                 }
                 if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
                         err = audit_set_rate_limit(s.rate_limit);
@@ -1090,7 +1227,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 if (err)
                                         break;
                         }
-                        mutex_unlock(&audit_cmd_mutex);
                         audit_log_common_recv_msg(&ab, msg_type);
                         if (msg_type != AUDIT_USER_TTY)
                                 audit_log_format(ab, " msg='%.*s'",
@@ -1108,7 +1244,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         }
                         audit_set_portid(ab, NETLINK_CB(skb).portid);
                         audit_log_end(ab);
-                        mutex_lock(&audit_cmd_mutex);
                 }
                 break;
         case AUDIT_ADD_RULE:
@@ -1298,26 +1433,26 @@ static int __net_init audit_net_init(struct net *net)
 
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
-        aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
-        if (aunet->nlsk == NULL) {
+        aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
+        if (aunet->sk == NULL) {
                 audit_panic("cannot initialize netlink socket in namespace");
                 return -ENOMEM;
         }
-        aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+        aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+
         return 0;
 }
 
 static void __net_exit audit_net_exit(struct net *net)
 {
         struct audit_net *aunet = net_generic(net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
-        mutex_lock(&audit_cmd_mutex);
-        if (sock == audit_sock)
+
+        rcu_read_lock();
+        if (net == auditd_conn.net)
                 auditd_reset();
-        mutex_unlock(&audit_cmd_mutex);
+        rcu_read_unlock();
 
-        netlink_kernel_release(sock);
-        aunet->nlsk = NULL;
+        netlink_kernel_release(aunet->sk);
 }
 
 static struct pernet_operations audit_net_ops __net_initdata = {
@@ -1335,20 +1470,24 @@ static int __init audit_init(void)
         if (audit_initialized == AUDIT_DISABLED)
                 return 0;
 
-        pr_info("initializing netlink subsys (%s)\n",
-                audit_default ? "enabled" : "disabled");
-        register_pernet_subsys(&audit_net_ops);
+        memset(&auditd_conn, 0, sizeof(auditd_conn));
+        spin_lock_init(&auditd_conn.lock);
 
         skb_queue_head_init(&audit_queue);
         skb_queue_head_init(&audit_retry_queue);
         skb_queue_head_init(&audit_hold_queue);
-        audit_initialized = AUDIT_INITIALIZED;
-        audit_enabled = audit_default;
-        audit_ever_enabled |= !!audit_default;
 
         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                 INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+        pr_info("initializing netlink subsys (%s)\n",
+                audit_default ? "enabled" : "disabled");
+        register_pernet_subsys(&audit_net_ops);
+
+        audit_initialized = AUDIT_INITIALIZED;
+        audit_enabled = audit_default;
+        audit_ever_enabled |= !!audit_default;
+
         kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
         if (IS_ERR(kauditd_task)) {
                 int err = PTR_ERR(kauditd_task);
@@ -1519,20 +1658,16 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
         if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE)))
                 return NULL;
 
-        /* don't ever fail/sleep on these two conditions:
+        /* NOTE: don't ever fail/sleep on these two conditions:
          * 1. auditd generated record - since we need auditd to drain the
          *    queue; also, when we are checking for auditd, compare PIDs using
          *    task_tgid_vnr() since auditd_pid is set in audit_receive_msg()
          *    using a PID anchored in the caller's namespace
-         * 2. audit command message - record types 1000 through 1099 inclusive
-         *    are command messages/records used to manage the kernel subsystem
-         *    and the audit userspace, blocking on these messages could cause
-         *    problems under load so don't do it (note: not all of these
-         *    command types are valid as record types, but it is quicker to
-         *    just check two ints than a series of ints in a if/switch stmt) */
-        if (!((audit_pid && audit_pid == task_tgid_vnr(current)) ||
-              (type >= 1000 && type <= 1099))) {
-                long sleep_time = audit_backlog_wait_time;
+         * 2. generator holding the audit_cmd_mutex - we don't want to block
+         *    while holding the mutex */
+        if (!(auditd_test_task(current) ||
+              (current == __mutex_owner(&audit_cmd_mutex)))) {
+                long stime = audit_backlog_wait_time;
 
                 while (audit_backlog_limit &&
                        (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
@@ -1541,14 +1676,13 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
                         /* sleep if we are allowed and we haven't exhausted our
                          * backlog wait limit */
-                        if ((gfp_mask & __GFP_DIRECT_RECLAIM) &&
-                            (sleep_time > 0)) {
+                        if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) {
                                 DECLARE_WAITQUEUE(wait, current);
 
                                 add_wait_queue_exclusive(&audit_backlog_wait,
                                                          &wait);
                                 set_current_state(TASK_UNINTERRUPTIBLE);
-                                sleep_time = schedule_timeout(sleep_time);
+                                stime = schedule_timeout(stime);
                                 remove_wait_queue(&audit_backlog_wait, &wait);
                         } else {
                                 if (audit_rate_check() && printk_ratelimit())
@@ -2127,15 +2261,27 @@ out:
  */
 void audit_log_end(struct audit_buffer *ab)
 {
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+
         if (!ab)
                 return;
-        if (!audit_rate_check()) {
-                audit_log_lost("rate limit exceeded");
-        } else {
-                skb_queue_tail(&audit_queue, ab->skb);
-                wake_up_interruptible(&kauditd_wait);
+
+        if (audit_rate_check()) {
+                skb = ab->skb;
                 ab->skb = NULL;
-        }
+
+                /* setup the netlink header, see the comments in
+                 * kauditd_send_multicast_skb() for length quirks */
+                nlh = nlmsg_hdr(skb);
+                nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
+
+                /* queue the netlink packet and poke the kauditd thread */
+                skb_queue_tail(&audit_queue, skb);
+                wake_up_interruptible(&kauditd_wait);
+        } else
+                audit_log_lost("rate limit exceeded");
+
         audit_buffer_free(ab);
 }
 
diff --git a/kernel/audit.h b/kernel/audit.h
index ca579880303a..0d87f8ab8778 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -218,7 +218,7 @@ extern void audit_log_name(struct audit_context *context,
                            struct audit_names *n, const struct path *path,
                            int record_num, int *call_panic);
 
-extern int audit_pid;
+extern int auditd_test_task(const struct task_struct *task);
 
 #define AUDIT_INODE_BUCKETS     32
 extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
@@ -250,10 +250,6 @@ struct audit_netlink_list {
 
 int audit_send_list(void *);
 
-struct audit_net {
-        struct sock *nlsk;
-};
-
 extern int selinux_audit_rule_update(void);
 
 extern struct mutex audit_filter_mutex;
@@ -337,14 +333,7 @@ extern u32 audit_sig_sid;
 extern int audit_filter(int msgtype, unsigned int listtype);
 
 #ifdef CONFIG_AUDITSYSCALL
-extern int __audit_signal_info(int sig, struct task_struct *t);
-static inline int audit_signal_info(int sig, struct task_struct *t)
-{
-        if (unlikely((audit_pid && t->tgid == audit_pid) ||
-                     (audit_signals && !audit_dummy_context())))
-                return __audit_signal_info(sig, t);
-        return 0;
-}
+extern int audit_signal_info(int sig, struct task_struct *t);
 extern void audit_filter_inodes(struct task_struct *, struct audit_context *);
 extern struct list_head *audit_killed_trees(void);
 #else
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index d6a8de5f8fa3..1c2333155893 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -762,7 +762,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
         struct audit_entry *e;
         enum audit_state state;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return AUDIT_DISABLED;
 
         rcu_read_lock();
@@ -816,7 +816,7 @@ void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
 {
         struct audit_names *n;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return;
 
         rcu_read_lock();
@@ -2249,26 +2249,27 @@ void __audit_ptrace(struct task_struct *t)
  * If the audit subsystem is being terminated, record the task (pid)
  * and uid that is doing that.
  */
-int __audit_signal_info(int sig, struct task_struct *t)
+int audit_signal_info(int sig, struct task_struct *t)
 {
         struct audit_aux_data_pids *axp;
         struct task_struct *tsk = current;
         struct audit_context *ctx = tsk->audit_context;
         kuid_t uid = current_uid(), t_uid = task_uid(t);
 
-        if (audit_pid && t->tgid == audit_pid) {
-                if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
-                        audit_sig_pid = task_tgid_nr(tsk);
-                        if (uid_valid(tsk->loginuid))
-                                audit_sig_uid = tsk->loginuid;
-                        else
-                                audit_sig_uid = uid;
-                        security_task_getsecid(tsk, &audit_sig_sid);
-                }
-                if (!audit_signals || audit_dummy_context())
-                        return 0;
+        if (auditd_test_task(t) &&
+            (sig == SIGTERM || sig == SIGHUP ||
+             sig == SIGUSR1 || sig == SIGUSR2)) {
+                audit_sig_pid = task_tgid_nr(tsk);
+                if (uid_valid(tsk->loginuid))
+                        audit_sig_uid = tsk->loginuid;
+                else
+                        audit_sig_uid = uid;
+                security_task_getsecid(tsk, &audit_sig_sid);
         }
 
+        if (!audit_signals || audit_dummy_context())
+                return 0;
+
         /* optimize the common case by putting first signal recipient directly
          * in audit_context */
         if (!ctx->target_pid) {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index f45827e205d3..b4f1cb0c5ac7 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1162,12 +1162,12 @@ out:
         LD_ABS_W: /* BPF_R0 = ntohl(*(u32 *) (skb->data + imm32)) */
                 off = IMM;
 load_word:
-                /* BPF_LD + BPD_ABS and BPF_LD + BPF_IND insns are
-                 * only appearing in the programs where ctx ==
-                 * skb. All programs keep 'ctx' in regs[BPF_REG_CTX]
-                 * == BPF_R6, bpf_convert_filter() saves it in BPF_R6,
-                 * internal BPF verifier will check that BPF_R6 ==
-                 * ctx.
+                /* BPF_LD + BPD_ABS and BPF_LD + BPF_IND insns are only
+                 * appearing in the programs where ctx == skb
+                 * (see may_access_skb() in the verifier). All programs
+                 * keep 'ctx' in regs[BPF_REG_CTX] == BPF_R6,
+                 * bpf_convert_filter() saves it in BPF_R6, internal BPF
+                 * verifier will check that BPF_R6 == ctx.
                  *
                  * BPF_ABS and BPF_IND are wrappers of function calls,
                  * so they scratch BPF_R1-BPF_R5 registers, preserve
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index afe5bab376c9..361a69dfe543 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -30,18 +30,12 @@ struct bpf_htab {
                 struct pcpu_freelist freelist;
                 struct bpf_lru lru;
         };
-        void __percpu *extra_elems;
+        struct htab_elem *__percpu *extra_elems;
         atomic_t count; /* number of elements in this hashtable */
         u32 n_buckets;  /* number of hash buckets */
         u32 elem_size;  /* size of each element in bytes */
 };
 
-enum extra_elem_state {
-        HTAB_NOT_AN_EXTRA_ELEM = 0,
-        HTAB_EXTRA_ELEM_FREE,
-        HTAB_EXTRA_ELEM_USED
-};
-
 /* each htab element is struct htab_elem + key + value */
 struct htab_elem {
         union {
@@ -56,7 +50,6 @@ struct htab_elem {
         };
         union {
                 struct rcu_head rcu;
-                enum extra_elem_state state;
                 struct bpf_lru_node lru_node;
         };
         u32 hash;
@@ -77,6 +70,11 @@ static bool htab_is_percpu(const struct bpf_htab *htab)
                 htab->map.map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH;
 }
 
+static bool htab_is_prealloc(const struct bpf_htab *htab)
+{
+        return !(htab->map.map_flags & BPF_F_NO_PREALLOC);
+}
+
 static inline void htab_elem_set_ptr(struct htab_elem *l, u32 key_size,
                                      void __percpu *pptr)
 {
@@ -128,17 +126,20 @@ static struct htab_elem *prealloc_lru_pop(struct bpf_htab *htab, void *key,
 
 static int prealloc_init(struct bpf_htab *htab)
 {
+        u32 num_entries = htab->map.max_entries;
         int err = -ENOMEM, i;
 
-        htab->elems = bpf_map_area_alloc(htab->elem_size *
-                                         htab->map.max_entries);
+        if (!htab_is_percpu(htab) && !htab_is_lru(htab))
+                num_entries += num_possible_cpus();
+
+        htab->elems = bpf_map_area_alloc(htab->elem_size * num_entries);
         if (!htab->elems)
                 return -ENOMEM;
 
         if (!htab_is_percpu(htab))
                 goto skip_percpu_elems;
 
-        for (i = 0; i < htab->map.max_entries; i++) {
+        for (i = 0; i < num_entries; i++) {
                 u32 size = round_up(htab->map.value_size, 8);
                 void __percpu *pptr;
 
@@ -166,11 +167,11 @@ skip_percpu_elems:
         if (htab_is_lru(htab))
                 bpf_lru_populate(&htab->lru, htab->elems,
                                  offsetof(struct htab_elem, lru_node),
-                                 htab->elem_size, htab->map.max_entries);
+                                 htab->elem_size, num_entries);
         else
                 pcpu_freelist_populate(&htab->freelist,
                                        htab->elems + offsetof(struct htab_elem, fnode),
-                                       htab->elem_size, htab->map.max_entries);
+                                       htab->elem_size, num_entries);
 
         return 0;
 
@@ -191,16 +192,22 @@ static void prealloc_destroy(struct bpf_htab *htab)
 
 static int alloc_extra_elems(struct bpf_htab *htab)
 {
-        void __percpu *pptr;
+        struct htab_elem *__percpu *pptr, *l_new;
+        struct pcpu_freelist_node *l;
         int cpu;
 
-        pptr = __alloc_percpu_gfp(htab->elem_size, 8, GFP_USER | __GFP_NOWARN);
+        pptr = __alloc_percpu_gfp(sizeof(struct htab_elem *), 8,
+                                  GFP_USER | __GFP_NOWARN);
         if (!pptr)
                 return -ENOMEM;
 
         for_each_possible_cpu(cpu) {
-                ((struct htab_elem *)per_cpu_ptr(pptr, cpu))->state =
-                        HTAB_EXTRA_ELEM_FREE;
+                l = pcpu_freelist_pop(&htab->freelist);
+                /* pop will succeed, since prealloc_init()
+                 * preallocated extra num_possible_cpus elements
+                 */
+                l_new = container_of(l, struct htab_elem, fnode);
+                *per_cpu_ptr(pptr, cpu) = l_new;
         }
         htab->extra_elems = pptr;
         return 0;
@@ -342,25 +349,25 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 raw_spin_lock_init(&htab->buckets[i].lock);
         }
 
-        if (!percpu && !lru) {
-                /* lru itself can remove the least used element, so
-                 * there is no need for an extra elem during map_update.
-                 */
-                err = alloc_extra_elems(htab);
-                if (err)
-                        goto free_buckets;
-        }
-
         if (prealloc) {
                 err = prealloc_init(htab);
                 if (err)
-                        goto free_extra_elems;
+                        goto free_buckets;
+
+                if (!percpu && !lru) {
+                        /* lru itself can remove the least used element, so
+                         * there is no need for an extra elem during map_update.
+                         */
+                        err = alloc_extra_elems(htab);
+                        if (err)
+                                goto free_prealloc;
+                }
         }
 
         return &htab->map;
 
-free_extra_elems:
-        free_percpu(htab->extra_elems);
+free_prealloc:
+        prealloc_destroy(htab);
 free_buckets:
         bpf_map_area_free(htab->buckets);
 free_htab:
@@ -575,12 +582,7 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 
 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 {
-        if (l->state == HTAB_EXTRA_ELEM_USED) {
-                l->state = HTAB_EXTRA_ELEM_FREE;
-                return;
-        }
-
-        if (!(htab->map.map_flags & BPF_F_NO_PREALLOC)) {
+        if (htab_is_prealloc(htab)) {
                 pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
                 atomic_dec(&htab->count);
@@ -610,47 +612,43 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                          void *value, u32 key_size, u32 hash,
                                          bool percpu, bool onallcpus,
-                                         bool old_elem_exists)
+                                         struct htab_elem *old_elem)
 {
         u32 size = htab->map.value_size;
-        bool prealloc = !(htab->map.map_flags & BPF_F_NO_PREALLOC);
-        struct htab_elem *l_new;
+        bool prealloc = htab_is_prealloc(htab);
+        struct htab_elem *l_new, **pl_new;
         void __percpu *pptr;
-        int err = 0;
 
         if (prealloc) {
-                struct pcpu_freelist_node *l;
+                if (old_elem) {
+                        /* if we're updating the existing element,
+                         * use per-cpu extra elems to avoid freelist_pop/push
+                         */
+                        pl_new = this_cpu_ptr(htab->extra_elems);
+                        l_new = *pl_new;
+                        *pl_new = old_elem;
+                } else {
+                        struct pcpu_freelist_node *l;
 
-                l = pcpu_freelist_pop(&htab->freelist);
-                if (!l)
-                        err = -E2BIG;
-                else
+                        l = pcpu_freelist_pop(&htab->freelist);
+                        if (!l)
+                                return ERR_PTR(-E2BIG);
                         l_new = container_of(l, struct htab_elem, fnode);
-        } else {
-                if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
-                        atomic_dec(&htab->count);
-                        err = -E2BIG;
-                } else {
-                        l_new = kmalloc(htab->elem_size,
-                                        GFP_ATOMIC | __GFP_NOWARN);
-                        if (!l_new)
-                                return ERR_PTR(-ENOMEM);
                 }
-        }
-
-        if (err) {
-                if (!old_elem_exists)
-                        return ERR_PTR(err);
-
-                /* if we're updating the existing element and the hash table
-                 * is full, use per-cpu extra elems
-                 */
-                l_new = this_cpu_ptr(htab->extra_elems);
-                if (l_new->state != HTAB_EXTRA_ELEM_FREE)
-                        return ERR_PTR(-E2BIG);
-                l_new->state = HTAB_EXTRA_ELEM_USED;
         } else {
-                l_new->state = HTAB_NOT_AN_EXTRA_ELEM;
+                if (atomic_inc_return(&htab->count) > htab->map.max_entries)
+                        if (!old_elem) {
+                                /* when map is full and update() is replacing
+                                 * old element, it's ok to allocate, since
+                                 * old element will be freed immediately.
+                                 * Otherwise return an error
+                                 */
+                                atomic_dec(&htab->count);
+                                return ERR_PTR(-E2BIG);
+                        }
+                l_new = kmalloc(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN);
+                if (!l_new)
+                        return ERR_PTR(-ENOMEM);
         }
 
         memcpy(l_new->key, key, key_size);
@@ -731,7 +729,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
                 goto err;
 
         l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
-                                !!l_old);
+                                l_old);
         if (IS_ERR(l_new)) {
                 /* all pre-allocated elements are in use or memory exhausted */
                 ret = PTR_ERR(l_new);
@@ -744,7 +742,8 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
         hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         if (l_old) {
                 hlist_nulls_del_rcu(&l_old->hash_node);
-                free_htab_elem(htab, l_old);
+                if (!htab_is_prealloc(htab))
+                        free_htab_elem(htab, l_old);
         }
         ret = 0;
 err:
@@ -856,7 +855,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
                                 value, onallcpus);
         } else {
                 l_new = alloc_htab_elem(htab, key, value, key_size,
-                                        hash, true, onallcpus, false);
+                                        hash, true, onallcpus, NULL);
                 if (IS_ERR(l_new)) {
                         ret = PTR_ERR(l_new);
                         goto err;
@@ -1024,8 +1023,7 @@ static void delete_all_elements(struct bpf_htab *htab)
 
                 hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
                         hlist_nulls_del_rcu(&l->hash_node);
-                        if (l->state != HTAB_EXTRA_ELEM_USED)
-                                htab_elem_free(htab, l);
+                        htab_elem_free(htab, l);
                 }
         }
 }
@@ -1045,7 +1043,7 @@ static void htab_map_free(struct bpf_map *map)
          * not have executed. Wait for them.
          */
         rcu_barrier();
-        if (htab->map.map_flags & BPF_F_NO_PREALLOC)
+        if (!htab_is_prealloc(htab))
                 delete_all_elements(htab);
         else
                 prealloc_destroy(htab);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7af0dcc5d755..821f9e807de5 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -617,6 +617,14 @@ static void fixup_bpf_calls(struct bpf_prog *prog)
                         if (insn->imm == BPF_FUNC_xdp_adjust_head)
                                 prog->xdp_adjust_head = 1;
                         if (insn->imm == BPF_FUNC_tail_call) {
+                                /* If we tail call into other programs, we
+                                 * cannot make any assumptions since they
+                                 * can be replaced dynamically during runtime
+                                 * in the program array.
+                                 */
+                                prog->cb_access = 1;
+                                prog->xdp_adjust_head = 1;
+
                                 /* mark bpf_tail_call as different opcode
                                  * to avoid conditional branch in
                                  * interpeter for every normal call
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 796b68d00119..a834068a400e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -765,38 +765,56 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
         }
 }
 
-static int check_ptr_alignment(struct bpf_verifier_env *env,
-                               struct bpf_reg_state *reg, int off, int size)
+static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
+                                   int off, int size)
 {
-        if (reg->type != PTR_TO_PACKET && reg->type != PTR_TO_MAP_VALUE_ADJ) {
-                if (off % size != 0) {
-                        verbose("misaligned access off %d size %d\n",
-                                off, size);
-                        return -EACCES;
-                } else {
-                        return 0;
-                }
-        }
-
-        if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
-                /* misaligned access to packet is ok on x86,arm,arm64 */
-                return 0;
-
         if (reg->id && size != 1) {
-                verbose("Unknown packet alignment. Only byte-sized access allowed\n");
+                verbose("Unknown alignment. Only byte-sized access allowed in packet access.\n");
                 return -EACCES;
         }
 
         /* skb->data is NET_IP_ALIGN-ed */
-        if (reg->type == PTR_TO_PACKET &&
-            (NET_IP_ALIGN + reg->off + off) % size != 0) {
+        if ((NET_IP_ALIGN + reg->off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
                         NET_IP_ALIGN, reg->off, off, size);
                 return -EACCES;
         }
+
         return 0;
 }
 
+static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
+                                   int size)
+{
+        if (size != 1) {
+                verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
+                return -EACCES;
+        }
+
+        return 0;
+}
+
+static int check_ptr_alignment(const struct bpf_reg_state *reg,
+                               int off, int size)
+{
+        switch (reg->type) {
+        case PTR_TO_PACKET:
+                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
+                       check_pkt_ptr_alignment(reg, off, size);
+        case PTR_TO_MAP_VALUE_ADJ:
+                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
+                       check_val_ptr_alignment(reg, size);
+        default:
+                if (off % size != 0) {
+                        verbose("misaligned access off %d size %d\n",
+                                off, size);
+                        return -EACCES;
+                }
+
+                return 0;
+        }
+}
+
 /* check whether memory at (regno + off) is accessible for t = (read | write)
  * if t==write, value_regno is a register which value is stored into memory
  * if t==read, value_regno is a register which will receive the value from memory
@@ -818,7 +836,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
         if (size < 0)
                 return size;
 
-        err = check_ptr_alignment(env, reg, off, size);
+        err = check_ptr_alignment(reg, off, size);
         if (err)
                 return err;
 
@@ -1925,6 +1943,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                  * register as unknown.
                  */
                 if (env->allow_ptr_leaks &&
+                    BPF_CLASS(insn->code) == BPF_ALU64 && opcode == BPF_ADD &&
                     (dst_reg->type == PTR_TO_MAP_VALUE ||
                      dst_reg->type == PTR_TO_MAP_VALUE_ADJ))
                         dst_reg->type = PTR_TO_MAP_VALUE_ADJ;
@@ -1973,14 +1992,15 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
 
         for (i = 0; i < MAX_BPF_REG; i++)
                 if (regs[i].type == PTR_TO_PACKET && regs[i].id == dst_reg->id)
-                        regs[i].range = dst_reg->off;
+                        /* keep the maximum range already checked */
+                        regs[i].range = max(regs[i].range, dst_reg->off);
 
         for (i = 0; i < MAX_BPF_STACK; i += BPF_REG_SIZE) {
                 if (state->stack_slot_type[i] != STACK_SPILL)
                         continue;
                 reg = &state->spilled_regs[i / BPF_REG_SIZE];
                 if (reg->type == PTR_TO_PACKET && reg->id == dst_reg->id)
-                        reg->range = dst_reg->off;
+                        reg->range = max(reg->range, dst_reg->off);
         }
 }
 
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 48851327a15e..687f5e0194ef 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2425,11 +2425,12 @@ ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
                 tsk = tsk->group_leader;
 
         /*
-         * Workqueue threads may acquire PF_NO_SETAFFINITY and become
-         * trapped in a cpuset, or RT worker may be born in a cgroup
-         * with no rt_runtime allocated.  Just say no.
+         * kthreads may acquire PF_NO_SETAFFINITY during initialization.
+         * If userland migrates such a kthread to a non-root cgroup, it can
+         * become trapped in a cpuset, or RT kthread may be born in a
+         * cgroup with no rt_runtime allocated.  Just say no.
          */
-        if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) {
+        if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) {
                 ret = -EINVAL;
                 goto out_unlock_rcu;
         }
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index 4544b115f5eb..e2d356dd7581 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -59,7 +59,7 @@ static int get_nodes_in_cpumask(const struct cpumask *mask, nodemask_t *nodemsk)
 struct cpumask *
 irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
 {
-        int n, nodes, vecs_per_node, cpus_per_vec, extra_vecs, curvec;
+        int n, nodes, cpus_per_vec, extra_vecs, curvec;
         int affv = nvecs - affd->pre_vectors - affd->post_vectors;
         int last_affv = affv + affd->pre_vectors;
         nodemask_t nodemsk = NODE_MASK_NONE;
@@ -94,19 +94,21 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
                 goto done;
         }
 
-        /* Spread the vectors per node */
-        vecs_per_node = affv / nodes;
-        /* Account for rounding errors */
-        extra_vecs = affv - (nodes * vecs_per_node);
-
         for_each_node_mask(n, nodemsk) {
-                int ncpus, v, vecs_to_assign = vecs_per_node;
+                int ncpus, v, vecs_to_assign, vecs_per_node;
+
+                /* Spread the vectors per node */
+                vecs_per_node = (affv - (curvec - affd->pre_vectors)) / nodes;
 
                 /* Get the cpus on this node which are in the mask */
                 cpumask_and(nmsk, cpu_online_mask, cpumask_of_node(n));
 
                 /* Calculate the number of cpus per vector */
                 ncpus = cpumask_weight(nmsk);
+                vecs_to_assign = min(vecs_per_node, ncpus);
+
+                /* Account for rounding errors */
+                extra_vecs = ncpus - vecs_to_assign * (ncpus / vecs_to_assign);
 
                 for (v = 0; curvec < last_affv && v < vecs_to_assign;
                      curvec++, v++) {
@@ -115,14 +117,14 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
                         /* Account for extra vectors to compensate rounding errors */
                         if (extra_vecs) {
                                 cpus_per_vec++;
-                                if (!--extra_vecs)
-                                        vecs_per_node++;
+                                --extra_vecs;
                         }
                         irq_spread_init_one(masks + curvec, nmsk, cpus_per_vec);
                 }
 
                 if (curvec >= last_affv)
                         break;
+                --nodes;
         }
 
 done:
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 2f26adea0f84..26db528c1d88 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -20,6 +20,7 @@
 #include <linux/freezer.h>
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
+#include <linux/cgroup.h>
 #include <trace/events/sched.h>
 
 static DEFINE_SPINLOCK(kthread_create_lock);
@@ -225,6 +226,7 @@ static int kthread(void *_create)
 
         ret = -EINTR;
         if (!test_bit(KTHREAD_SHOULD_STOP, &self->flags)) {
+                cgroup_kthread_ready();
                 __kthread_parkme(self);
                 ret = threadfn(data);
         }
@@ -538,6 +540,7 @@ int kthreadd(void *unused)
         set_mems_allowed(node_states[N_MEMORY]);
 
         current->flags |= PF_NOFREEZE;
+        cgroup_init_kthreadd();
 
         for (;;) {
                 set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h
index c2b88490d857..c08fbd2f5ba9 100644
--- a/kernel/locking/lockdep_internals.h
+++ b/kernel/locking/lockdep_internals.h
@@ -46,13 +46,13 @@ enum {
                 (LOCKF_USED_IN_HARDIRQ_READ | LOCKF_USED_IN_SOFTIRQ_READ)
 
 /*
- * CONFIG_PROVE_LOCKING_SMALL is defined for sparc. Sparc requires .text,
+ * CONFIG_LOCKDEP_SMALL is defined for sparc. Sparc requires .text,
  * .data and .bss to fit in required 32MB limit for the kernel. With
- * PROVE_LOCKING we could go over this limit and cause system boot-up problems.
+ * CONFIG_LOCKDEP we could go over this limit and cause system boot-up problems.
  * So, reduce the static allocations for lockdeps related structures so that
  * everything fits in current required size limit.
  */
-#ifdef CONFIG_PROVE_LOCKING_SMALL
+#ifdef CONFIG_LOCKDEP_SMALL
 /*
  * MAX_LOCKDEP_ENTRIES is the maximum number of lock dependencies
  * we track.
diff --git a/kernel/padata.c b/kernel/padata.c
index 05316c9f32da..3202aa17492c 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -186,19 +186,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
 
         reorder = &next_queue->reorder;
 
+        spin_lock(&reorder->lock);
         if (!list_empty(&reorder->list)) {
                 padata = list_entry(reorder->list.next,
                                     struct padata_priv, list);
 
-                spin_lock(&reorder->lock);
                 list_del_init(&padata->list);
                 atomic_dec(&pd->reorder_objects);
-                spin_unlock(&reorder->lock);
 
                 pd->processed++;
 
+                spin_unlock(&reorder->lock);
                 goto out;
         }
+        spin_unlock(&reorder->lock);
 
         if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
                 padata = ERR_PTR(-ENODATA);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 0af928712174..266ddcc1d8bb 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -184,11 +184,17 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
 
         WARN_ON(!task->ptrace || task->parent != current);
 
+        /*
+         * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely.
+         * Recheck state under the lock to close this race.
+         */
         spin_lock_irq(&task->sighand->siglock);
-        if (__fatal_signal_pending(task))
-                wake_up_state(task, __TASK_TRACED);
-        else
-                task->state = TASK_TRACED;
+        if (task->state == __TASK_TRACED) {
+                if (__fatal_signal_pending(task))
+                        wake_up_state(task, __TASK_TRACED);
+                else
+                        task->state = TASK_TRACED;
+        }
         spin_unlock_irq(&task->sighand->siglock);
 }
 
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index a08795e21628..00a45c45beca 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -96,10 +96,10 @@ static DEFINE_STATIC_KEY_FALSE(__sched_clock_stable);
 static int __sched_clock_stable_early = 1;
 
 /*
- * We want: ktime_get_ns() + gtod_offset == sched_clock() + raw_offset
+ * We want: ktime_get_ns() + __gtod_offset == sched_clock() + __sched_clock_offset
  */
-static __read_mostly u64 raw_offset;
-static __read_mostly u64 gtod_offset;
+__read_mostly u64 __sched_clock_offset;
+static __read_mostly u64 __gtod_offset;
 
 struct sched_clock_data {
         u64                     tick_raw;
@@ -131,17 +131,24 @@ static void __set_sched_clock_stable(void)
         /*
          * Attempt to make the (initial) unstable->stable transition continuous.
          */
-        raw_offset = (scd->tick_gtod + gtod_offset) - (scd->tick_raw);
+        __sched_clock_offset = (scd->tick_gtod + __gtod_offset) - (scd->tick_raw);
 
         printk(KERN_INFO "sched_clock: Marking stable (%lld, %lld)->(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
         static_branch_enable(&__sched_clock_stable);
         tick_dep_clear(TICK_DEP_BIT_CLOCK_UNSTABLE);
 }
 
-static void __clear_sched_clock_stable(struct work_struct *work)
+static void __sched_clock_work(struct work_struct *work)
+{
+        static_branch_disable(&__sched_clock_stable);
+}
+
+static DECLARE_WORK(sched_clock_work, __sched_clock_work);
+
+static void __clear_sched_clock_stable(void)
 {
         struct sched_clock_data *scd = this_scd();
 
@@ -154,17 +161,17 @@ static void __clear_sched_clock_stable(struct work_struct *work)
          *
          * Still do what we can.
          */
-        gtod_offset = (scd->tick_raw + raw_offset) - (scd->tick_gtod);
+        __gtod_offset = (scd->tick_raw + __sched_clock_offset) - (scd->tick_gtod);
 
         printk(KERN_INFO "sched_clock: Marking unstable (%lld, %lld)<-(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
-        static_branch_disable(&__sched_clock_stable);
         tick_dep_set(TICK_DEP_BIT_CLOCK_UNSTABLE);
-}
 
-static DECLARE_WORK(sched_clock_work, __clear_sched_clock_stable);
+        if (sched_clock_stable())
+                schedule_work(&sched_clock_work);
+}
 
 void clear_sched_clock_stable(void)
 {
@@ -173,7 +180,7 @@ void clear_sched_clock_stable(void)
         smp_mb(); /* matches sched_clock_init_late() */
 
         if (sched_clock_running == 2)
-                schedule_work(&sched_clock_work);
+                __clear_sched_clock_stable();
 }
 
 void sched_clock_init_late(void)
@@ -214,7 +221,7 @@ static inline u64 wrap_max(u64 x, u64 y)
  */
 static u64 sched_clock_local(struct sched_clock_data *scd)
 {
-        u64 now, clock, old_clock, min_clock, max_clock;
+        u64 now, clock, old_clock, min_clock, max_clock, gtod;
         s64 delta;
 
 again:
@@ -231,9 +238,10 @@ again:
          *                    scd->tick_gtod + TICK_NSEC);
          */
 
-        clock = scd->tick_gtod + gtod_offset + delta;
-        min_clock = wrap_max(scd->tick_gtod, old_clock);
-        max_clock = wrap_max(old_clock, scd->tick_gtod + TICK_NSEC);
+        gtod = scd->tick_gtod + __gtod_offset;
+        clock = gtod + delta;
+        min_clock = wrap_max(gtod, old_clock);
+        max_clock = wrap_max(old_clock, gtod + TICK_NSEC);
 
         clock = wrap_max(clock, min_clock);
         clock = wrap_min(clock, max_clock);
@@ -317,7 +325,7 @@ u64 sched_clock_cpu(int cpu)
         u64 clock;
 
         if (sched_clock_stable())
-                return sched_clock() + raw_offset;
+                return sched_clock() + __sched_clock_offset;
 
         if (unlikely(!sched_clock_running))
                 return 0ull;
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index cd7cd489f739..54c577578da6 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -584,20 +584,14 @@ static int sugov_start(struct cpufreq_policy *policy)
         for_each_cpu(cpu, policy->cpus) {
                 struct sugov_cpu *sg_cpu = &per_cpu(sugov_cpu, cpu);
 
+                memset(sg_cpu, 0, sizeof(*sg_cpu));
                 sg_cpu->sg_policy = sg_policy;
-                if (policy_is_shared(policy)) {
-                        sg_cpu->util = 0;
-                        sg_cpu->max = 0;
-                        sg_cpu->flags = SCHED_CPUFREQ_RT;
-                        sg_cpu->last_update = 0;
-                        sg_cpu->iowait_boost = 0;
-                        sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_shared);
-                } else {
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_single);
-                }
+                sg_cpu->flags = SCHED_CPUFREQ_RT;
+                sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
+                cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
+                                             policy_is_shared(policy) ?
+                                                        sugov_update_shared :
+                                                        sugov_update_single);
         }
         return 0;
 }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index acf0a5a06da7..8c8714fcb53c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2133,9 +2133,12 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
         if (write) {
                 if (*negp)
                         return -EINVAL;
+                if (*lvalp > UINT_MAX)
+                        return -EINVAL;
                 *valp = *lvalp;
         } else {
                 unsigned int val = *valp;
+                *negp = false;
                 *lvalp = (unsigned long)val;
         }
         return 0;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index b9691ee8f6c1..dd3e91d68dc7 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3755,23 +3755,24 @@ static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
         ftrace_probe_registered = 1;
 }
 
-static void __disable_ftrace_function_probe(void)
+static bool __disable_ftrace_function_probe(void)
 {
         int i;
 
         if (!ftrace_probe_registered)
-                return;
+                return false;
 
         for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) {
                 struct hlist_head *hhd = &ftrace_func_hash[i];
                 if (hhd->first)
-                        return;
+                        return false;
         }
 
         /* no more funcs left */
         ftrace_shutdown(&trace_probe_ops, 0);
 
         ftrace_probe_registered = 0;
+        return true;
 }
 
 
@@ -3901,6 +3902,7 @@ static void
 __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                                   void *data, int flags)
 {
+        struct ftrace_ops_hash old_hash_ops;
         struct ftrace_func_entry *rec_entry;
         struct ftrace_func_probe *entry;
         struct ftrace_func_probe *p;
@@ -3912,6 +3914,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         struct hlist_node *tmp;
         char str[KSYM_SYMBOL_LEN];
         int i, ret;
+        bool disabled;
 
         if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
                 func_g.search = NULL;
@@ -3930,6 +3933,10 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
 
         mutex_lock(&trace_probe_ops.func_hash->regex_lock);
 
+        old_hash_ops.filter_hash = old_hash;
+        /* Probes only have filters */
+        old_hash_ops.notrace_hash = NULL;
+
         hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
         if (!hash)
                 /* Hmm, should report this somehow */
@@ -3967,12 +3974,17 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                 }
         }
         mutex_lock(&ftrace_lock);
-        __disable_ftrace_function_probe();
+        disabled = __disable_ftrace_function_probe();
         /*
          * Remove after the disable is called. Otherwise, if the last
          * probe is removed, a null hash means *all enabled*.
          */
         ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+
+        /* still need to update the function call sites */
+        if (ftrace_enabled && !disabled)
+                ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS,
+                                       &old_hash_ops);
         synchronize_sched();
         if (!ret)
                 free_ftrace_hash_rcu(old_hash);
@@ -5554,6 +5566,15 @@ static void clear_ftrace_pids(struct trace_array *tr)
         trace_free_pid_list(pid_list);
 }
 
+void ftrace_clear_pids(struct trace_array *tr)
+{
+        mutex_lock(&ftrace_lock);
+
+        clear_ftrace_pids(tr);
+
+        mutex_unlock(&ftrace_lock);
+}
+
 static void ftrace_pid_reset(struct trace_array *tr)
 {
         mutex_lock(&ftrace_lock);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 96fc3c043ad6..ca47a4fa2986 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3405,11 +3405,23 @@ EXPORT_SYMBOL_GPL(ring_buffer_iter_reset);
 int ring_buffer_iter_empty(struct ring_buffer_iter *iter)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
+        struct buffer_page *reader;
+        struct buffer_page *head_page;
+        struct buffer_page *commit_page;
+        unsigned commit;
 
         cpu_buffer = iter->cpu_buffer;
 
-        return iter->head_page == cpu_buffer->commit_page &&
-                iter->head == rb_commit_index(cpu_buffer);
+        /* Remember, trace recording is off when iterator is in use */
+        reader = cpu_buffer->reader_page;
+        head_page = cpu_buffer->head_page;
+        commit_page = cpu_buffer->commit_page;
+        commit = rb_page_commit(commit_page);
+
+        return ((iter->head_page == commit_page && iter->head == commit) ||
+                (iter->head_page == reader && commit_page == head_page &&
+                 head_page->read == commit &&
+                 iter->head == rb_page_commit(cpu_buffer->reader_page)));
 }
 EXPORT_SYMBOL_GPL(ring_buffer_iter_empty);
 
@@ -4826,9 +4838,9 @@ static __init int test_ringbuffer(void)
                 rb_data[cpu].cnt = cpu;
                 rb_threads[cpu] = kthread_create(rb_test, &rb_data[cpu],
                                                  "rbtester/%d", cpu);
-                if (WARN_ON(!rb_threads[cpu])) {
+                if (WARN_ON(IS_ERR(rb_threads[cpu]))) {
                         pr_cont("FAILED\n");
-                        ret = -1;
+                        ret = PTR_ERR(rb_threads[cpu]);
                         goto out_free;
                 }
 
@@ -4838,9 +4850,9 @@ static __init int test_ringbuffer(void)
 
         /* Now create the rb hammer! */
         rb_hammer = kthread_run(rb_hammer_test, NULL, "rbhammer");
-        if (WARN_ON(!rb_hammer)) {
+        if (WARN_ON(IS_ERR(rb_hammer))) {
                 pr_cont("FAILED\n");
-                ret = -1;
+                ret = PTR_ERR(rb_hammer);
                 goto out_free;
         }
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index f35109514a01..0ad75e9698f6 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6733,11 +6733,13 @@ ftrace_trace_snapshot_callback(struct ftrace_hash *hash,
                 return ret;
 
  out_reg:
-        ret = register_ftrace_function_probe(glob, ops, count);
+        ret = alloc_snapshot(&global_trace);
+        if (ret < 0)
+                goto out;
 
-        if (ret >= 0)
-                alloc_snapshot(&global_trace);
+        ret = register_ftrace_function_probe(glob, ops, count);
 
+ out:
         return ret < 0 ? ret : 0;
 }
 
@@ -7402,6 +7404,7 @@ static int instance_rmdir(const char *name)
 
         tracing_set_nop(tr);
         event_trace_del_tracer(tr);
+        ftrace_clear_pids(tr);
         ftrace_destroy_function_files(tr);
         tracefs_remove_recursive(tr->dir);
         free_trace_buffers(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index ae1cce91fead..d19d52d600d6 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -896,6 +896,7 @@ int using_ftrace_ops_list_func(void);
 void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d_tracer);
 void ftrace_init_tracefs_toplevel(struct trace_array *tr,
                                   struct dentry *d_tracer);
+void ftrace_clear_pids(struct trace_array *tr);
 #else
 static inline int ftrace_trace_task(struct trace_array *tr)
 {
@@ -914,6 +915,7 @@ ftrace_init_global_array_ops(struct trace_array *tr) { }
 static inline void ftrace_reset_array_ops(struct trace_array *tr) { }
 static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d) { }
 static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
+static inline void ftrace_clear_pids(struct trace_array *tr) { }
 /* ftace_func_t type is not defined, use macro instead of static inline */
 #define ftrace_init_array_ops(tr, func) do { } while (0)
 #endif /* CONFIG_FUNCTION_TRACER */
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 97d62c2da6c2..fa16c0f82d6e 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1103,9 +1103,6 @@ config PROVE_LOCKING
 
          For more details, see Documentation/locking/lockdep-design.txt.
 
-config PROVE_LOCKING_SMALL
-        bool
-
 config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
@@ -1114,6 +1111,9 @@ config LOCKDEP
         select KALLSYMS
         select KALLSYMS_ALL
 
+config LOCKDEP_SMALL
+        bool
+
 config LOCK_STAT
         bool "Lock usage statistics"
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index e68604ae3ced..60abc44385b7 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -786,6 +786,68 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
 }
 EXPORT_SYMBOL(iov_iter_advance);
 
+void iov_iter_revert(struct iov_iter *i, size_t unroll)
+{
+        if (!unroll)
+                return;
+        i->count += unroll;
+        if (unlikely(i->type & ITER_PIPE)) {
+                struct pipe_inode_info *pipe = i->pipe;
+                int idx = i->idx;
+                size_t off = i->iov_offset;
+                while (1) {
+                        size_t n = off - pipe->bufs[idx].offset;
+                        if (unroll < n) {
+                                off -= (n - unroll);
+                                break;
+                        }
+                        unroll -= n;
+                        if (!unroll && idx == i->start_idx) {
+                                off = 0;
+                                break;
+                        }
+                        if (!idx--)
+                                idx = pipe->buffers - 1;
+                        off = pipe->bufs[idx].offset + pipe->bufs[idx].len;
+                }
+                i->iov_offset = off;
+                i->idx = idx;
+                pipe_truncate(i);
+                return;
+        }
+        if (unroll <= i->iov_offset) {
+                i->iov_offset -= unroll;
+                return;
+        }
+        unroll -= i->iov_offset;
+        if (i->type & ITER_BVEC) {
+                const struct bio_vec *bvec = i->bvec;
+                while (1) {
+                        size_t n = (--bvec)->bv_len;
+                        i->nr_segs++;
+                        if (unroll <= n) {
+                                i->bvec = bvec;
+                                i->iov_offset = n - unroll;
+                                return;
+                        }
+                        unroll -= n;
+                }
+        } else { /* same logics for iovec and kvec */
+                const struct iovec *iov = i->iov;
+                while (1) {
+                        size_t n = (--iov)->iov_len;
+                        i->nr_segs++;
+                        if (unroll <= n) {
+                                i->iov = iov;
+                                i->iov_offset = n - unroll;
+                                return;
+                        }
+                        unroll -= n;
+                }
+        }
+}
+EXPORT_SYMBOL(iov_iter_revert);
+
 /*
  * Return the count of just the current iov_iter segment.
  */
@@ -839,6 +901,7 @@ void iov_iter_pipe(struct iov_iter *i, int direction,
         i->idx = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
         i->iov_offset = 0;
         i->count = count;
+        i->start_idx = i->idx;
 }
 EXPORT_SYMBOL(iov_iter_pipe);
 
diff --git a/lib/syscall.c b/lib/syscall.c
index 17d5ff5fa6a3..2c6cd1b5c3ea 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
+                *sp = *pc = 0;
                 *callno = -1;
                 return 0;
         }
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 0b1d3140fbb8..a25c9763fce1 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -20,6 +20,7 @@
 #include <linux/string.h>
 #include <linux/uaccess.h>
 #include <linux/module.h>
+#include <linux/kasan.h>
 
 /*
  * Note: test functions are marked noinline so that their names appear in
@@ -474,6 +475,12 @@ static noinline void __init use_after_scope_test(void)
 
 static int __init kmalloc_tests_init(void)
 {
+        /*
+         * Temporarily enable multi-shot mode. Otherwise, we'd only get a
+         * report for the first case.
+         */
+        bool multishot = kasan_save_enable_multi_shot();
+
         kmalloc_oob_right();
         kmalloc_oob_left();
         kmalloc_node_oob_right();
@@ -499,6 +506,9 @@ static int __init kmalloc_tests_init(void)
         ksize_unpoisons_memory();
         copy_user_test();
         use_after_scope_test();
+
+        kasan_restore_multi_shot(multishot);
+
         return -EAGAIN;
 }
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1ebc93e179f3..f3c4f9d22821 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -240,18 +240,18 @@ static ssize_t defrag_store(struct kobject *kobj,
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
                 set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
-        } else if (!memcmp("defer", buf,
-                    min(sizeof("defer")-1, count))) {
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
-                set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
         } else if (!memcmp("defer+madvise", buf,
                     min(sizeof("defer+madvise")-1, count))) {
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
                 set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+        } else if (!memcmp("defer", buf,
+                    min(sizeof("defer")-1, count))) {
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+                set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
         } else if (!memcmp("madvise", buf,
                            min(sizeof("madvise")-1, count))) {
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
@@ -1568,8 +1568,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                 deactivate_page(page);
 
         if (pmd_young(orig_pmd) || pmd_dirty(orig_pmd)) {
-                orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
-                        tlb->fullmm);
+                pmdp_invalidate(vma, addr, pmd);
                 orig_pmd = pmd_mkold(orig_pmd);
                 orig_pmd = pmd_mkclean(orig_pmd);
 
@@ -1724,37 +1723,69 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 {
         struct mm_struct *mm = vma->vm_mm;
         spinlock_t *ptl;
-        int ret = 0;
+        pmd_t entry;
+        bool preserve_write;
+        int ret;
 
         ptl = __pmd_trans_huge_lock(pmd, vma);
-        if (ptl) {
-                pmd_t entry;
-                bool preserve_write = prot_numa && pmd_write(*pmd);
-                ret = 1;
+        if (!ptl)
+                return 0;
 
-                /*
-                 * Avoid trapping faults against the zero page. The read-only
-                 * data is likely to be read-cached on the local CPU and
-                 * local/remote hits to the zero page are not interesting.
-                 */
-                if (prot_numa && is_huge_zero_pmd(*pmd)) {
-                        spin_unlock(ptl);
-                        return ret;
-                }
+        preserve_write = prot_numa && pmd_write(*pmd);
+        ret = 1;
 
-                if (!prot_numa || !pmd_protnone(*pmd)) {
-                        entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
-                        entry = pmd_modify(entry, newprot);
-                        if (preserve_write)
-                                entry = pmd_mk_savedwrite(entry);
-                        ret = HPAGE_PMD_NR;
-                        set_pmd_at(mm, addr, pmd, entry);
-                        BUG_ON(vma_is_anonymous(vma) && !preserve_write &&
-                                        pmd_write(entry));
-                }
-                spin_unlock(ptl);
-        }
+        /*
+         * Avoid trapping faults against the zero page. The read-only
+         * data is likely to be read-cached on the local CPU and
+         * local/remote hits to the zero page are not interesting.
+         */
+        if (prot_numa && is_huge_zero_pmd(*pmd))
+                goto unlock;
+
+        if (prot_numa && pmd_protnone(*pmd))
+                goto unlock;
+
+        /*
+         * In case prot_numa, we are under down_read(mmap_sem). It's critical
+         * to not clear pmd intermittently to avoid race with MADV_DONTNEED
+         * which is also under down_read(mmap_sem):
+         *
+         *      CPU0:                           CPU1:
+         *                              change_huge_pmd(prot_numa=1)
+         *                               pmdp_huge_get_and_clear_notify()
+         * madvise_dontneed()
+         *  zap_pmd_range()
+         *   pmd_trans_huge(*pmd) == 0 (without ptl)
+         *   // skip the pmd
+         *                               set_pmd_at();
+         *                               // pmd is re-established
+         *
+         * The race makes MADV_DONTNEED miss the huge pmd and don't clear it
+         * which may break userspace.
+         *
+         * pmdp_invalidate() is required to make sure we don't miss
+         * dirty/young flags set by hardware.
+         */
+        entry = *pmd;
+        pmdp_invalidate(vma, addr, pmd);
 
+        /*
+         * Recover dirty/young flags.  It relies on pmdp_invalidate to not
+         * corrupt them.
+         */
+        if (pmd_dirty(*pmd))
+                entry = pmd_mkdirty(entry);
+        if (pmd_young(*pmd))
+                entry = pmd_mkyoung(entry);
+
+        entry = pmd_modify(entry, newprot);
+        if (preserve_write)
+                entry = pmd_mk_savedwrite(entry);
+        ret = HPAGE_PMD_NR;
+        set_pmd_at(mm, addr, pmd, entry);
+        BUG_ON(vma_is_anonymous(vma) && !preserve_write && pmd_write(entry));
+unlock:
+        spin_unlock(ptl);
         return ret;
 }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 3d0aab9ee80d..e5828875f7bb 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4403,7 +4403,9 @@ int hugetlb_reserve_pages(struct inode *inode,
         return 0;
 out_err:
         if (!vma || vma->vm_flags & VM_MAYSHARE)
-                region_abort(resv_map, from, to);
+                /* Don't call region_abort if region_chg failed */
+                if (chg >= 0)
+                        region_abort(resv_map, from, to);
         if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
                 kref_put(&resv_map->refs, resv_map_release);
         return ret;
@@ -4651,6 +4653,7 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 {
         struct page *page = NULL;
         spinlock_t *ptl;
+        pte_t pte;
 retry:
         ptl = pmd_lockptr(mm, pmd);
         spin_lock(ptl);
@@ -4660,12 +4663,13 @@ retry:
          */
         if (!pmd_huge(*pmd))
                 goto out;
-        if (pmd_present(*pmd)) {
+        pte = huge_ptep_get((pte_t *)pmd);
+        if (pte_present(pte)) {
                 page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT);
                 if (flags & FOLL_GET)
                         get_page(page);
         } else {
-                if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
+                if (is_hugetlb_entry_migration(pte)) {
                         spin_unlock(ptl);
                         __migration_entry_wait(mm, (pte_t *)pmd, ptl);
                         goto retry;
diff --git a/mm/internal.h b/mm/internal.h
index ccfc2a2969f4..266efaeaa370 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -481,6 +481,13 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
 enum ttu_flags;
 struct tlbflush_unmap_batch;
 
+
+/*
+ * only for MM internal work items which do not depend on
+ * any allocations or locks which might depend on allocations
+ */
+extern struct workqueue_struct *mm_percpu_wq;
+
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
 void try_to_unmap_flush(void);
 void try_to_unmap_flush_dirty(void);
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 1c260e6b3b3c..dd2dea8eb077 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -96,11 +96,6 @@ static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
                 << KASAN_SHADOW_SCALE_SHIFT);
 }
 
-static inline bool kasan_report_enabled(void)
-{
-        return !current->kasan_depth;
-}
-
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip);
 void kasan_report_double_free(struct kmem_cache *cache, void *object,
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index f479365530b6..ab42a0803f16 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -13,7 +13,9 @@
  *
  */
 
+#include <linux/bitops.h>
 #include <linux/ftrace.h>
+#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
@@ -293,6 +295,40 @@ static void kasan_report_error(struct kasan_access_info *info)
         kasan_end_report(&flags);
 }
 
+static unsigned long kasan_flags;
+
+#define KASAN_BIT_REPORTED      0
+#define KASAN_BIT_MULTI_SHOT    1
+
+bool kasan_save_enable_multi_shot(void)
+{
+        return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
+
+void kasan_restore_multi_shot(bool enabled)
+{
+        if (!enabled)
+                clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
+
+static int __init kasan_set_multi_shot(char *str)
+{
+        set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+        return 1;
+}
+__setup("kasan_multi_shot", kasan_set_multi_shot);
+
+static inline bool kasan_report_enabled(void)
+{
+        if (current->kasan_depth)
+                return false;
+        if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
+                return true;
+        return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
+}
+
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip)
 {
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 26c874e90b12..20036d4f9f13 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1416,7 +1416,7 @@ static void kmemleak_scan(void)
         /* data/bss scanning */
         scan_large_block(_sdata, _edata);
         scan_large_block(__bss_start, __bss_stop);
-        scan_large_block(__start_data_ro_after_init, __end_data_ro_after_init);
+        scan_large_block(__start_ro_after_init, __end_ro_after_init);
 
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 75b2745bac41..37d0b334bfe9 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1529,7 +1529,6 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
 COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
                        compat_ulong_t, maxnode)
 {
-        long err = 0;
         unsigned long __user *nm = NULL;
         unsigned long nr_bits, alloc_size;
         DECLARE_BITMAP(bm, MAX_NUMNODES);
@@ -1538,14 +1537,13 @@ COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
         alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
         if (nmask) {
-                err = compat_get_bitmap(bm, nmask, nr_bits);
+                if (compat_get_bitmap(bm, nmask, nr_bits))
+                        return -EFAULT;
                 nm = compat_alloc_user_space(alloc_size);
-                err |= copy_to_user(nm, bm, alloc_size);
+                if (copy_to_user(nm, bm, alloc_size))
+                        return -EFAULT;
         }
 
-        if (err)
-                return -EFAULT;
-
         return sys_set_mempolicy(mode, nm, nr_bits+1);
 }
 
@@ -1553,7 +1551,6 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
                        compat_ulong_t, mode, compat_ulong_t __user *, nmask,
                        compat_ulong_t, maxnode, compat_ulong_t, flags)
 {
-        long err = 0;
         unsigned long __user *nm = NULL;
         unsigned long nr_bits, alloc_size;
         nodemask_t bm;
@@ -1562,14 +1559,13 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
         alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
         if (nmask) {
-                err = compat_get_bitmap(nodes_addr(bm), nmask, nr_bits);
+                if (compat_get_bitmap(nodes_addr(bm), nmask, nr_bits))
+                        return -EFAULT;
                 nm = compat_alloc_user_space(alloc_size);
-                err |= copy_to_user(nm, nodes_addr(bm), alloc_size);
+                if (copy_to_user(nm, nodes_addr(bm), alloc_size))
+                        return -EFAULT;
         }
 
-        if (err)
-                return -EFAULT;
-
         return sys_mbind(start, len, mode, nm, nr_bits+1, flags);
 }
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 9a0897a14d37..738f1d5f8350 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -184,9 +184,9 @@ void putback_movable_pages(struct list_head *l)
                         unlock_page(page);
                         put_page(page);
                 } else {
-                        putback_lru_page(page);
                         dec_node_page_state(page, NR_ISOLATED_ANON +
                                         page_is_file_cache(page));
+                        putback_lru_page(page);
                 }
         }
 }
@@ -209,8 +209,11 @@ static int remove_migration_pte(struct page *page, struct vm_area_struct *vma,
 
         VM_BUG_ON_PAGE(PageTail(page), page);
         while (page_vma_mapped_walk(&pvmw)) {
-                new = page - pvmw.page->index +
-                        linear_page_index(vma, pvmw.address);
+                if (PageKsm(page))
+                        new = page;
+                else
+                        new = page - pvmw.page->index +
+                                linear_page_index(vma, pvmw.address);
 
                 get_page(new);
                 pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6cbde310abed..07efbc3a8656 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1090,10 +1090,10 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 {
         int migratetype = 0;
         int batch_free = 0;
-        unsigned long nr_scanned, flags;
+        unsigned long nr_scanned;
         bool isolated_pageblocks;
 
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
         isolated_pageblocks = has_isolate_pageblock(zone);
         nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
         if (nr_scanned)
@@ -1142,7 +1142,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                         trace_mm_page_pcpu_drain(page, 0, mt);
                 } while (--count && --batch_free && !list_empty(list));
         }
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 
 static void free_one_page(struct zone *zone,
@@ -1150,9 +1150,8 @@ static void free_one_page(struct zone *zone,
                                 unsigned int order,
                                 int migratetype)
 {
-        unsigned long nr_scanned, flags;
-        spin_lock_irqsave(&zone->lock, flags);
-        __count_vm_events(PGFREE, 1 << order);
+        unsigned long nr_scanned;
+        spin_lock(&zone->lock);
         nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
         if (nr_scanned)
                 __mod_node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED, -nr_scanned);
@@ -1162,7 +1161,7 @@ static void free_one_page(struct zone *zone,
                 migratetype = get_pfnblock_migratetype(page, pfn);
         }
         __free_one_page(page, pfn, zone, order, migratetype);
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 
 static void __meminit __init_single_page(struct page *page, unsigned long pfn,
@@ -1240,6 +1239,7 @@ void __meminit reserve_bootmem_region(phys_addr_t start, phys_addr_t end)
 
 static void __free_pages_ok(struct page *page, unsigned int order)
 {
+        unsigned long flags;
         int migratetype;
         unsigned long pfn = page_to_pfn(page);
 
@@ -1247,7 +1247,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
                 return;
 
         migratetype = get_pfnblock_migratetype(page, pfn);
+        local_irq_save(flags);
+        __count_vm_events(PGFREE, 1 << order);
         free_one_page(page_zone(page), page, pfn, order, migratetype);
+        local_irq_restore(flags);
 }
 
 static void __init __free_pages_boot_core(struct page *page, unsigned int order)
@@ -2219,9 +2222,8 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
                         int migratetype, bool cold)
 {
         int i, alloced = 0;
-        unsigned long flags;
 
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
         for (i = 0; i < count; ++i) {
                 struct page *page = __rmqueue(zone, order, migratetype);
                 if (unlikely(page == NULL))
@@ -2257,7 +2259,7 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
          * pages added to the pcp list.
          */
         __mod_zone_page_state(zone, NR_FREE_PAGES, -(i << order));
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
         return alloced;
 }
 
@@ -2373,6 +2375,13 @@ void drain_all_pages(struct zone *zone)
          */
         static cpumask_t cpus_with_pcps;
 
+        /*
+         * Make sure nobody triggers this path before mm_percpu_wq is fully
+         * initialized.
+         */
+        if (WARN_ON_ONCE(!mm_percpu_wq))
+                return;
+
         /* Workqueues cannot recurse */
         if (current->flags & PF_WQ_WORKER)
                 return;
@@ -2422,7 +2431,7 @@ void drain_all_pages(struct zone *zone)
         for_each_cpu(cpu, &cpus_with_pcps) {
                 struct work_struct *work = per_cpu_ptr(&pcpu_drain, cpu);
                 INIT_WORK(work, drain_local_pages_wq);
-                schedule_work_on(cpu, work);
+                queue_work_on(cpu, mm_percpu_wq, work);
         }
         for_each_cpu(cpu, &cpus_with_pcps)
                 flush_work(per_cpu_ptr(&pcpu_drain, cpu));
@@ -2478,20 +2487,17 @@ void free_hot_cold_page(struct page *page, bool cold)
 {
         struct zone *zone = page_zone(page);
         struct per_cpu_pages *pcp;
+        unsigned long flags;
         unsigned long pfn = page_to_pfn(page);
         int migratetype;
 
-        if (in_interrupt()) {
-                __free_pages_ok(page, 0);
-                return;
-        }
-
         if (!free_pcp_prepare(page))
                 return;
 
         migratetype = get_pfnblock_migratetype(page, pfn);
         set_pcppage_migratetype(page, migratetype);
-        preempt_disable();
+        local_irq_save(flags);
+        __count_vm_event(PGFREE);
 
         /*
          * We only track unmovable, reclaimable and movable on pcp lists.
@@ -2508,7 +2514,6 @@ void free_hot_cold_page(struct page *page, bool cold)
                 migratetype = MIGRATE_MOVABLE;
         }
 
-        __count_vm_event(PGFREE);
         pcp = &this_cpu_ptr(zone->pageset)->pcp;
         if (!cold)
                 list_add(&page->lru, &pcp->lists[migratetype]);
@@ -2522,7 +2527,7 @@ void free_hot_cold_page(struct page *page, bool cold)
         }
 
 out:
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /*
@@ -2647,8 +2652,6 @@ static struct page *__rmqueue_pcplist(struct zone *zone, int migratetype,
 {
         struct page *page;
 
-        VM_BUG_ON(in_interrupt());
-
         do {
                 if (list_empty(list)) {
                         pcp->count += rmqueue_bulk(zone, 0,
@@ -2679,8 +2682,9 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
         struct list_head *list;
         bool cold = ((gfp_flags & __GFP_COLD) != 0);
         struct page *page;
+        unsigned long flags;
 
-        preempt_disable();
+        local_irq_save(flags);
         pcp = &this_cpu_ptr(zone->pageset)->pcp;
         list = &pcp->lists[migratetype];
         page = __rmqueue_pcplist(zone,  migratetype, cold, pcp, list);
@@ -2688,7 +2692,7 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
                 __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order);
                 zone_statistics(preferred_zone, zone);
         }
-        preempt_enable();
+        local_irq_restore(flags);
         return page;
 }
 
@@ -2704,7 +2708,7 @@ struct page *rmqueue(struct zone *preferred_zone,
         unsigned long flags;
         struct page *page;
 
-        if (likely(order == 0) && !in_interrupt()) {
+        if (likely(order == 0)) {
                 page = rmqueue_pcplist(preferred_zone, zone, order,
                                 gfp_flags, migratetype);
                 goto out;
@@ -4519,13 +4523,13 @@ void show_free_areas(unsigned int filter, nodemask_t *nodemask)
                         K(node_page_state(pgdat, NR_FILE_MAPPED)),
                         K(node_page_state(pgdat, NR_FILE_DIRTY)),
                         K(node_page_state(pgdat, NR_WRITEBACK)),
+                        K(node_page_state(pgdat, NR_SHMEM)),
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
                         K(node_page_state(pgdat, NR_SHMEM_THPS) * HPAGE_PMD_NR),
                         K(node_page_state(pgdat, NR_SHMEM_PMDMAPPED)
                                         * HPAGE_PMD_NR),
                         K(node_page_state(pgdat, NR_ANON_THPS) * HPAGE_PMD_NR),
 #endif
-                        K(node_page_state(pgdat, NR_SHMEM)),
                         K(node_page_state(pgdat, NR_WRITEBACK_TEMP)),
                         K(node_page_state(pgdat, NR_UNSTABLE_NFS)),
                         node_page_state(pgdat, NR_PAGES_SCANNED),
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index c4c9def8ffea..de9c40d7304a 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -111,12 +111,8 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
         if (pvmw->pmd && !pvmw->pte)
                 return not_found(pvmw);
 
-        /* Only for THP, seek to next pte entry makes sense */
-        if (pvmw->pte) {
-                if (!PageTransHuge(pvmw->page) || PageHuge(pvmw->page))
-                        return not_found(pvmw);
+        if (pvmw->pte)
                 goto next_pte;
-        }
 
         if (unlikely(PageHuge(pvmw->page))) {
                 /* when pud is not present, pte will be NULL */
@@ -165,9 +161,14 @@ restart:
         while (1) {
                 if (check_pte(pvmw))
                         return true;
-next_pte:       do {
+next_pte:
+                /* Seek to next pte only makes sense for THP */
+                if (!PageTransHuge(pvmw->page) || PageHuge(pvmw->page))
+                        return not_found(pvmw);
+                do {
                         pvmw->address += PAGE_SIZE;
-                        if (pvmw->address >=
+                        if (pvmw->address >= pvmw->vma->vm_end ||
+                            pvmw->address >=
                                         __vma_address(pvmw->page, pvmw->vma) +
                                         hpage_nr_pages(pvmw->page) * PAGE_SIZE)
                                 return not_found(pvmw);
diff --git a/mm/rmap.c b/mm/rmap.c
index 49ed681ccc7b..f6838015810f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1159,7 +1159,7 @@ void page_add_file_rmap(struct page *page, bool compound)
                         goto out;
         }
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, nr);
-        mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, nr);
 out:
         unlock_page_memcg(page);
 }
@@ -1199,7 +1199,7 @@ static void page_remove_file_rmap(struct page *page, bool compound)
          * pte lock(a spinlock) is held, which implies preemption disabled.
          */
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, -nr);
-        mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, -nr);
 
         if (unlikely(PageMlocked(page)))
                 clear_page_mlock(page);
diff --git a/mm/swap.c b/mm/swap.c
index c4910f14f957..5dabf444d724 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -670,30 +670,19 @@ static void lru_add_drain_per_cpu(struct work_struct *dummy)
 
 static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
 
-/*
- * lru_add_drain_wq is used to do lru_add_drain_all() from a WQ_MEM_RECLAIM
- * workqueue, aiding in getting memory freed.
- */
-static struct workqueue_struct *lru_add_drain_wq;
-
-static int __init lru_init(void)
-{
-        lru_add_drain_wq = alloc_workqueue("lru-add-drain", WQ_MEM_RECLAIM, 0);
-
-        if (WARN(!lru_add_drain_wq,
-                "Failed to create workqueue lru_add_drain_wq"))
-                return -ENOMEM;
-
-        return 0;
-}
-early_initcall(lru_init);
-
 void lru_add_drain_all(void)
 {
         static DEFINE_MUTEX(lock);
         static struct cpumask has_work;
         int cpu;
 
+        /*
+         * Make sure nobody triggers this path before mm_percpu_wq is fully
+         * initialized.
+         */
+        if (WARN_ON(!mm_percpu_wq))
+                return;
+
         mutex_lock(&lock);
         get_online_cpus();
         cpumask_clear(&has_work);
@@ -707,7 +696,7 @@ void lru_add_drain_all(void)
                     pagevec_count(&per_cpu(lru_deactivate_pvecs, cpu)) ||
                     need_activate_page_drain(cpu)) {
                         INIT_WORK(work, lru_add_drain_per_cpu);
-                        queue_work_on(cpu, lru_add_drain_wq, work);
+                        queue_work_on(cpu, mm_percpu_wq, work);
                         cpumask_set_cpu(cpu, &has_work);
                 }
         }
diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
index 310ac0b8f974..ac6318a064d3 100644
--- a/mm/swap_cgroup.c
+++ b/mm/swap_cgroup.c
@@ -201,6 +201,8 @@ void swap_cgroup_swapoff(int type)
                         struct page *page = map[i];
                         if (page)
                                 __free_page(page);
+                        if (!(i % SWAP_CLUSTER_MAX))
+                                cond_resched();
                 }
                 vfree(map);
         }
diff --git a/mm/swap_slots.c b/mm/swap_slots.c
index 7ebb23836f68..b1ccb58ad397 100644
--- a/mm/swap_slots.c
+++ b/mm/swap_slots.c
@@ -267,8 +267,6 @@ int free_swap_slot(swp_entry_t entry)
 {
         struct swap_slots_cache *cache;
 
-        WARN_ON_ONCE(!swap_slot_cache_initialized);
-
         cache = &get_cpu_var(swp_slots);
         if (use_swap_slot_cache && cache->slots_ret) {
                 spin_lock_irq(&cache->free_lock);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index b1947f0cbee2..5a4f5c5a31e8 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1552,7 +1552,6 @@ static const struct file_operations proc_vmstat_file_operations = {
 #endif /* CONFIG_PROC_FS */
 
 #ifdef CONFIG_SMP
-static struct workqueue_struct *vmstat_wq;
 static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
 int sysctl_stat_interval __read_mostly = HZ;
 
@@ -1623,7 +1622,7 @@ static void vmstat_update(struct work_struct *w)
                  * to occur in the future. Keep on running the
                  * update worker thread.
                  */
-                queue_delayed_work_on(smp_processor_id(), vmstat_wq,
+                queue_delayed_work_on(smp_processor_id(), mm_percpu_wq,
                                 this_cpu_ptr(&vmstat_work),
                                 round_jiffies_relative(sysctl_stat_interval));
         }
@@ -1702,7 +1701,7 @@ static void vmstat_shepherd(struct work_struct *w)
                 struct delayed_work *dw = &per_cpu(vmstat_work, cpu);
 
                 if (!delayed_work_pending(dw) && need_update(cpu))
-                        queue_delayed_work_on(cpu, vmstat_wq, dw, 0);
+                        queue_delayed_work_on(cpu, mm_percpu_wq, dw, 0);
         }
         put_online_cpus();
 
@@ -1718,7 +1717,6 @@ static void __init start_shepherd_timer(void)
                 INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
                         vmstat_update);
 
-        vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
         schedule_delayed_work(&shepherd,
                 round_jiffies_relative(sysctl_stat_interval));
 }
@@ -1764,11 +1762,15 @@ static int vmstat_cpu_dead(unsigned int cpu)
 
 #endif
 
-static int __init setup_vmstat(void)
+struct workqueue_struct *mm_percpu_wq;
+
+void __init init_mm_internals(void)
 {
-#ifdef CONFIG_SMP
-        int ret;
+        int ret __maybe_unused;
+
+        mm_percpu_wq = alloc_workqueue("mm_percpu_wq", WQ_MEM_RECLAIM, 0);
 
+#ifdef CONFIG_SMP
         ret = cpuhp_setup_state_nocalls(CPUHP_MM_VMSTAT_DEAD, "mm/vmstat:dead",
                                         NULL, vmstat_cpu_dead);
         if (ret < 0)
@@ -1792,9 +1794,7 @@ static int __init setup_vmstat(void)
         proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
         proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
 #endif
-        return 0;
 }
-module_init(setup_vmstat)
 
 #if defined(CONFIG_DEBUG_FS) && defined(CONFIG_COMPACTION)
 
diff --git a/mm/workingset.c b/mm/workingset.c
index ac839fca0e76..eda05c71fa49 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -532,7 +532,7 @@ static int __init workingset_init(void)
         pr_info("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
                timestamp_bits, max_order, bucket_order);
 
-        ret = list_lru_init_key(&shadow_nodes, &shadow_nodes_key);
+        ret = __list_lru_init(&shadow_nodes, true, &shadow_nodes_key);
         if (ret)
                 goto err;
         ret = register_shrinker(&workingset_shadow_shrinker);
diff --git a/mm/z3fold.c b/mm/z3fold.c
index f9492bccfd79..54f63c4a809a 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -185,6 +185,12 @@ static inline void z3fold_page_lock(struct z3fold_header *zhdr)
         spin_lock(&zhdr->page_lock);
 }
 
+/* Try to lock a z3fold page */
+static inline int z3fold_page_trylock(struct z3fold_header *zhdr)
+{
+        return spin_trylock(&zhdr->page_lock);
+}
+
 /* Unlock a z3fold page */
 static inline void z3fold_page_unlock(struct z3fold_header *zhdr)
 {
@@ -385,7 +391,7 @@ static int z3fold_alloc(struct z3fold_pool *pool, size_t size, gfp_t gfp,
                         spin_lock(&pool->lock);
                         zhdr = list_first_entry_or_null(&pool->unbuddied[i],
                                                 struct z3fold_header, buddy);
-                        if (!zhdr) {
+                        if (!zhdr || !z3fold_page_trylock(zhdr)) {
                                 spin_unlock(&pool->lock);
                                 continue;
                         }
@@ -394,7 +400,6 @@ static int z3fold_alloc(struct z3fold_pool *pool, size_t size, gfp_t gfp,
                         spin_unlock(&pool->lock);
 
                         page = virt_to_page(zhdr);
-                        z3fold_page_lock(zhdr);
                         if (zhdr->first_chunks == 0) {
                                 if (zhdr->middle_chunks != 0 &&
                                     chunks >= zhdr->start_middle)
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index b7ee9c34dbd6..d41edd28298b 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -276,7 +276,7 @@ struct zs_pool {
 struct zspage {
         struct {
                 unsigned int fullness:FULLNESS_BITS;
-                unsigned int class:CLASS_BITS;
+                unsigned int class:CLASS_BITS + 1;
                 unsigned int isolated:ISOLATED_BITS;
                 unsigned int magic:MAGIC_VAL_BITS;
         };
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 7c3d994e90d8..71343d0fec94 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2477,6 +2477,16 @@ static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface)
         batadv_iv_ogm_schedule(hard_iface);
 }
 
+/**
+ * batadv_iv_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_iv_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default TQ difference threshold to 20 */
+        atomic_set(&bat_priv->gw.sel_class, 20);
+}
+
 static struct batadv_gw_node *
 batadv_iv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
 {
@@ -2823,6 +2833,7 @@ static struct batadv_algo_ops batadv_batman_iv __read_mostly = {
                 .del_if = batadv_iv_ogm_orig_del_if,
         },
         .gw = {
+                .init_sel_class = batadv_iv_init_sel_class,
                 .get_best_gw_node = batadv_iv_gw_get_best_gw_node,
                 .is_eligible = batadv_iv_gw_is_eligible,
 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 0acd081dd286..a36c8e7291d6 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -668,6 +668,16 @@ err_ifinfo1:
         return ret;
 }
 
+/**
+ * batadv_v_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_v_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default throughput difference threshold to 5Mbps */
+        atomic_set(&bat_priv->gw.sel_class, 50);
+}
+
 static ssize_t batadv_v_store_sel_class(struct batadv_priv *bat_priv,
                                         char *buff, size_t count)
 {
@@ -1052,6 +1062,7 @@ static struct batadv_algo_ops batadv_batman_v __read_mostly = {
                 .dump = batadv_v_orig_dump,
         },
         .gw = {
+                .init_sel_class = batadv_v_init_sel_class,
                 .store_sel_class = batadv_v_store_sel_class,
                 .show_sel_class = batadv_v_show_sel_class,
                 .get_best_gw_node = batadv_v_gw_get_best_gw_node,
@@ -1092,9 +1103,6 @@ int batadv_v_mesh_init(struct batadv_priv *bat_priv)
         if (ret < 0)
                 return ret;
 
-        /* set default throughput difference threshold to 5Mbps */
-        atomic_set(&bat_priv->gw.sel_class, 50);
-
         return 0;
 }
 
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 11a23fd6e1a0..8f964beaac28 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -404,7 +404,7 @@ out:
  * batadv_frag_create - create a fragment from skb
  * @skb: skb to create fragment from
  * @frag_head: header to use in new fragment
- * @mtu: size of new fragment
+ * @fragment_size: size of new fragment
  *
  * Split the passed skb into two fragments: A new one with size matching the
  * passed mtu and the old one with the rest. The new skb contains data from the
@@ -414,11 +414,11 @@ out:
  */
 static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
                                           struct batadv_frag_packet *frag_head,
-                                          unsigned int mtu)
+                                          unsigned int fragment_size)
 {
         struct sk_buff *skb_fragment;
         unsigned int header_size = sizeof(*frag_head);
-        unsigned int fragment_size = mtu - header_size;
+        unsigned int mtu = fragment_size + header_size;
 
         skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
         if (!skb_fragment)
@@ -456,7 +456,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
         struct sk_buff *skb_fragment;
         unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
         unsigned int header_size = sizeof(frag_header);
-        unsigned int max_fragment_size, max_packet_size;
+        unsigned int max_fragment_size, num_fragments;
         int ret;
 
         /* To avoid merge and refragmentation at next-hops we never send
@@ -464,10 +464,15 @@ int batadv_frag_send_packet(struct sk_buff *skb,
          */
         mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
         max_fragment_size = mtu - header_size;
-        max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
+
+        if (skb->len == 0 || max_fragment_size == 0)
+                return -EINVAL;
+
+        num_fragments = (skb->len - 1) / max_fragment_size + 1;
+        max_fragment_size = (skb->len - 1) / num_fragments + 1;
 
         /* Don't even try to fragment, if we need more than 16 fragments */
-        if (skb->len > max_packet_size) {
+        if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) {
                 ret = -EAGAIN;
                 goto free_skb;
         }
@@ -507,7 +512,8 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                         goto put_primary_if;
                 }
 
-                skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
+                skb_fragment = batadv_frag_create(skb, &frag_header,
+                                                  max_fragment_size);
                 if (!skb_fragment) {
                         ret = -ENOMEM;
                         goto put_primary_if;
diff --git a/net/batman-adv/gateway_common.c b/net/batman-adv/gateway_common.c
index 5db2e43e3775..33940c5c74a8 100644
--- a/net/batman-adv/gateway_common.c
+++ b/net/batman-adv/gateway_common.c
@@ -253,6 +253,11 @@ static void batadv_gw_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
  */
 void batadv_gw_init(struct batadv_priv *bat_priv)
 {
+        if (bat_priv->algo_ops->gw.init_sel_class)
+                bat_priv->algo_ops->gw.init_sel_class(bat_priv);
+        else
+                atomic_set(&bat_priv->gw.sel_class, 1);
+
         batadv_tvlv_handler_register(bat_priv, batadv_gw_tvlv_ogm_handler_v1,
                                      NULL, BATADV_TVLV_GW, 1,
                                      BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 5d099b2e6cfc..d042c99af028 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -819,7 +819,6 @@ static int batadv_softif_init_late(struct net_device *dev)
         atomic_set(&bat_priv->mcast.num_want_all_ipv6, 0);
 #endif
         atomic_set(&bat_priv->gw.mode, BATADV_GW_MODE_OFF);
-        atomic_set(&bat_priv->gw.sel_class, 20);
         atomic_set(&bat_priv->gw.bandwidth_down, 100);
         atomic_set(&bat_priv->gw.bandwidth_up, 20);
         atomic_set(&bat_priv->orig_interval, 1000);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 66b25e410a41..246f21b4973b 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1489,6 +1489,7 @@ struct batadv_algo_orig_ops {
 
 /**
  * struct batadv_algo_gw_ops - mesh algorithm callbacks (GW specific)
+ * @init_sel_class: initialize GW selection class (optional)
  * @store_sel_class: parse and stores a new GW selection class (optional)
  * @show_sel_class: prints the current GW selection class (optional)
  * @get_best_gw_node: select the best GW from the list of available nodes
@@ -1499,6 +1500,7 @@ struct batadv_algo_orig_ops {
  * @dump: dump gateways to a netlink socket (optional)
  */
 struct batadv_algo_gw_ops {
+        void (*init_sel_class)(struct batadv_priv *bat_priv);
         ssize_t (*store_sel_class)(struct batadv_priv *bat_priv, char *buff,
                                    size_t count);
         ssize_t (*show_sel_class)(struct batadv_priv *bat_priv, char *buff);
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index ea71513fca21..90f49a194249 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -119,6 +119,15 @@ static int br_dev_init(struct net_device *dev)
         return err;
 }
 
+static void br_dev_uninit(struct net_device *dev)
+{
+        struct net_bridge *br = netdev_priv(dev);
+
+        br_multicast_uninit_stats(br);
+        br_vlan_flush(br);
+        free_percpu(br->stats);
+}
+
 static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -332,6 +341,7 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_open                = br_dev_open,
         .ndo_stop                = br_dev_stop,
         .ndo_init                = br_dev_init,
+        .ndo_uninit              = br_dev_uninit,
         .ndo_start_xmit          = br_dev_xmit,
         .ndo_get_stats64         = br_get_stats64,
         .ndo_set_mac_address     = br_set_mac_address,
@@ -356,14 +366,6 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_features_check      = passthru_features_check,
 };
 
-static void br_dev_free(struct net_device *dev)
-{
-        struct net_bridge *br = netdev_priv(dev);
-
-        free_percpu(br->stats);
-        free_netdev(dev);
-}
-
 static struct device_type br_type = {
         .name   = "bridge",
 };
@@ -376,7 +378,7 @@ void br_dev_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = br_dev_free;
+        dev->destructor = free_netdev;
         dev->ethtool_ops = &br_ethtool_ops;
         SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 4f598dc2d916..6e08b7199dd7 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -106,7 +106,7 @@ static struct net_bridge_fdb_entry *br_fdb_find(struct net_bridge *br,
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
-        WARN_ON_ONCE(!br_hash_lock_held(br));
+        lockdep_assert_held_once(&br->hash_lock);
 
         rcu_read_lock();
         fdb = fdb_find_rcu(head, addr, vid);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8ac1770aa222..56a2a72e7738 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -311,7 +311,6 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
 
         br_fdb_delete_by_port(br, NULL, 0, 1);
 
-        br_vlan_flush(br);
         br_multicast_dev_del(br);
         cancel_delayed_work_sync(&br->gc_work);
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index b760f2620abf..faa7261a992f 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2031,8 +2031,6 @@ void br_multicast_dev_del(struct net_bridge *br)
 
 out:
         spin_unlock_bh(&br->multicast_lock);
-
-        free_percpu(br->mcast_stats);
 }
 
 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
@@ -2531,6 +2529,11 @@ int br_multicast_init_stats(struct net_bridge *br)
         return 0;
 }
 
+void br_multicast_uninit_stats(struct net_bridge *br)
+{
+        free_percpu(br->mcast_stats);
+}
+
 static void mcast_stats_add_dir(u64 *dst, u64 *src)
 {
         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index fa87fbd62bb7..1f1e62095464 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -706,18 +706,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
 
 static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct nf_bridge_info *nf_bridge;
-        unsigned int mtu_reserved;
+        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
+        unsigned int mtu, mtu_reserved;
 
         mtu_reserved = nf_bridge_mtu_reduction(skb);
+        mtu = skb->dev->mtu;
+
+        if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+                mtu = nf_bridge->frag_max_size;
 
-        if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {
+        if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
                 nf_bridge_info_free(skb);
                 return br_dev_queue_push_xmit(net, sk, skb);
         }
 
-        nf_bridge = nf_bridge_info_get(skb);
-
         /* This is wrong! We should preserve the original fragment
          * boundaries by preserving frag_list rather than refragmenting.
          */
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a8f6acd23e30..225ef7d53701 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1165,11 +1165,14 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev,
                 spin_unlock_bh(&br->lock);
         }
 
-        err = br_changelink(dev, tb, data);
+        err = register_netdevice(dev);
         if (err)
                 return err;
 
-        return register_netdevice(dev);
+        err = br_changelink(dev, tb, data);
+        if (err)
+                unregister_netdevice(dev);
+        return err;
 }
 
 static size_t br_get_size(const struct net_device *brdev)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2288fca7756c..0d177280aa84 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -531,15 +531,6 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
 int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
                               const unsigned char *addr, u16 vid);
 
-static inline bool br_hash_lock_held(struct net_bridge *br)
-{
-#ifdef CONFIG_LOCKDEP
-        return lockdep_is_held(&br->hash_lock);
-#else
-        return true;
-#endif
-}
-
 /* br_forward.c */
 enum br_pkt_type {
         BR_PKT_UNICAST,
@@ -629,6 +620,7 @@ void br_rtr_notify(struct net_device *dev, struct net_bridge_port *port,
 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
                         const struct sk_buff *skb, u8 type, u8 dir);
 int br_multicast_init_stats(struct net_bridge *br);
+void br_multicast_uninit_stats(struct net_bridge *br);
 void br_multicast_get_stats(const struct net_bridge *br,
                             const struct net_bridge_port *p,
                             struct br_mcast_stats *dest);
@@ -769,6 +761,10 @@ static inline int br_multicast_init_stats(struct net_bridge *br)
         return 0;
 }
 
+static inline void br_multicast_uninit_stats(struct net_bridge *br)
+{
+}
+
 static inline int br_multicast_igmp_type(const struct sk_buff *skb)
 {
         return 0;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 38dcf1eb427d..f76bb3332613 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -7,6 +7,7 @@
 #include <linux/kthread.h>
 #include <linux/net.h>
 #include <linux/nsproxy.h>
+#include <linux/sched/mm.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
@@ -469,11 +470,16 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 {
         struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
         struct socket *sock;
+        unsigned int noio_flag;
         int ret;
 
         BUG_ON(con->sock);
+
+        /* sock_create_kern() allocates with GFP_KERNEL */
+        noio_flag = memalloc_noio_save();
         ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family,
                                SOCK_STREAM, IPPROTO_TCP, &sock);
+        memalloc_noio_restore(noio_flag);
         if (ret)
                 return ret;
         sock->sk->sk_allocation = GFP_NOFS;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ea633342ab0d..f4947e737f34 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -398,7 +398,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
                            struct iov_iter *to, int len)
 {
         int start = skb_headlen(skb);
-        int i, copy = start - offset;
+        int i, copy = start - offset, start_off = offset, n;
         struct sk_buff *frag_iter;
 
         trace_skb_copy_datagram_iovec(skb, len);
@@ -407,11 +407,12 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
         if (copy > 0) {
                 if (copy > len)
                         copy = len;
-                if (copy_to_iter(skb->data + offset, copy, to) != copy)
+                n = copy_to_iter(skb->data + offset, copy, to);
+                offset += n;
+                if (n != copy)
                         goto short_copy;
                 if ((len -= copy) == 0)
                         return 0;
-                offset += copy;
         }
 
         /* Copy paged appendix. Hmm... why does this look so complicated? */
@@ -425,13 +426,14 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
                 if ((copy = end - offset) > 0) {
                         if (copy > len)
                                 copy = len;
-                        if (copy_page_to_iter(skb_frag_page(frag),
+                        n = copy_page_to_iter(skb_frag_page(frag),
                                               frag->page_offset + offset -
-                                              start, copy, to) != copy)
+                                              start, copy, to);
+                        offset += n;
+                        if (n != copy)
                                 goto short_copy;
                         if (!(len -= copy))
                                 return 0;
-                        offset += copy;
                 }
                 start = end;
         }
@@ -463,6 +465,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
          */
 
 fault:
+        iov_iter_revert(to, offset - start_off);
         return -EFAULT;
 
 short_copy:
@@ -613,7 +616,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                       __wsum *csump)
 {
         int start = skb_headlen(skb);
-        int i, copy = start - offset;
+        int i, copy = start - offset, start_off = offset;
         struct sk_buff *frag_iter;
         int pos = 0;
         int n;
@@ -623,11 +626,11 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 if (copy > len)
                         copy = len;
                 n = csum_and_copy_to_iter(skb->data + offset, copy, csump, to);
+                offset += n;
                 if (n != copy)
                         goto fault;
                 if ((len -= copy) == 0)
                         return 0;
-                offset += copy;
                 pos = copy;
         }
 
@@ -649,12 +652,12 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                                   offset - start, copy,
                                                   &csum2, to);
                         kunmap(page);
+                        offset += n;
                         if (n != copy)
                                 goto fault;
                         *csump = csum_block_add(*csump, csum2, pos);
                         if (!(len -= copy))
                                 return 0;
-                        offset += copy;
                         pos += copy;
                 }
                 start = end;
@@ -687,6 +690,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 return 0;
 
 fault:
+        iov_iter_revert(to, offset - start_off);
         return -EFAULT;
 }
 
@@ -771,6 +775,7 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
         }
         return 0;
 csum_error:
+        iov_iter_revert(&msg->msg_iter, chunk);
         return -EINVAL;
 fault:
         return -EFAULT;
diff --git a/net/core/dev.c b/net/core/dev.c
index 7869ae3837ca..533a6d6f6092 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6757,7 +6757,6 @@ int dev_change_xdp_fd(struct net_device *dev, int fd, u32 flags)
 
         return err;
 }
-EXPORT_SYMBOL(dev_change_xdp_fd);
 
 /**
  *      dev_new_index   -       allocate an ifindex
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index c35aae13c8d2..d98d4998213d 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -390,7 +390,7 @@ mpls:
                         unsigned char ar_tip[4];
                 } *arp_eth, _arp_eth;
                 const struct arphdr *arp;
-                struct arphdr *_arp;
+                struct arphdr _arp;
 
                 arp = __skb_header_pointer(skb, nhoff, sizeof(_arp), data,
                                            hlen, &_arp);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e7c12caa20c8..4526cbd7e28a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -860,7 +860,8 @@ static void neigh_probe(struct neighbour *neigh)
         if (skb)
                 skb = skb_clone(skb, GFP_ATOMIC);
         write_unlock(&neigh->lock);
-        neigh->ops->solicit(neigh, skb);
+        if (neigh->ops->solicit)
+                neigh->ops->solicit(neigh, skb);
         atomic_inc(&neigh->probes);
         kfree_skb(skb);
 }
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 6ae56037bb13..029a61ac6cdd 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -71,27 +71,17 @@ static int update_classid_sock(const void *v, struct file *file, unsigned n)
         return 0;
 }
 
-static void update_classid(struct cgroup_subsys_state *css, void *v)
+static void cgrp_attach(struct cgroup_taskset *tset)
 {
-        struct css_task_iter it;
+        struct cgroup_subsys_state *css;
         struct task_struct *p;
 
-        css_task_iter_start(css, &it);
-        while ((p = css_task_iter_next(&it))) {
+        cgroup_taskset_for_each(p, css, tset) {
                 task_lock(p);
-                iterate_fd(p->files, 0, update_classid_sock, v);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)css_cls_state(css)->classid);
                 task_unlock(p);
         }
-        css_task_iter_end(&it);
-}
-
-static void cgrp_attach(struct cgroup_taskset *tset)
-{
-        struct cgroup_subsys_state *css;
-
-        cgroup_taskset_first(tset, &css);
-        update_classid(css,
-                       (void *)(unsigned long)css_cls_state(css)->classid);
 }
 
 static u64 read_classid(struct cgroup_subsys_state *css, struct cftype *cft)
@@ -103,12 +93,22 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
                          u64 value)
 {
         struct cgroup_cls_state *cs = css_cls_state(css);
+        struct css_task_iter it;
+        struct task_struct *p;
 
         cgroup_sk_alloc_disable();
 
         cs->classid = (u32)value;
 
-        update_classid(css, (void *)(unsigned long)cs->classid);
+        css_task_iter_start(css, &it);
+        while ((p = css_task_iter_next(&it))) {
+                task_lock(p);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)cs->classid);
+                task_unlock(p);
+        }
+        css_task_iter_end(&it);
+
         return 0;
 }
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9424673009c1..29be2466970c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -105,15 +105,21 @@ static void queue_process(struct work_struct *work)
         while ((skb = skb_dequeue(&npinfo->txq))) {
                 struct net_device *dev = skb->dev;
                 struct netdev_queue *txq;
+                unsigned int q_index;
 
                 if (!netif_device_present(dev) || !netif_running(dev)) {
                         kfree_skb(skb);
                         continue;
                 }
 
-                txq = skb_get_tx_queue(dev, skb);
-
                 local_irq_save(flags);
+                /* check if skb->queue_mapping is still valid */
+                q_index = skb_get_queue_mapping(skb);
+                if (unlikely(q_index >= dev->real_num_tx_queues)) {
+                        q_index = q_index % dev->real_num_tx_queues;
+                        skb_set_queue_mapping(skb, q_index);
+                }
+                txq = netdev_get_tx_queue(dev, q_index);
                 HARD_TX_LOCK(dev, txq, smp_processor_id());
                 if (netif_xmit_frozen_or_stopped(txq) ||
                     netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 758f140b6bed..d28da7d363f1 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -20,9 +20,11 @@
 #include <net/tcp.h>
 
 static siphash_key_t net_secret __read_mostly;
+static siphash_key_t ts_secret __read_mostly;
 
 static __always_inline void net_secret_init(void)
 {
+        net_get_random_once(&ts_secret, sizeof(ts_secret));
         net_get_random_once(&net_secret, sizeof(net_secret));
 }
 #endif
@@ -45,6 +47,23 @@ static u32 seq_scale(u32 seq)
 #endif
 
 #if IS_ENABLED(CONFIG_IPV6)
+static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
+{
+        const struct {
+                struct in6_addr saddr;
+                struct in6_addr daddr;
+        } __aligned(SIPHASH_ALIGNMENT) combined = {
+                .saddr = *(struct in6_addr *)saddr,
+                .daddr = *(struct in6_addr *)daddr,
+        };
+
+        if (sysctl_tcp_timestamps != 1)
+                return 0;
+
+        return siphash(&combined, offsetofend(typeof(combined), daddr),
+                       &ts_secret);
+}
+
 u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
                                  __be16 sport, __be16 dport, u32 *tsoff)
 {
@@ -63,7 +82,7 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
         net_secret_init();
         hash = siphash(&combined, offsetofend(typeof(combined), dport),
                        &net_secret);
-        *tsoff = sysctl_tcp_timestamps == 1 ? (hash >> 32) : 0;
+        *tsoff = secure_tcpv6_ts_off(saddr, daddr);
         return seq_scale(hash);
 }
 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
@@ -88,6 +107,14 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #ifdef CONFIG_INET
+static u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr)
+{
+        if (sysctl_tcp_timestamps != 1)
+                return 0;
+
+        return siphash_2u32((__force u32)saddr, (__force u32)daddr,
+                            &ts_secret);
+}
 
 /* secure_tcp_sequence_number(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d),
  * but fortunately, `sport' cannot be 0 in any circumstances. If this changes,
@@ -103,7 +130,7 @@ u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
         hash = siphash_3u32((__force u32)saddr, (__force u32)daddr,
                             (__force u32)sport << 16 | (__force u32)dport,
                             &net_secret);
-        *tsoff = sysctl_tcp_timestamps == 1 ? (hash >> 32) : 0;
+        *tsoff = secure_tcp_ts_off(saddr, daddr);
         return seq_scale(hash);
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index cd4ba8c6b609..f86bf69cfb8d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3082,22 +3082,32 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
         if (sg && csum && (mss != GSO_BY_FRAGS))  {
                 if (!(features & NETIF_F_GSO_PARTIAL)) {
                         struct sk_buff *iter;
+                        unsigned int frag_len;
 
                         if (!list_skb ||
                             !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
                                 goto normal;
 
-                        /* Split the buffer at the frag_list pointer.
-                         * This is based on the assumption that all
-                         * buffers in the chain excluding the last
-                         * containing the same amount of data.
+                        /* If we get here then all the required
+                         * GSO features except frag_list are supported.
+                         * Try to split the SKB to multiple GSO SKBs
+                         * with no frag_list.
+                         * Currently we can do that only when the buffers don't
+                         * have a linear part and all the buffers except
+                         * the last are of the same length.
                          */
+                        frag_len = list_skb->len;
                         skb_walk_frags(head_skb, iter) {
+                                if (frag_len != iter->len && iter->next)
+                                        goto normal;
                                 if (skb_headlen(iter))
                                         goto normal;
 
                                 len -= iter->len;
                         }
+
+                        if (len != frag_len)
+                                goto normal;
                 }
 
                 /* GSO partial only requires that we trim off any excess that
@@ -3694,6 +3704,15 @@ static void sock_rmem_free(struct sk_buff *skb)
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
 }
 
+static void skb_set_err_queue(struct sk_buff *skb)
+{
+        /* pkt_type of skbs received on local sockets is never PACKET_OUTGOING.
+         * So, it is safe to (mis)use it to mark skbs on the error queue.
+         */
+        skb->pkt_type = PACKET_OUTGOING;
+        BUILD_BUG_ON(PACKET_OUTGOING == 0);
+}
+
 /*
  * Note: We dont mem charge error packets (no sk_forward_alloc changes)
  */
@@ -3707,6 +3726,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
         skb->sk = sk;
         skb->destructor = sock_rmem_free;
         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+        skb_set_err_queue(skb);
 
         /* before exiting rcu section, make sure dst is refcounted */
         skb_dst_force(skb);
@@ -3783,16 +3803,21 @@ EXPORT_SYMBOL(skb_clone_sk);
 
 static void __skb_complete_tx_timestamp(struct sk_buff *skb,
                                         struct sock *sk,
-                                        int tstype)
+                                        int tstype,
+                                        bool opt_stats)
 {
         struct sock_exterr_skb *serr;
         int err;
 
+        BUILD_BUG_ON(sizeof(struct sock_exterr_skb) > sizeof(skb->cb));
+
         serr = SKB_EXT_ERR(skb);
         memset(serr, 0, sizeof(*serr));
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         serr->ee.ee_info = tstype;
+        serr->opt_stats = opt_stats;
+        serr->header.h4.iif = skb->dev ? skb->dev->ifindex : 0;
         if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
                 serr->ee.ee_data = skb_shinfo(skb)->tskey;
                 if (sk->sk_protocol == IPPROTO_TCP &&
@@ -3833,7 +3858,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
          */
         if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
                 *skb_hwtstamps(skb) = *hwtstamps;
-                __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
+                __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND, false);
                 sock_put(sk);
         }
 }
@@ -3844,7 +3869,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly;
+        bool tsonly, opt_stats = false;
 
         if (!sk)
                 return;
@@ -3857,9 +3882,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
 #ifdef CONFIG_INET
                 if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS) &&
                     sk->sk_protocol == IPPROTO_TCP &&
-                    sk->sk_type == SOCK_STREAM)
+                    sk->sk_type == SOCK_STREAM) {
                         skb = tcp_get_timestamping_opt_stats(sk);
-                else
+                        opt_stats = true;
+                } else
 #endif
                         skb = alloc_skb(0, GFP_ATOMIC);
         } else {
@@ -3878,7 +3904,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
         else
                 skb->tstamp = ktime_get_real();
 
-        __skb_complete_tx_timestamp(skb, sk, tstype);
+        __skb_complete_tx_timestamp(skb, sk, tstype, opt_stats);
 }
 EXPORT_SYMBOL_GPL(__skb_tstamp_tx);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index a96d5f7a5734..2c4f574168fb 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1442,6 +1442,11 @@ static void __sk_destruct(struct rcu_head *head)
                 pr_debug("%s: optmem leakage (%d bytes) detected\n",
                          __func__, atomic_read(&sk->sk_omem_alloc));
 
+        if (sk->sk_frag.page) {
+                put_page(sk->sk_frag.page);
+                sk->sk_frag.page = NULL;
+        }
+
         if (sk->sk_peer_cred)
                 put_cred(sk->sk_peer_cred);
         put_pid(sk->sk_peer_pid);
@@ -1539,6 +1544,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                         is_charged = sk_filter_charge(newsk, filter);
 
                 if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+                        /* We need to make sure that we don't uncharge the new
+                         * socket if we couldn't charge it in the first place
+                         * as otherwise we uncharge the parent's filter.
+                         */
+                        if (!is_charged)
+                                RCU_INIT_POINTER(newsk->sk_filter, NULL);
                         sk_free_unlock_clone(newsk);
                         newsk = NULL;
                         goto out;
@@ -2787,11 +2798,6 @@ void sk_common_release(struct sock *sk)
 
         sk_refcnt_debug_release(sk);
 
-        if (sk->sk_frag.page) {
-                put_page(sk->sk_frag.page);
-                sk->sk_frag.page = NULL;
-        }
-
         sock_put(sk);
 }
 EXPORT_SYMBOL(sk_common_release);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 4ead336e14ea..7f9cc400eca0 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -408,14 +408,16 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_net_busy_poll,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "busy_read",
                 .data           = &sysctl_net_busy_read,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
 #endif
 #ifdef CONFIG_NET_SCHED
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 42bfd08109dd..8f2133ffc2ff 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1083,7 +1083,8 @@ static void nl_fib_input(struct sk_buff *skb)
 
         net = sock_net(skb->sk);
         nlh = nlmsg_hdr(skb);
-        if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len ||
+        if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
+            skb->len < nlh->nlmsg_len ||
             nlmsg_len(nlh) < sizeof(*frn))
                 return;
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index bbe7f72db9c1..b3cdeec85f1f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -198,6 +198,7 @@ static void ip_expire(unsigned long arg)
         qp = container_of((struct inet_frag_queue *) arg, struct ipq, q);
         net = container_of(qp->q.net, struct net, ipv4.frags);
 
+        rcu_read_lock();
         spin_lock(&qp->q.lock);
 
         if (qp->q.flags & INET_FRAG_COMPLETE)
@@ -207,7 +208,7 @@ static void ip_expire(unsigned long arg)
         __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
 
         if (!inet_frag_evicting(&qp->q)) {
-                struct sk_buff *head = qp->q.fragments;
+                struct sk_buff *clone, *head = qp->q.fragments;
                 const struct iphdr *iph;
                 int err;
 
@@ -216,32 +217,40 @@ static void ip_expire(unsigned long arg)
                 if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments)
                         goto out;
 
-                rcu_read_lock();
                 head->dev = dev_get_by_index_rcu(net, qp->iif);
                 if (!head->dev)
-                        goto out_rcu_unlock;
+                        goto out;
+
 
                 /* skb has no dst, perform route lookup again */
                 iph = ip_hdr(head);
                 err = ip_route_input_noref(head, iph->daddr, iph->saddr,
                                            iph->tos, head->dev);
                 if (err)
-                        goto out_rcu_unlock;
+                        goto out;
 
                 /* Only an end host needs to send an ICMP
                  * "Fragment Reassembly Timeout" message, per RFC792.
                  */
                 if (frag_expire_skip_icmp(qp->user) &&
                     (skb_rtable(head)->rt_type != RTN_LOCAL))
-                        goto out_rcu_unlock;
+                        goto out;
+
+                clone = skb_clone(head, GFP_ATOMIC);
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-out_rcu_unlock:
-                rcu_read_unlock();
+                if (clone) {
+                        spin_unlock(&qp->q.lock);
+                        icmp_send(clone, ICMP_TIME_EXCEEDED,
+                                  ICMP_EXC_FRAGTIME, 0);
+                        consume_skb(clone);
+                        goto out_rcu_unlock;
+                }
         }
 out:
         spin_unlock(&qp->q.lock);
+out_rcu_unlock:
+        rcu_read_unlock();
         ipq_put(qp);
 }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ebd953bc5607..1d46d05efb0f 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -488,16 +488,15 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk,
                 return false;
 
         /* Support IP_PKTINFO on tstamp packets if requested, to correlate
-         * timestamp with egress dev. Not possible for packets without dev
+         * timestamp with egress dev. Not possible for packets without iif
          * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
          */
-        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
-            (!skb->dev))
+        info = PKTINFO_SKB_CB(skb);
+        if (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG) ||
+            !info->ipi_ifindex)
                 return false;
 
-        info = PKTINFO_SKB_CB(skb);
         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
-        info->ipi_ifindex = skb->dev->ifindex;
         return true;
 }
 
@@ -591,6 +590,7 @@ static bool setsockopt_needs_rtnl(int optname)
         case MCAST_LEAVE_GROUP:
         case MCAST_LEAVE_SOURCE_GROUP:
         case MCAST_UNBLOCK_SOURCE:
+        case IP_ROUTER_ALERT:
                 return true;
         }
         return false;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index fd9f34bbd740..dfb2ab2dd3c8 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -306,7 +306,7 @@ static void __init ic_close_devs(void)
         while ((d = next)) {
                 next = d->next;
                 dev = d->dev;
-                if ((!ic_dev || dev != ic_dev->dev) && !netdev_uses_dsa(dev)) {
+                if (d != ic_dev && !netdev_uses_dsa(dev)) {
                         pr_debug("IP-Config: Downing %s\n", dev->name);
                         dev_change_flags(dev, d->flags);
                 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index c0317c940bcd..b036e85e093b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1278,7 +1278,7 @@ static void mrtsock_destruct(struct sock *sk)
         struct net *net = sock_net(sk);
         struct mr_table *mrt;
 
-        rtnl_lock();
+        ASSERT_RTNL();
         ipmr_for_each_table(mrt, net) {
                 if (sk == rtnl_dereference(mrt->mroute_sk)) {
                         IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
@@ -1289,7 +1289,6 @@ static void mrtsock_destruct(struct sock *sk)
                         mroute_clean_tables(mrt, false);
                 }
         }
-        rtnl_unlock();
 }
 
 /* Socket options and virtual interface manipulation. The whole
@@ -1353,13 +1352,8 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
                 if (sk != rcu_access_pointer(mrt->mroute_sk)) {
                         ret = -EACCES;
                 } else {
-                        /* We need to unlock here because mrtsock_destruct takes
-                         * care of rtnl itself and we can't change that due to
-                         * the IP_ROUTER_ALERT setsockopt which runs without it.
-                         */
-                        rtnl_unlock();
                         ret = ip_ra_control(sk, 0, NULL);
-                        goto out;
+                        goto out_unlock;
                 }
                 break;
         case MRT_ADD_VIF:
@@ -1470,7 +1464,6 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
         }
 out_unlock:
         rtnl_unlock();
-out:
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 52f26459efc3..9b8841316e7b 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -461,7 +461,7 @@ static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
 
         clusterip_config_put(cipinfo->config);
 
-        nf_ct_netns_get(par->net, par->family);
+        nf_ct_netns_put(par->net, par->family);
 }
 
 #ifdef CONFIG_COMPAT
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index bc1486f2c064..2e14ed11a35c 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -165,6 +165,10 @@ static unsigned int ipv4_conntrack_local(void *priv,
         if (skb->len < sizeof(struct iphdr) ||
             ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
+
+        if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+                return NF_ACCEPT;
+
         return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index f8aad03d674b..6f5e8d01b876 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -255,11 +255,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
         /* maniptype == SRC for postrouting. */
         enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);
 
-        /* We never see fragments: conntrack defrags on pre-routing
-         * and local-out, and nf_nat_out protects post-routing.
-         */
-        NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
         ct = nf_ct_get(skb, &ctinfo);
         /* Can't track?  It's not due to stress, or conntrack would
          * have dropped it.  Hence it's the user's responsibilty to
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index c9b52c361da2..53e49f5011d3 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1260,16 +1260,6 @@ static const struct nf_conntrack_expect_policy snmp_exp_policy = {
         .timeout        = 180,
 };
 
-static struct nf_conntrack_helper snmp_helper __read_mostly = {
-        .me                     = THIS_MODULE,
-        .help                   = help,
-        .expect_policy          = &snmp_exp_policy,
-        .name                   = "snmp",
-        .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.udp.port   = cpu_to_be16(SNMP_PORT),
-        .tuple.dst.protonum     = IPPROTO_UDP,
-};
-
 static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
         .me                     = THIS_MODULE,
         .help                   = help,
@@ -1288,22 +1278,16 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
 
 static int __init nf_nat_snmp_basic_init(void)
 {
-        int ret = 0;
-
         BUG_ON(nf_nat_snmp_hook != NULL);
         RCU_INIT_POINTER(nf_nat_snmp_hook, help);
 
-        ret = nf_conntrack_helper_register(&snmp_trap_helper);
-        if (ret < 0) {
-                nf_conntrack_helper_unregister(&snmp_helper);
-                return ret;
-        }
-        return ret;
+        return nf_conntrack_helper_register(&snmp_trap_helper);
 }
 
 static void __exit nf_nat_snmp_basic_fini(void)
 {
         RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+        synchronize_rcu();
         nf_conntrack_helper_unregister(&snmp_trap_helper);
 }
 
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index a0ea8aad1bf1..f18677277119 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -26,10 +26,10 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, nft_hook(pkt),
                                                     &range, nft_out(pkt));
diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index 1650ed23c15d..5120be1d3118 100644
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
 
         memset(&mr, 0, sizeof(mr));
         if (priv->sreg_proto_min) {
-                mr.range[0].min.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                mr.range[0].max.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                mr.range[0].min.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                mr.range[0].max.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 2af6244b83e2..ccfbce13a633 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -156,17 +156,18 @@ int ping_hash(struct sock *sk)
 void ping_unhash(struct sock *sk)
 {
         struct inet_sock *isk = inet_sk(sk);
+
         pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
+        write_lock_bh(&ping_table.lock);
         if (sk_hashed(sk)) {
-                write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
                 sk_nulls_node_init(&sk->sk_nulls_node);
                 sock_put(sk);
                 isk->inet_num = 0;
                 isk->inet_sport = 0;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-                write_unlock_bh(&ping_table.lock);
         }
+        write_unlock_bh(&ping_table.lock);
 }
 EXPORT_SYMBOL_GPL(ping_unhash);
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 8119e1f66e03..9d943974de2b 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -682,7 +682,9 @@ static void raw_close(struct sock *sk, long timeout)
         /*
          * Raw sockets may have direct kernel references. Kill them.
          */
+        rtnl_lock();
         ip_ra_control(sk, 0, NULL);
+        rtnl_unlock();
 
         sk_common_release(sk);
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8471dd116771..acd69cfe2951 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2620,7 +2620,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
         skb_reset_network_header(skb);
 
         /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
-        ip_hdr(skb)->protocol = IPPROTO_ICMP;
+        ip_hdr(skb)->protocol = IPPROTO_UDP;
         skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
         src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cf4555581282..40ba4249a586 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2322,6 +2322,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
+        tcp_saved_syn_free(tp);
 
         /* Clean up fastopen related fields */
         tcp_free_fastopen_req(tp);
@@ -2770,7 +2771,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
         const struct tcp_sock *tp = tcp_sk(sk); /* iff sk_type == SOCK_STREAM */
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        u32 now = tcp_time_stamp, intv;
+        u32 now, intv;
         u64 rate64;
         bool slow;
         u32 rate;
@@ -2839,6 +2840,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_retrans = tp->retrans_out;
         info->tcpi_fackets = tp->fackets_out;
 
+        now = tcp_time_stamp;
         info->tcpi_last_data_sent = jiffies_to_msecs(now - tp->lsndtime);
         info->tcpi_last_data_recv = jiffies_to_msecs(now - icsk->icsk_ack.lrcvtime);
         info->tcpi_last_ack_recv = jiffies_to_msecs(now - tp->rcv_tstamp);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 39c393cc0fd3..659d1baefb2b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -126,7 +126,8 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 #define REXMIT_LOST     1 /* retransmit packets marked lost */
 #define REXMIT_NEW      2 /* FRTO-style transmit of unsent/new packets */
 
-static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
+static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb,
+                             unsigned int len)
 {
         static bool __once __read_mostly;
 
@@ -137,8 +138,9 @@ static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
 
                 rcu_read_lock();
                 dev = dev_get_by_index_rcu(sock_net(sk), skb->skb_iif);
-                pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
-                        dev ? dev->name : "Unknown driver");
+                if (!dev || len >= dev->mtu)
+                        pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
+                                dev ? dev->name : "Unknown driver");
                 rcu_read_unlock();
         }
 }
@@ -161,8 +163,10 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
         if (len >= icsk->icsk_ack.rcv_mss) {
                 icsk->icsk_ack.rcv_mss = min_t(unsigned int, len,
                                                tcp_sk(sk)->advmss);
-                if (unlikely(icsk->icsk_ack.rcv_mss != len))
-                        tcp_gro_dev_warn(sk, skb);
+                /* Account for possibly-removed options */
+                if (unlikely(len > icsk->icsk_ack.rcv_mss +
+                                   MAX_TCP_OPTION_SPACE))
+                        tcp_gro_dev_warn(sk, skb, len);
         } else {
                 /* Otherwise, we make more careful check taking into account,
                  * that SACKs block is variable.
@@ -874,22 +878,11 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
                                   const int ts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        if (metric > tp->reordering) {
-                int mib_idx;
+        int mib_idx;
 
+        if (metric > tp->reordering) {
                 tp->reordering = min(sysctl_tcp_max_reordering, metric);
 
-                /* This exciting event is worth to be remembered. 8) */
-                if (ts)
-                        mib_idx = LINUX_MIB_TCPTSREORDER;
-                else if (tcp_is_reno(tp))
-                        mib_idx = LINUX_MIB_TCPRENOREORDER;
-                else if (tcp_is_fack(tp))
-                        mib_idx = LINUX_MIB_TCPFACKREORDER;
-                else
-                        mib_idx = LINUX_MIB_TCPSACKREORDER;
-
-                NET_INC_STATS(sock_net(sk), mib_idx);
 #if FASTRETRANS_DEBUG > 1
                 pr_debug("Disorder%d %d %u f%u s%u rr%d\n",
                          tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
@@ -902,6 +895,18 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
         }
 
         tp->rack.reord = 1;
+
+        /* This exciting event is worth to be remembered. 8) */
+        if (ts)
+                mib_idx = LINUX_MIB_TCPTSREORDER;
+        else if (tcp_is_reno(tp))
+                mib_idx = LINUX_MIB_TCPRENOREORDER;
+        else if (tcp_is_fack(tp))
+                mib_idx = LINUX_MIB_TCPFACKREORDER;
+        else
+                mib_idx = LINUX_MIB_TCPSACKREORDER;
+
+        NET_INC_STATS(sock_net(sk), mib_idx);
 }
 
 /* This must be called before lost_out is incremented */
@@ -1930,6 +1935,7 @@ void tcp_enter_loss(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct net *net = sock_net(sk);
         struct sk_buff *skb;
+        bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
         bool is_reneg;                  /* is receiver reneging on SACKs? */
         bool mark_lost;
 
@@ -1989,15 +1995,18 @@ void tcp_enter_loss(struct sock *sk)
         tp->high_seq = tp->snd_nxt;
         tcp_ecn_queue_cwr(tp);
 
-        /* F-RTO RFC5682 sec 3.1 step 1 mandates to disable F-RTO
-         * if a previous recovery is underway, otherwise it may incorrectly
-         * call a timeout spurious if some previously retransmitted packets
-         * are s/acked (sec 3.2). We do not apply that retriction since
-         * retransmitted skbs are permanently tagged with TCPCB_EVER_RETRANS
-         * so FLAG_ORIG_SACK_ACKED is always correct. But we do disable F-RTO
-         * on PTMU discovery to avoid sending new data.
+        /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
+         * loss recovery is underway except recurring timeout(s) on
+         * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing
+         *
+         * In theory F-RTO can be used repeatedly during loss recovery.
+         * In practice this interacts badly with broken middle-boxes that
+         * falsely raise the receive window, which results in repeated
+         * timeouts and stop-and-go behavior.
          */
-        tp->frto = sysctl_tcp_frto && !inet_csk(sk)->icsk_mtup.probe_size;
+        tp->frto = sysctl_tcp_frto &&
+                   (new_recovery || icsk->icsk_retransmits) &&
+                   !inet_csk(sk)->icsk_mtup.probe_size;
 }
 
 /* If ACK arrived pointing to a remembered SACK, it means that our
@@ -5541,6 +5550,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         struct inet_connection_sock *icsk = inet_csk(sk);
 
         tcp_set_state(sk, TCP_ESTABLISHED);
+        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
         if (skb) {
                 icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
@@ -5759,7 +5769,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                          * to stand against the temptation 8)     --ANK
                          */
                         inet_csk_schedule_ack(sk);
-                        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
                         tcp_enter_quickack_mode(sk);
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
                                                   TCP_DELACK_MAX, TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7e16243cdb58..65c0f3d13eca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -460,6 +460,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
                 minmax_reset(&newtp->rtt_min, tcp_time_stamp, ~0U);
                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+                newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
                 newtp->packets_out = 0;
                 newtp->retrans_out = 0;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 22548b5f05cb..c3c082ed3879 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2999,6 +2999,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
 {
         struct sk_buff *skb;
 
+        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
+
         /* NOTE: No TCP options attached and we never retransmit this. */
         skb = alloc_skb(MAX_TCP_HEADER, priority);
         if (!skb) {
@@ -3014,8 +3016,6 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         /* Send it off. */
         if (tcp_transmit_skb(sk, skb, 0, priority))
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
-
-        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 }
 
 /* Send a crossed SYN-ACK during socket establishment.
diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
index 4ecb38ae8504..d8acbd9f477a 100644
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -12,7 +12,8 @@ static void tcp_rack_mark_skb_lost(struct sock *sk, struct sk_buff *skb)
                 /* Account for retransmits that are lost again */
                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                 tp->retrans_out -= tcp_skb_pcount(skb);
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSTRETRANSMIT);
+                NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPLOSTRETRANSMIT,
+                              tcp_skb_pcount(skb));
         }
 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 363172527e43..80ce478c4851 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3626,14 +3626,19 @@ restart:
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
                 struct rt6_info *rt = NULL;
+                bool keep;
 
                 addrconf_del_dad_work(ifa);
 
+                keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
+                        !addr_is_local(&ifa->addr);
+                if (!keep)
+                        list_move(&ifa->if_list, &del_list);
+
                 write_unlock_bh(&idev->lock);
                 spin_lock_bh(&ifa->lock);
 
-                if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
-                    !addr_is_local(&ifa->addr)) {
+                if (keep) {
                         /* set state to skip the notifier below */
                         state = INET6_IFADDR_STATE_DEAD;
                         ifa->state = 0;
@@ -3645,8 +3650,6 @@ restart:
                 } else {
                         state = ifa->state;
                         ifa->state = INET6_IFADDR_STATE_DEAD;
-
-                        list_move(&ifa->if_list, &del_list);
                 }
 
                 spin_unlock_bh(&ifa->lock);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index eec27f87efac..e011122ebd43 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -405,9 +405,6 @@ static inline bool ipv6_datagram_support_addr(struct sock_exterr_skb *serr)
  * At one point, excluding local errors was a quick test to identify icmp/icmp6
  * errors. This is no longer true, but the test remained, so the v6 stack,
  * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
- *
- * Timestamp code paths do not initialize the fields expected by cmsg:
- * the PKTINFO fields in skb->cb[]. Fill those in here.
  */
 static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
                                       struct sock_exterr_skb *serr)
@@ -419,14 +416,9 @@ static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
         if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
                 return false;
 
-        if (!skb->dev)
+        if (!IP6CB(skb)->iif)
                 return false;
 
-        if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = skb->dev->ifindex;
-        else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
-
         return true;
 }
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 275cac628a95..25192a3b0cd7 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -388,7 +388,6 @@ looped_back:
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                   ((&hdr->segments_left) -
                                    skb_network_header(skb)));
-                kfree_skb(skb);
                 return -1;
         }
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aacfb4bce153..c45b12b4431c 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -122,11 +122,14 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                         max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
         /*
          * RFC4291 2.5.3
+         * The loopback address must not be used as the source address in IPv6
+         * packets that are sent outside of a single node. [..]
          * A packet received on an interface with a destination address
          * of loopback must be dropped.
          */
-        if (!(dev->flags & IFF_LOOPBACK) &&
-            ipv6_addr_loopback(&hdr->daddr))
+        if ((ipv6_addr_loopback(&hdr->saddr) ||
+             ipv6_addr_loopback(&hdr->daddr)) &&
+             !(dev->flags & IFF_LOOPBACK))
                 goto err;
 
         /* RFC4291 Errata ID: 3480
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 6ba6c900ebcf..bf34d0950752 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -774,7 +774,8 @@ failure:
  *      Delete a VIF entry
  */
 
-static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
+                       struct list_head *head)
 {
         struct mif_device *v;
         struct net_device *dev;
@@ -820,7 +821,7 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
                                              dev->ifindex, &in6_dev->cnf);
         }
 
-        if (v->flags & MIFF_REGISTER)
+        if ((v->flags & MIFF_REGISTER) && !notify)
                 unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
@@ -1331,7 +1332,6 @@ static int ip6mr_device_event(struct notifier_block *this,
         struct mr6_table *mrt;
         struct mif_device *v;
         int ct;
-        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
@@ -1340,10 +1340,9 @@ static int ip6mr_device_event(struct notifier_block *this,
                 v = &mrt->vif6_table[0];
                 for (ct = 0; ct < mrt->maxvif; ct++, v++) {
                         if (v->dev == dev)
-                                mif6_delete(mrt, ct, &list);
+                                mif6_delete(mrt, ct, 1, NULL);
                 }
         }
-        unregister_netdevice_many(&list);
 
         return NOTIFY_DONE;
 }
@@ -1552,7 +1551,7 @@ static void mroute_clean_tables(struct mr6_table *mrt, bool all)
         for (i = 0; i < mrt->maxvif; i++) {
                 if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
                         continue;
-                mif6_delete(mrt, i, &list);
+                mif6_delete(mrt, i, 0, &list);
         }
         unregister_netdevice_many(&list);
 
@@ -1707,7 +1706,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                 if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                         return -EFAULT;
                 rtnl_lock();
-                ret = mif6_delete(mrt, mifi, NULL);
+                ret = mif6_delete(mrt, mifi, 0, NULL);
                 rtnl_unlock();
                 return ret;
 
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 6c5b5b1830a7..4146536e9c15 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -27,10 +27,10 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv6(pkt->skb, &range,
                                                     nft_out(pkt));
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index f5ac080fc084..a27e424f690d 100644
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
 
         memset(&range, 0, sizeof(range));
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min],
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max],
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 35c58b669ebd..fb174b590fd3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1854,6 +1854,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
         int addr_type;
         int err = -EINVAL;
 
+        /* RTF_PCPU is an internal flag; can not be set by userspace */
+        if (cfg->fc_flags & RTF_PCPU)
+                goto out;
+
         if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
                 goto out;
 #ifndef CONFIG_IPV6_SUBTREES
@@ -3423,6 +3427,8 @@ static int rt6_fill_node(struct net *net,
         }
         else if (rt->rt6i_flags & RTF_LOCAL)
                 rtm->rtm_type = RTN_LOCAL;
+        else if (rt->rt6i_flags & RTF_ANYCAST)
+                rtm->rtm_type = RTN_ANYCAST;
         else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
                 rtm->rtm_type = RTN_LOCAL;
         else
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index a855eb325b03..5f44ffed2576 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -53,6 +53,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
                 struct sr6_tlv *tlv;
                 unsigned int tlv_len;
 
+                if (trailing < sizeof(*tlv))
+                        return false;
+
                 tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset);
                 tlv_len = sizeof(*tlv) + tlv->len;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4e4c401e3bc6..e28082f0a307 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1035,6 +1035,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         ipc6.hlimit = -1;
         ipc6.tclass = -1;
         ipc6.dontfrag = -1;
+        sockc.tsflags = sk->sk_tsflags;
 
         /* destination address check */
         if (sin6) {
@@ -1159,7 +1160,6 @@ do_udp_sendmsg:
 
         fl6.flowi6_mark = sk->sk_mark;
         fl6.flowi6_uid = sk->sk_uid;
-        sockc.tsflags = sk->sk_tsflags;
 
         if (msg->msg_controllen) {
                 opt = &opt_space;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 309062f3debe..31762f76cdb5 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1687,7 +1687,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct kcm_attach info;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_attach_ioctl(sock, &info);
 
@@ -1697,7 +1697,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct kcm_unattach info;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_unattach_ioctl(sock, &info);
 
@@ -1708,7 +1708,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct socket *newsock = NULL;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_clone(sock, &info, &newsock);
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c6252ed42c1d..be8cecc65002 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -63,8 +63,13 @@ struct pfkey_sock {
                 } u;
                 struct sk_buff  *skb;
         } dump;
+        struct mutex dump_lock;
 };
 
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+                               xfrm_address_t *saddr, xfrm_address_t *daddr,
+                               u16 *family);
+
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
         return (struct pfkey_sock *)sk;
@@ -139,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
 {
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         struct sock *sk;
+        struct pfkey_sock *pfk;
         int err;
 
         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
@@ -153,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
         if (sk == NULL)
                 goto out;
 
+        pfk = pfkey_sk(sk);
+        mutex_init(&pfk->dump_lock);
+
         sock->ops = &pfkey_ops;
         sock_init_data(sock, sk);
 
@@ -281,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
         struct sadb_msg *hdr;
         int rc;
 
+        mutex_lock(&pfk->dump_lock);
+        if (!pfk->dump.dump) {
+                rc = 0;
+                goto out;
+        }
+
         rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
-                return 0;
+        if (rc == -ENOBUFS) {
+                rc = 0;
+                goto out;
+        }
 
         if (pfk->dump.skb) {
-                if (!pfkey_can_dump(&pfk->sk))
-                        return 0;
+                if (!pfkey_can_dump(&pfk->sk)) {
+                        rc = 0;
+                        goto out;
+                }
 
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
@@ -298,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
         }
 
         pfkey_terminate_dump(pfk);
+
+out:
+        mutex_unlock(&pfk->dump_lock);
         return rc;
 }
 
@@ -1793,19 +1815,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
         struct xfrm_address_filter *filter = NULL;
         struct pfkey_sock *pfk = pfkey_sk(sk);
 
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EBUSY;
+        }
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-        if (proto == 0)
+        if (proto == 0) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EINVAL;
+        }
 
         if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
                 struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
                 filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-                if (filter == NULL)
+                if (filter == NULL) {
+                        mutex_unlock(&pfk->dump_lock);
                         return -ENOMEM;
+                }
 
                 memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
                        sizeof(xfrm_address_t));
@@ -1821,6 +1850,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
         pfk->dump.dump = pfkey_dump_sa;
         pfk->dump.done = pfkey_dump_sa_done;
         xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
+        mutex_unlock(&pfk->dump_lock);
 
         return pfkey_do_dump(pfk);
 }
@@ -1913,19 +1943,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
 
         /* addresses present only in tunnel mode */
         if (t->mode == XFRM_MODE_TUNNEL) {
-                u8 *sa = (u8 *) (rq + 1);
-                int family, socklen;
+                int err;
 
-                family = pfkey_sockaddr_extract((struct sockaddr *)sa,
-                                                &t->saddr);
-                if (!family)
-                        return -EINVAL;
-
-                socklen = pfkey_sockaddr_len(family);
-                if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
-                                           &t->id.daddr) != family)
-                        return -EINVAL;
-                t->encap_family = family;
+                err = parse_sockaddr_pair(
+                        (struct sockaddr *)(rq + 1),
+                        rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+                        &t->saddr, &t->id.daddr, &t->encap_family);
+                if (err)
+                        return err;
         } else
                 t->encap_family = xp->family;
 
@@ -1945,7 +1970,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
         if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
                 return -EINVAL;
 
-        while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+        while (len >= sizeof(*rq)) {
+                if (len < rq->sadb_x_ipsecrequest_len ||
+                    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+                        return -EINVAL;
+
                 if ((err = parse_ipsecrequest(xp, rq)) < 0)
                         return err;
                 len -= rq->sadb_x_ipsecrequest_len;
@@ -2408,7 +2437,6 @@ out:
         return err;
 }
 
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
         return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2420,7 +2448,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
 {
         int af, socklen;
 
-        if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+        if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
                 return -EINVAL;
 
         af = pfkey_sockaddr_extract(sa, saddr);
@@ -2436,6 +2464,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
         return 0;
 }
 
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
                                     struct xfrm_migrate *m)
 {
@@ -2443,13 +2472,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
         struct sadb_x_ipsecrequest *rq2;
         int mode;
 
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-            len < rq1->sadb_x_ipsecrequest_len)
+        if (len < sizeof(*rq1) ||
+            len < rq1->sadb_x_ipsecrequest_len ||
+            rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
                 return -EINVAL;
 
         /* old endoints */
         err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-                                  rq1->sadb_x_ipsecrequest_len,
+                                  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
                                   &m->old_saddr, &m->old_daddr,
                                   &m->old_family);
         if (err)
@@ -2458,13 +2488,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
         rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
         len -= rq1->sadb_x_ipsecrequest_len;
 
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-            len < rq2->sadb_x_ipsecrequest_len)
+        if (len <= sizeof(*rq2) ||
+            len < rq2->sadb_x_ipsecrequest_len ||
+            rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
                 return -EINVAL;
 
         /* new endpoints */
         err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-                                  rq2->sadb_x_ipsecrequest_len,
+                                  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
                                   &m->new_saddr, &m->new_daddr,
                                   &m->new_family);
         if (err)
@@ -2679,14 +2710,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb
 {
         struct pfkey_sock *pfk = pfkey_sk(sk);
 
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EBUSY;
+        }
 
         pfk->dump.msg_version = hdr->sadb_msg_version;
         pfk->dump.msg_portid = hdr->sadb_msg_pid;
         pfk->dump.dump = pfkey_dump_sp;
         pfk->dump.done = pfkey_dump_sp_done;
         xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
+        mutex_unlock(&pfk->dump_lock);
 
         return pfkey_do_dump(pfk);
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 8adab6335ced..e37d9554da7b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -278,7 +278,57 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 }
 EXPORT_SYMBOL_GPL(l2tp_session_find);
 
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
+/* Like l2tp_session_find() but takes a reference on the returned session.
+ * Optionally calls session->ref() too if do_ref is true.
+ */
+struct l2tp_session *l2tp_session_get(struct net *net,
+                                      struct l2tp_tunnel *tunnel,
+                                      u32 session_id, bool do_ref)
+{
+        struct hlist_head *session_list;
+        struct l2tp_session *session;
+
+        if (!tunnel) {
+                struct l2tp_net *pn = l2tp_pernet(net);
+
+                session_list = l2tp_session_id_hash_2(pn, session_id);
+
+                rcu_read_lock_bh();
+                hlist_for_each_entry_rcu(session, session_list, global_hlist) {
+                        if (session->session_id == session_id) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
+                                rcu_read_unlock_bh();
+
+                                return session;
+                        }
+                }
+                rcu_read_unlock_bh();
+
+                return NULL;
+        }
+
+        session_list = l2tp_session_id_hash(tunnel, session_id);
+        read_lock_bh(&tunnel->hlist_lock);
+        hlist_for_each_entry(session, session_list, hlist) {
+                if (session->session_id == session_id) {
+                        l2tp_session_inc_refcount(session);
+                        if (do_ref && session->ref)
+                                session->ref(session);
+                        read_unlock_bh(&tunnel->hlist_lock);
+
+                        return session;
+                }
+        }
+        read_unlock_bh(&tunnel->hlist_lock);
+
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(l2tp_session_get);
+
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref)
 {
         int hash;
         struct l2tp_session *session;
@@ -288,6 +338,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
                 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                         if (++count > nth) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
                                 read_unlock_bh(&tunnel->hlist_lock);
                                 return session;
                         }
@@ -298,12 +351,13 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
+EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 
 /* Lookup a session by interface name.
  * This is very inefficient but is only used by management interfaces.
  */
-struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
+struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+                                                bool do_ref)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         int hash;
@@ -313,7 +367,11 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
                 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                         if (!strcmp(session->ifname, ifname)) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
                                 rcu_read_unlock_bh();
+
                                 return session;
                         }
                 }
@@ -323,7 +381,49 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
+EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
+
+static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
+                                      struct l2tp_session *session)
+{
+        struct l2tp_session *session_walk;
+        struct hlist_head *g_head;
+        struct hlist_head *head;
+        struct l2tp_net *pn;
+
+        head = l2tp_session_id_hash(tunnel, session->session_id);
+
+        write_lock_bh(&tunnel->hlist_lock);
+        hlist_for_each_entry(session_walk, head, hlist)
+                if (session_walk->session_id == session->session_id)
+                        goto exist;
+
+        if (tunnel->version == L2TP_HDR_VER_3) {
+                pn = l2tp_pernet(tunnel->l2tp_net);
+                g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net),
+                                                session->session_id);
+
+                spin_lock_bh(&pn->l2tp_session_hlist_lock);
+                hlist_for_each_entry(session_walk, g_head, global_hlist)
+                        if (session_walk->session_id == session->session_id)
+                                goto exist_glob;
+
+                hlist_add_head_rcu(&session->global_hlist, g_head);
+                spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+        }
+
+        hlist_add_head(&session->hlist, head);
+        write_unlock_bh(&tunnel->hlist_lock);
+
+        return 0;
+
+exist_glob:
+        spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+exist:
+        write_unlock_bh(&tunnel->hlist_lock);
+
+        return -EEXIST;
+}
 
 /* Lookup a tunnel by id
  */
@@ -633,6 +733,9 @@ discard:
  * a data (not control) frame before coming here. Fields up to the
  * session-id have already been parsed and ptr points to the data
  * after the session-id.
+ *
+ * session->ref() must have been called prior to l2tp_recv_common().
+ * session->deref() will be called automatically after skb is processed.
  */
 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
@@ -642,14 +745,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         int offset;
         u32 ns, nr;
 
-        /* The ref count is increased since we now hold a pointer to
-         * the session. Take care to decrement the refcnt when exiting
-         * this function from now on...
-         */
-        l2tp_session_inc_refcount(session);
-        if (session->ref)
-                (*session->ref)(session);
-
         /* Parse and check optional cookie */
         if (session->peer_cookie_len > 0) {
                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
@@ -802,8 +897,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         /* Try to dequeue as many skbs from reorder_q as we can. */
         l2tp_recv_dequeue(session);
 
-        l2tp_session_dec_refcount(session);
-
         return;
 
 discard:
@@ -812,8 +905,6 @@ discard:
 
         if (session->deref)
                 (*session->deref)(session);
-
-        l2tp_session_dec_refcount(session);
 }
 EXPORT_SYMBOL(l2tp_recv_common);
 
@@ -920,8 +1011,14 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         }
 
         /* Find the session context */
-        session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
+        session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
         if (!session || !session->recv_skb) {
+                if (session) {
+                        if (session->deref)
+                                session->deref(session);
+                        l2tp_session_dec_refcount(session);
+                }
+
                 /* Not found? Pass to userspace to deal with */
                 l2tp_info(tunnel, L2TP_MSG_DATA,
                           "%s: no session found (%u/%u). Passing up.\n",
@@ -930,6 +1027,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         }
 
         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
+        l2tp_session_dec_refcount(session);
 
         return 0;
 
@@ -1738,6 +1836,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
         struct l2tp_session *session;
+        int err;
 
         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
         if (session != NULL) {
@@ -1793,6 +1892,13 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
 
                 l2tp_session_set_header_len(session, tunnel->version);
 
+                err = l2tp_session_add_to_tunnel(tunnel, session);
+                if (err) {
+                        kfree(session);
+
+                        return ERR_PTR(err);
+                }
+
                 /* Bump the reference count. The session context is deleted
                  * only when this drops to zero.
                  */
@@ -1802,28 +1908,14 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                 /* Ensure tunnel socket isn't deleted */
                 sock_hold(tunnel->sock);
 
-                /* Add session to the tunnel's hash list */
-                write_lock_bh(&tunnel->hlist_lock);
-                hlist_add_head(&session->hlist,
-                               l2tp_session_id_hash(tunnel, session_id));
-                write_unlock_bh(&tunnel->hlist_lock);
-
-                /* And to the global session list if L2TPv3 */
-                if (tunnel->version != L2TP_HDR_VER_2) {
-                        struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
-                        spin_lock_bh(&pn->l2tp_session_hlist_lock);
-                        hlist_add_head_rcu(&session->global_hlist,
-                                           l2tp_session_id_hash_2(pn, session_id));
-                        spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-                }
-
                 /* Ignore management session in session count value */
                 if (session->session_id != 0)
                         atomic_inc(&l2tp_session_count);
+
+                return session;
         }
 
-        return session;
+        return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL_GPL(l2tp_session_create);
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index aebf281d09ee..8ce7818c7a9d 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -230,11 +230,16 @@ out:
         return tunnel;
 }
 
+struct l2tp_session *l2tp_session_get(struct net *net,
+                                      struct l2tp_tunnel *tunnel,
+                                      u32 session_id, bool do_ref);
 struct l2tp_session *l2tp_session_find(struct net *net,
                                        struct l2tp_tunnel *tunnel,
                                        u32 session_id);
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
-struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref);
+struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+                                                bool do_ref);
 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth);
 
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 2d6760a2ae34..d100aed3d06f 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -53,7 +53,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -238,10 +238,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
         }
 
         /* Show the tunnel or session context */
-        if (pd->session == NULL)
+        if (!pd->session) {
                 l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                 l2tp_dfs_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 
 out:
         return 0;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8bf18a5f66e0..6fd41d7afe1e 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -221,12 +221,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
                 goto out;
         }
 
-        session = l2tp_session_find(net, tunnel, session_id);
-        if (session) {
-                rc = -EEXIST;
-                goto out;
-        }
-
         if (cfg->ifname) {
                 dev = dev_get_by_name(net, cfg->ifname);
                 if (dev) {
@@ -240,8 +234,8 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
 
         session = l2tp_session_create(sizeof(*spriv), tunnel, session_id,
                                       peer_session_id, cfg);
-        if (!session) {
-                rc = -ENOMEM;
+        if (IS_ERR(session)) {
+                rc = PTR_ERR(session);
                 goto out;
         }
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d25038cfd64e..4d322c1b7233 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -143,19 +143,19 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(net, NULL, session_id);
-        if (session == NULL)
+        session = l2tp_session_get(net, NULL, session_id, true);
+        if (!session)
                 goto discard;
 
         tunnel = session->tunnel;
-        if (tunnel == NULL)
-                goto discard;
+        if (!tunnel)
+                goto discard_sess;
 
         /* Trace packet contents, if enabled */
         if (tunnel->debug & L2TP_MSG_DATA) {
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
-                        goto discard;
+                        goto discard_sess;
 
                 /* Point to L2TP header */
                 optr = ptr = skb->data;
@@ -165,6 +165,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, tunnel->recv_payload_hook);
+        l2tp_session_dec_refcount(session);
 
         return 0;
 
@@ -178,9 +179,10 @@ pass_up:
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
         tunnel = l2tp_tunnel_find(net, tunnel_id);
-        if (tunnel != NULL)
+        if (tunnel) {
                 sk = tunnel->sock;
-        else {
+                sock_hold(sk);
+        } else {
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
@@ -202,6 +204,12 @@ pass_up:
 
         return sk_receive_skb(sk, skb, 1);
 
+discard_sess:
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+        goto discard;
+
 discard_put:
         sock_put(sk);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index a4abcbc4c09a..88b397c30d86 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -156,19 +156,19 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(net, NULL, session_id);
-        if (session == NULL)
+        session = l2tp_session_get(net, NULL, session_id, true);
+        if (!session)
                 goto discard;
 
         tunnel = session->tunnel;
-        if (tunnel == NULL)
-                goto discard;
+        if (!tunnel)
+                goto discard_sess;
 
         /* Trace packet contents, if enabled */
         if (tunnel->debug & L2TP_MSG_DATA) {
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
-                        goto discard;
+                        goto discard_sess;
 
                 /* Point to L2TP header */
                 optr = ptr = skb->data;
@@ -179,6 +179,8 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
 
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len,
                          tunnel->recv_payload_hook);
+        l2tp_session_dec_refcount(session);
+
         return 0;
 
 pass_up:
@@ -191,9 +193,10 @@ pass_up:
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
         tunnel = l2tp_tunnel_find(net, tunnel_id);
-        if (tunnel != NULL)
+        if (tunnel) {
                 sk = tunnel->sock;
-        else {
+                sock_hold(sk);
+        } else {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
@@ -215,6 +218,12 @@ pass_up:
 
         return sk_receive_skb(sk, skb, 1);
 
+discard_sess:
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+        goto discard;
+
 discard_put:
         sock_put(sk);
 
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 3620fba31786..7e3e669baac4 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -48,7 +48,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq,
 /* Accessed under genl lock */
 static const struct l2tp_nl_cmd_ops *l2tp_nl_cmd_ops[__L2TP_PWTYPE_MAX];
 
-static struct l2tp_session *l2tp_nl_session_find(struct genl_info *info)
+static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info,
+                                                bool do_ref)
 {
         u32 tunnel_id;
         u32 session_id;
@@ -59,14 +60,15 @@ static struct l2tp_session *l2tp_nl_session_find(struct genl_info *info)
 
         if (info->attrs[L2TP_ATTR_IFNAME]) {
                 ifname = nla_data(info->attrs[L2TP_ATTR_IFNAME]);
-                session = l2tp_session_find_by_ifname(net, ifname);
+                session = l2tp_session_get_by_ifname(net, ifname, do_ref);
         } else if ((info->attrs[L2TP_ATTR_SESSION_ID]) &&
                    (info->attrs[L2TP_ATTR_CONN_ID])) {
                 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
                 session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
                 tunnel = l2tp_tunnel_find(net, tunnel_id);
                 if (tunnel)
-                        session = l2tp_session_find(net, tunnel, session_id);
+                        session = l2tp_session_get(net, tunnel, session_id,
+                                                   do_ref);
         }
 
         return session;
@@ -642,10 +644,12 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
                         session_id, peer_session_id, &cfg);
 
         if (ret >= 0) {
-                session = l2tp_session_find(net, tunnel, session_id);
-                if (session)
+                session = l2tp_session_get(net, tunnel, session_id, false);
+                if (session) {
                         ret = l2tp_session_notify(&l2tp_nl_family, info, session,
                                                   L2TP_CMD_SESSION_CREATE);
+                        l2tp_session_dec_refcount(session);
+                }
         }
 
 out:
@@ -658,7 +662,7 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
         struct l2tp_session *session;
         u16 pw_type;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, true);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -672,6 +676,10 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
                 if (l2tp_nl_cmd_ops[pw_type] && l2tp_nl_cmd_ops[pw_type]->session_delete)
                         ret = (*l2tp_nl_cmd_ops[pw_type]->session_delete)(session);
 
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+
 out:
         return ret;
 }
@@ -681,7 +689,7 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         int ret = 0;
         struct l2tp_session *session;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, false);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -716,6 +724,8 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         ret = l2tp_session_notify(&l2tp_nl_family, info,
                                   session, L2TP_CMD_SESSION_MODIFY);
 
+        l2tp_session_dec_refcount(session);
+
 out:
         return ret;
 }
@@ -811,29 +821,34 @@ static int l2tp_nl_cmd_session_get(struct sk_buff *skb, struct genl_info *info)
         struct sk_buff *msg;
         int ret;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, false);
         if (session == NULL) {
                 ret = -ENODEV;
-                goto out;
+                goto err;
         }
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 ret = -ENOMEM;
-                goto out;
+                goto err_ref;
         }
 
         ret = l2tp_nl_session_send(msg, info->snd_portid, info->snd_seq,
                                    0, session, L2TP_CMD_SESSION_GET);
         if (ret < 0)
-                goto err_out;
+                goto err_ref_msg;
 
-        return genlmsg_unicast(genl_info_net(info), msg, info->snd_portid);
+        ret = genlmsg_unicast(genl_info_net(info), msg, info->snd_portid);
 
-err_out:
-        nlmsg_free(msg);
+        l2tp_session_dec_refcount(session);
 
-out:
+        return ret;
+
+err_ref_msg:
+        nlmsg_free(msg);
+err_ref:
+        l2tp_session_dec_refcount(session);
+err:
         return ret;
 }
 
@@ -852,7 +867,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                                 goto out;
                 }
 
-                session = l2tp_session_find_nth(tunnel, si);
+                session = l2tp_session_get_nth(tunnel, si, false);
                 if (session == NULL) {
                         ti++;
                         tunnel = NULL;
@@ -862,8 +877,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
 
                 if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                         session, L2TP_CMD_SESSION_GET) < 0)
+                                         session, L2TP_CMD_SESSION_GET) < 0) {
+                        l2tp_session_dec_refcount(session);
                         break;
+                }
+                l2tp_session_dec_refcount(session);
 
                 si++;
         }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 36cc56fd0418..32ea0f3d868c 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -450,6 +450,10 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 static void pppol2tp_session_destruct(struct sock *sk)
 {
         struct l2tp_session *session = sk->sk_user_data;
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+
         if (session) {
                 sk->sk_user_data = NULL;
                 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
@@ -488,9 +492,6 @@ static int pppol2tp_release(struct socket *sock)
                 l2tp_session_queue_purge(session);
                 sock_put(sk);
         }
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-
         release_sock(sk);
 
         /* This will delete the session context via
@@ -582,6 +583,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         int error = 0;
         u32 tunnel_id, peer_tunnel_id;
         u32 session_id, peer_session_id;
+        bool drop_refcnt = false;
         int ver = 2;
         int fd;
 
@@ -683,36 +685,36 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (tunnel->peer_tunnel_id == 0)
                 tunnel->peer_tunnel_id = peer_tunnel_id;
 
-        /* Create session if it doesn't already exist. We handle the
-         * case where a session was previously created by the netlink
-         * interface by checking that the session doesn't already have
-         * a socket and its tunnel socket are what we expect. If any
-         * of those checks fail, return EEXIST to the caller.
-         */
-        session = l2tp_session_find(sock_net(sk), tunnel, session_id);
-        if (session == NULL) {
-                /* Default MTU must allow space for UDP/L2TP/PPP
-                 * headers.
+        session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
+        if (session) {
+                drop_refcnt = true;
+                ps = l2tp_session_priv(session);
+
+                /* Using a pre-existing session is fine as long as it hasn't
+                 * been connected yet.
                  */
-                cfg.mtu = cfg.mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
+                if (ps->sock) {
+                        error = -EEXIST;
+                        goto end;
+                }
 
-                /* Allocate and initialize a new session context. */
-                session = l2tp_session_create(sizeof(struct pppol2tp_session),
-                                              tunnel, session_id,
-                                              peer_session_id, &cfg);
-                if (session == NULL) {
-                        error = -ENOMEM;
+                /* consistency checks */
+                if (ps->tunnel_sock != tunnel->sock) {
+                        error = -EEXIST;
                         goto end;
                 }
         } else {
-                ps = l2tp_session_priv(session);
-                error = -EEXIST;
-                if (ps->sock != NULL)
-                        goto end;
+                /* Default MTU must allow space for UDP/L2TP/PPP headers */
+                cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
+                cfg.mru = cfg.mtu;
 
-                /* consistency checks */
-                if (ps->tunnel_sock != tunnel->sock)
+                session = l2tp_session_create(sizeof(struct pppol2tp_session),
+                                              tunnel, session_id,
+                                              peer_session_id, &cfg);
+                if (IS_ERR(session)) {
+                        error = PTR_ERR(session);
                         goto end;
+                }
         }
 
         /* Associate session with its PPPoL2TP socket */
@@ -777,6 +779,8 @@ out_no_ppp:
                   session->name);
 
 end:
+        if (drop_refcnt)
+                l2tp_session_dec_refcount(session);
         release_sock(sk);
 
         return error;
@@ -804,12 +808,6 @@ static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_i
         if (tunnel->sock == NULL)
                 goto out;
 
-        /* Check that this session doesn't already exist */
-        error = -EEXIST;
-        session = l2tp_session_find(net, tunnel, session_id);
-        if (session != NULL)
-                goto out;
-
         /* Default MTU values. */
         if (cfg->mtu == 0)
                 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
@@ -817,12 +815,13 @@ static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_i
                 cfg->mru = cfg->mtu;
 
         /* Allocate and initialize a new session context. */
-        error = -ENOMEM;
         session = l2tp_session_create(sizeof(struct pppol2tp_session),
                                       tunnel, session_id,
                                       peer_session_id, cfg);
-        if (session == NULL)
+        if (IS_ERR(session)) {
+                error = PTR_ERR(session);
                 goto out;
+        }
 
         ps = l2tp_session_priv(session);
         ps->tunnel_sock = tunnel->sock;
@@ -1140,11 +1139,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                 if (stats.session_id != 0) {
                         /* resend to session ioctl handler */
                         struct l2tp_session *session =
-                                l2tp_session_find(sock_net(sk), tunnel, stats.session_id);
-                        if (session != NULL)
-                                err = pppol2tp_session_ioctl(session, cmd, arg);
-                        else
+                                l2tp_session_get(sock_net(sk), tunnel,
+                                                 stats.session_id, true);
+
+                        if (session) {
+                                err = pppol2tp_session_ioctl(session, cmd,
+                                                             arg);
+                                if (session->deref)
+                                        session->deref(session);
+                                l2tp_session_dec_refcount(session);
+                        } else {
                                 err = -EBADR;
+                        }
                         break;
                 }
 #ifdef CONFIG_XFRM
@@ -1377,8 +1383,6 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
         } else
                 err = pppol2tp_session_setsockopt(sk, session, optname, val);
 
-        err = 0;
-
 end_put_sess:
         sock_put(sk);
 end:
@@ -1501,8 +1505,13 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
 
                 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
                 sock_put(ps->tunnel_sock);
-        } else
+                if (err)
+                        goto end_put_sess;
+        } else {
                 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
+                if (err)
+                        goto end_put_sess;
+        }
 
         err = -EFAULT;
         if (put_user(len, optlen))
@@ -1554,7 +1563,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -1681,10 +1690,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
 
         /* Show the tunnel or session context.
          */
-        if (pd->session == NULL)
+        if (!pd->session) {
                 pppol2tp_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                 pppol2tp_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 
 out:
         return 0;
@@ -1843,4 +1856,4 @@ MODULE_DESCRIPTION("PPP over L2TP over UDP");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
-MODULE_ALIAS_L2TP_PWTYPE(11);
+MODULE_ALIAS_L2TP_PWTYPE(7);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 40813dd3301c..5bb0c5012819 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -718,7 +718,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         ieee80211_recalc_ps(local);
 
         if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            local->ops->wake_tx_queue) {
                 /* XXX: for AP_VLAN, actually track AP queues */
                 netif_tx_start_all_queues(dev);
         } else if (dev) {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e48724a6725e..4d7543d1a62c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -208,6 +208,51 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
         return len;
 }
 
+static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
+                                         struct sk_buff *skb,
+                                         int rtap_vendor_space)
+{
+        struct {
+                struct ieee80211_hdr_3addr hdr;
+                u8 category;
+                u8 action_code;
+        } __packed action;
+
+        if (!sdata)
+                return;
+
+        BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
+
+        if (skb->len < rtap_vendor_space + sizeof(action) +
+                       VHT_MUMIMO_GROUPS_DATA_LEN)
+                return;
+
+        if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
+                return;
+
+        skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
+
+        if (!ieee80211_is_action(action.hdr.frame_control))
+                return;
+
+        if (action.category != WLAN_CATEGORY_VHT)
+                return;
+
+        if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
+                return;
+
+        if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
+                return;
+
+        skb = skb_copy(skb, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
 /*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
@@ -515,7 +560,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         struct net_device *prev_dev = NULL;
         int present_fcs_len = 0;
         unsigned int rtap_vendor_space = 0;
-        struct ieee80211_mgmt *mgmt;
         struct ieee80211_sub_if_data *monitor_sdata =
                 rcu_dereference(local->monitor_sdata);
 
@@ -553,6 +597,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 return remove_monitor_info(local, origskb, rtap_vendor_space);
         }
 
+        ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
+
         /* room for the radiotap header based on driver features */
         rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
         needed_headroom = rt_hdrlen - rtap_vendor_space;
@@ -618,23 +664,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 ieee80211_rx_stats(sdata->dev, skb->len);
         }
 
-        mgmt = (void *)skb->data;
-        if (monitor_sdata &&
-            skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + VHT_MUMIMO_GROUPS_DATA_LEN &&
-            ieee80211_is_action(mgmt->frame_control) &&
-            mgmt->u.action.category == WLAN_CATEGORY_VHT &&
-            mgmt->u.action.u.vht_group_notif.action_code == WLAN_VHT_ACTION_GROUPID_MGMT &&
-            is_valid_ether_addr(monitor_sdata->u.mntr.mu_follow_addr) &&
-            ether_addr_equal(mgmt->da, monitor_sdata->u.mntr.mu_follow_addr)) {
-                struct sk_buff *mu_skb = skb_copy(skb, GFP_ATOMIC);
-
-                if (mu_skb) {
-                        mu_skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
-                        skb_queue_tail(&monitor_sdata->skb_queue, mu_skb);
-                        ieee80211_queue_work(&local->hw, &monitor_sdata->work);
-                }
-        }
-
         if (prev_dev) {
                 skb->dev = prev_dev;
                 netif_receive_skb(skb);
@@ -3610,6 +3639,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
                             !ether_addr_equal(bssid, hdr->addr1))
                                 return false;
                 }
+
+                /*
+                 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
+                 * the BSSID - we've checked that already but may have accepted
+                 * the wildcard (ff:ff:ff:ff:ff:ff).
+                 *
+                 * It also says:
+                 *      The BSSID of the Data frame is determined as follows:
+                 *      a) If the STA is contained within an AP or is associated
+                 *         with an AP, the BSSID is the address currently in use
+                 *         by the STA contained in the AP.
+                 *
+                 * So we should not accept data frames with an address that's
+                 * multicast.
+                 *
+                 * Accepting it also opens a security problem because stations
+                 * could encrypt it with the GTK and inject traffic that way.
+                 */
+                if (ieee80211_is_data(hdr->frame_control) && multicast)
+                        return false;
+
                 return true;
         case NL80211_IFTYPE_WDS:
                 if (bssid || !ieee80211_is_data(hdr->frame_control))
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 33211f9a2656..6414079aa729 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1269,6 +1269,8 @@ static void mpls_ifdown(struct net_device *dev, int event)
 {
         struct mpls_route __rcu **platform_label;
         struct net *net = dev_net(dev);
+        unsigned int nh_flags = RTNH_F_DEAD | RTNH_F_LINKDOWN;
+        unsigned int alive;
         unsigned index;
 
         platform_label = rtnl_dereference(net->mpls.platform_label);
@@ -1278,9 +1280,11 @@ static void mpls_ifdown(struct net_device *dev, int event)
                 if (!rt)
                         continue;
 
+                alive = 0;
                 change_nexthops(rt) {
                         if (rtnl_dereference(nh->nh_dev) != dev)
-                                continue;
+                                goto next;
+
                         switch (event) {
                         case NETDEV_DOWN:
                         case NETDEV_UNREGISTER:
@@ -1288,13 +1292,16 @@ static void mpls_ifdown(struct net_device *dev, int event)
                                 /* fall through */
                         case NETDEV_CHANGE:
                                 nh->nh_flags |= RTNH_F_LINKDOWN;
-                                if (event != NETDEV_UNREGISTER)
-                                        ACCESS_ONCE(rt->rt_nhn_alive) = rt->rt_nhn_alive - 1;
                                 break;
                         }
                         if (event == NETDEV_UNREGISTER)
                                 RCU_INIT_POINTER(nh->nh_dev, NULL);
+next:
+                        if (!(nh->nh_flags & nh_flags))
+                                alive++;
                 } endfor_nexthops(rt);
+
+                WRITE_ONCE(rt->rt_nhn_alive, alive);
         }
 }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 071b97fcbefb..ffb78e5f7b70 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -181,7 +181,11 @@ EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 unsigned int nf_conntrack_max __read_mostly;
 seqcount_t nf_conntrack_generation __read_mostly;
 
-DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+/* nf_conn must be 8 bytes aligned, as the 3 LSB bits are used
+ * for the nfctinfo. We cheat by (ab)using the PER CPU cache line
+ * alignment to enforce this.
+ */
+DEFINE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
 
 static unsigned int nf_conntrack_hash_rnd __read_mostly;
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index da9df2d56e66..22fc32143e9c 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -290,6 +290,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
         BUG_ON(notify != new);
         RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
+        /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
@@ -326,6 +327,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
         BUG_ON(notify != new);
         RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
+        /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4b2e1fb28bb4..d80073037856 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -57,7 +57,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
         hlist_del_rcu(&exp->hnode);
         net->ct.expect_count--;
 
-        hlist_del(&exp->lnode);
+        hlist_del_rcu(&exp->lnode);
         master_help->expecting[exp->class]--;
 
         nf_ct_expect_event_report(IPEXP_DESTROY, exp, portid, report);
@@ -363,7 +363,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         /* two references : one for hash insert, one for the timer */
         atomic_add(2, &exp->use);
 
-        hlist_add_head(&exp->lnode, &master_help->expectations);
+        hlist_add_head_rcu(&exp->lnode, &master_help->expectations);
         master_help->expecting[exp->class]++;
 
         hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 02bcf00c2492..008299b7f78f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -53,7 +53,11 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id,
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
+
         off = ALIGN(sizeof(struct nf_ct_ext), t->align);
         len = off + t->len + var_alloc_len;
         alloc_size = t->alloc_size + var_alloc_len;
@@ -88,7 +92,10 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
 
         newoff = ALIGN(old->len, t->align);
         newlen = newoff + t->len + var_alloc_len;
@@ -175,6 +182,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type)
         RCU_INIT_POINTER(nf_ct_ext_types[type->id], NULL);
         update_alloc_size(type);
         mutex_unlock(&nf_ct_ext_type_mutex);
-        rcu_barrier(); /* Wait for completion of call_rcu()'s */
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 6dc44d9b4190..4eeb3418366a 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -158,16 +158,25 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 {
         struct nf_conntrack_helper *h;
 
+        rcu_read_lock();
+
         h = __nf_conntrack_helper_find(name, l3num, protonum);
 #ifdef CONFIG_MODULES
         if (h == NULL) {
-                if (request_module("nfct-helper-%s", name) == 0)
+                rcu_read_unlock();
+                if (request_module("nfct-helper-%s", name) == 0) {
+                        rcu_read_lock();
                         h = __nf_conntrack_helper_find(name, l3num, protonum);
+                } else {
+                        return h;
+                }
         }
 #endif
         if (h != NULL && !try_module_get(h->me))
                 h = NULL;
 
+        rcu_read_unlock();
+
         return h;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
@@ -311,38 +320,36 @@ void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n)
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister);
 
+/* Caller should hold the rcu lock */
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_name(const char *name)
 {
         struct nf_ct_helper_expectfn *cur;
         bool found = false;
 
-        rcu_read_lock();
         list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
                 if (!strcmp(cur->name, name)) {
                         found = true;
                         break;
                 }
         }
-        rcu_read_unlock();
         return found ? cur : NULL;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name);
 
+/* Caller should hold the rcu lock */
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol)
 {
         struct nf_ct_helper_expectfn *cur;
         bool found = false;
 
-        rcu_read_lock();
         list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
                 if (cur->expectfn == symbol) {
                         found = true;
                         break;
                 }
         }
-        rcu_read_unlock();
         return found ? cur : NULL;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6806b5e73567..dc7dfd68fafe 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1488,11 +1488,16 @@ static int ctnetlink_change_helper(struct nf_conn *ct,
                  * treat the second attempt as a no-op instead of returning
                  * an error.
                  */
-                if (help && help->helper &&
-                    !strcmp(help->helper->name, helpname))
-                        return 0;
-                else
-                        return -EBUSY;
+                err = -EBUSY;
+                if (help) {
+                        rcu_read_lock();
+                        helper = rcu_dereference(help->helper);
+                        if (helper && !strcmp(helper->name, helpname))
+                                err = 0;
+                        rcu_read_unlock();
+                }
+
+                return err;
         }
 
         if (!strcmp(helpname, "")) {
@@ -1929,9 +1934,9 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
 
                         err = 0;
                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
-                                events = IPCT_RELATED;
+                                events = 1 << IPCT_RELATED;
                         else
-                                events = IPCT_NEW;
+                                events = 1 << IPCT_NEW;
 
                         if (cda[CTA_LABELS] &&
                             ctnetlink_attach_labels(ct, cda) == 0)
@@ -2675,8 +2680,8 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(exp, &nf_ct_expect_hash[cb->args[0]],
-                                     hnode) {
+                hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
+                                         hnode) {
                         if (l3proto && exp->tuple.src.l3num != l3proto)
                                 continue;
 
@@ -2727,7 +2732,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         last = (struct nf_conntrack_expect *)cb->args[1];
 restart:
-        hlist_for_each_entry(exp, &help->expectations, lnode) {
+        hlist_for_each_entry_rcu(exp, &help->expectations, lnode) {
                 if (l3proto && exp->tuple.src.l3num != l3proto)
                         continue;
                 if (cb->args[1]) {
@@ -2789,6 +2794,12 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
                 return -ENOENT;
 
         ct = nf_ct_tuplehash_to_ctrack(h);
+        /* No expectation linked to this connection tracking. */
+        if (!nfct_help(ct)) {
+                nf_ct_put(ct);
+                return 0;
+        }
+
         c.data = ct;
 
         err = netlink_dump_start(ctnl, skb, nlh, &c);
@@ -3133,23 +3144,27 @@ ctnetlink_create_expect(struct net *net,
                 return -ENOENT;
         ct = nf_ct_tuplehash_to_ctrack(h);
 
+        rcu_read_lock();
         if (cda[CTA_EXPECT_HELP_NAME]) {
                 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
 
                 helper = __nf_conntrack_helper_find(helpname, u3,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
+                        rcu_read_unlock();
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
                                 err = -EOPNOTSUPP;
                                 goto err_ct;
                         }
+                        rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname, u3,
                                                             nf_ct_protonum(ct));
                         if (helper) {
                                 err = -EAGAIN;
-                                goto err_ct;
+                                goto err_rcu;
                         }
+                        rcu_read_unlock();
 #endif
                         err = -EOPNOTSUPP;
                         goto err_ct;
@@ -3159,11 +3174,13 @@ ctnetlink_create_expect(struct net *net,
         exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
         if (IS_ERR(exp)) {
                 err = PTR_ERR(exp);
-                goto err_ct;
+                goto err_rcu;
         }
 
         err = nf_ct_expect_related_report(exp, portid, report);
         nf_ct_expect_put(exp);
+err_rcu:
+        rcu_read_unlock();
 err_ct:
         nf_ct_put(ct);
         return err;
@@ -3442,6 +3459,7 @@ static void __exit ctnetlink_exit(void)
 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
         RCU_INIT_POINTER(nfnl_ct_hook, NULL);
 #endif
+        synchronize_rcu();
 }
 
 module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 94b14c5a8b17..82802e4a6640 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -903,6 +903,8 @@ static void __exit nf_nat_cleanup(void)
 #ifdef CONFIG_XFRM
         RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
+        synchronize_rcu();
+
         for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 kfree(nf_nat_l4protos[i]);
 
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index 31d358691af0..804e8a0ab36e 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -33,8 +33,16 @@ sctp_manip_pkt(struct sk_buff *skb,
                enum nf_nat_manip_type maniptype)
 {
         sctp_sctphdr_t *hdr;
+        int hdrsize = 8;
 
-        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
+        /* This could be an inner header returned in imcp packet; in such
+         * cases we cannot update the checksum field since it is outside
+         * of the 8 bytes of transport layer headers we are guaranteed.
+         */
+        if (skb->len >= hdroff + sizeof(*hdr))
+                hdrsize = sizeof(*hdr);
+
+        if (!skb_make_writable(skb, hdroff + hdrsize))
                 return false;
 
         hdr = (struct sctphdr *)(skb->data + hdroff);
@@ -47,6 +55,9 @@ sctp_manip_pkt(struct sk_buff *skb,
                 hdr->dest = tuple->dst.u.sctp.port;
         }
 
+        if (hdrsize < sizeof(*hdr))
+                return true;
+
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
                 hdr->checksum = sctp_compute_cksum(skb, hdroff);
                 skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index d43869879fcf..86067560a318 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -101,11 +101,13 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
                 rcu_read_lock();
                 idev = __in6_dev_get(skb->dev);
                 if (idev != NULL) {
+                        read_lock_bh(&idev->lock);
                         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                                 newdst = ifa->addr;
                                 addr = true;
                                 break;
                         }
+                        read_unlock_bh(&idev->lock);
                 }
                 rcu_read_unlock();
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5e0ccfd5bb37..434c739dfeca 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3145,7 +3145,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                 iter.count      = 0;
                 iter.err        = 0;
                 iter.fn         = nf_tables_bind_check_setelem;
-                iter.flush      = false;
 
                 set->ops->walk(ctx, set, &iter);
                 if (iter.err < 0)
@@ -3399,7 +3398,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        args.iter.flush         = false;
         set->ops->walk(&ctx, set, &args.iter);
 
         nla_nest_end(skb, nest);
@@ -3963,7 +3961,6 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
                 struct nft_set_iter iter = {
                         .genmask        = genmask,
                         .fn             = nft_flush_set,
-                        .flush          = true,
                 };
                 set->ops->walk(&ctx, set, &iter);
 
@@ -5114,7 +5111,6 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                         iter.count      = 0;
                         iter.err        = 0;
                         iter.fn         = nf_tables_loop_check_setelem;
-                        iter.flush      = false;
 
                         set->ops->walk(ctx, set, &iter);
                         if (iter.err < 0)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index de8782345c86..d45558178da5 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -32,6 +32,13 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
 
+struct nfnl_cthelper {
+        struct list_head                list;
+        struct nf_conntrack_helper      helper;
+};
+
+static LIST_HEAD(nfnl_cthelper_list);
+
 static int
 nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
                         struct nf_conn *ct, enum ip_conntrack_info ctinfo)
@@ -161,6 +168,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         int i, ret;
         struct nf_conntrack_expect_policy *expect_policy;
         struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
+        unsigned int class_max;
 
         ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
                                nfnl_cthelper_expect_policy_set);
@@ -170,19 +178,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         if (!tb[NFCTH_POLICY_SET_NUM])
                 return -EINVAL;
 
-        helper->expect_class_max =
-                ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
-
-        if (helper->expect_class_max != 0 &&
-            helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)
+        class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+        if (class_max == 0)
+                return -EINVAL;
+        if (class_max > NF_CT_MAX_EXPECT_CLASSES)
                 return -EOVERFLOW;
 
         expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
-                                helper->expect_class_max, GFP_KERNEL);
+                                class_max, GFP_KERNEL);
         if (expect_policy == NULL)
                 return -ENOMEM;
 
-        for (i=0; i<helper->expect_class_max; i++) {
+        for (i = 0; i < class_max; i++) {
                 if (!tb[NFCTH_POLICY_SET+i])
                         goto err;
 
@@ -191,6 +198,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
                 if (ret < 0)
                         goto err;
         }
+
+        helper->expect_class_max = class_max - 1;
         helper->expect_policy = expect_policy;
         return 0;
 err:
@@ -203,18 +212,20 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                      struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_helper *helper;
+        struct nfnl_cthelper *nfcth;
         int ret;
 
         if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
                 return -EINVAL;
 
-        helper = kzalloc(sizeof(struct nf_conntrack_helper), GFP_KERNEL);
-        if (helper == NULL)
+        nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL);
+        if (nfcth == NULL)
                 return -ENOMEM;
+        helper = &nfcth->helper;
 
         ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
         if (ret < 0)
-                goto err;
+                goto err1;
 
         strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
         helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
@@ -245,15 +256,101 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
 
         ret = nf_conntrack_helper_register(helper);
         if (ret < 0)
-                goto err;
+                goto err2;
 
+        list_add_tail(&nfcth->list, &nfnl_cthelper_list);
         return 0;
-err:
-        kfree(helper);
+err2:
+        kfree(helper->expect_policy);
+err1:
+        kfree(nfcth);
         return ret;
 }
 
 static int
+nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
+                                struct nf_conntrack_expect_policy *new_policy,
+                                const struct nlattr *attr)
+{
+        struct nlattr *tb[NFCTH_POLICY_MAX + 1];
+        int err;
+
+        err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr,
+                               nfnl_cthelper_expect_pol);
+        if (err < 0)
+                return err;
+
+        if (!tb[NFCTH_POLICY_NAME] ||
+            !tb[NFCTH_POLICY_EXPECT_MAX] ||
+            !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
+                return -EINVAL;
+
+        if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
+                return -EBUSY;
+
+        new_policy->max_expected =
+                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
+        new_policy->timeout =
+                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
+
+        return 0;
+}
+
+static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
+                                           struct nf_conntrack_helper *helper)
+{
+        struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
+        struct nf_conntrack_expect_policy *policy;
+        int i, err;
+
+        /* Check first that all policy attributes are well-formed, so we don't
+         * leave things in inconsistent state on errors.
+         */
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
+
+                if (!tb[NFCTH_POLICY_SET + i])
+                        return -EINVAL;
+
+                err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
+                                                      &new_policy[i],
+                                                      tb[NFCTH_POLICY_SET + i]);
+                if (err < 0)
+                        return err;
+        }
+        /* Now we can safely update them. */
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
+                policy = (struct nf_conntrack_expect_policy *)
+                                &helper->expect_policy[i];
+                policy->max_expected = new_policy->max_expected;
+                policy->timeout = new_policy->timeout;
+        }
+
+        return 0;
+}
+
+static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
+                                       const struct nlattr *attr)
+{
+        struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
+        unsigned int class_max;
+        int err;
+
+        err = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
+                               nfnl_cthelper_expect_policy_set);
+        if (err < 0)
+                return err;
+
+        if (!tb[NFCTH_POLICY_SET_NUM])
+                return -EINVAL;
+
+        class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+        if (helper->expect_class_max + 1 != class_max)
+                return -EBUSY;
+
+        return nfnl_cthelper_update_policy_all(tb, helper);
+}
+
+static int
 nfnl_cthelper_update(const struct nlattr * const tb[],
                      struct nf_conntrack_helper *helper)
 {
@@ -263,8 +360,7 @@ nfnl_cthelper_update(const struct nlattr * const tb[],
                 return -EBUSY;
 
         if (tb[NFCTH_POLICY]) {
-                ret = nfnl_cthelper_parse_expect_policy(helper,
-                                                        tb[NFCTH_POLICY]);
+                ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
                 if (ret < 0)
                         return ret;
         }
@@ -293,7 +389,8 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
         const char *helper_name;
         struct nf_conntrack_helper *cur, *helper = NULL;
         struct nf_conntrack_tuple tuple;
-        int ret = 0, i;
+        struct nfnl_cthelper *nlcth;
+        int ret = 0;
 
         if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
                 return -EINVAL;
@@ -304,31 +401,22 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
         if (ret < 0)
                 return ret;
 
-        rcu_read_lock();
-        for (i = 0; i < nf_ct_helper_hsize && !helper; i++) {
-                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
+        list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
 
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+                if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        if (strncmp(cur->name, helper_name,
-                                        NF_CT_HELPER_NAME_LEN) != 0)
-                                continue;
+                if ((tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        if ((tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
+                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                        return -EEXIST;
 
-                        if (nlh->nlmsg_flags & NLM_F_EXCL) {
-                                ret = -EEXIST;
-                                goto err;
-                        }
-                        helper = cur;
-                        break;
-                }
+                helper = cur;
+                break;
         }
-        rcu_read_unlock();
 
         if (helper == NULL)
                 ret = nfnl_cthelper_create(tb, &tuple);
@@ -336,9 +424,6 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
                 ret = nfnl_cthelper_update(tb, helper);
 
         return ret;
-err:
-        rcu_read_unlock();
-        return ret;
 }
 
 static int
@@ -377,10 +462,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
-                         htonl(helper->expect_class_max)))
+                         htonl(helper->expect_class_max + 1)))
                 goto nla_put_failure;
 
-        for (i=0; i<helper->expect_class_max; i++) {
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
                 nest_parms2 = nla_nest_start(skb,
                                 (NFCTH_POLICY_SET+i) | NLA_F_NESTED);
                 if (nest_parms2 == NULL)
@@ -502,11 +587,12 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                              const struct nlattr * const tb[])
 {
-        int ret = -ENOENT, i;
+        int ret = -ENOENT;
         struct nf_conntrack_helper *cur;
         struct sk_buff *skb2;
         char *helper_name = NULL;
         struct nf_conntrack_tuple tuple;
+        struct nfnl_cthelper *nlcth;
         bool tuple_set = false;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
@@ -527,45 +613,39 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
-        for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
+        list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
+                if (helper_name &&
+                    strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+                if (tuple_set &&
+                    (tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        if (helper_name && strncmp(cur->name, helper_name,
-                                                NF_CT_HELPER_NAME_LEN) != 0) {
-                                continue;
-                        }
-                        if (tuple_set &&
-                            (tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
-
-                        skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-                        if (skb2 == NULL) {
-                                ret = -ENOMEM;
-                                break;
-                        }
+                skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                if (skb2 == NULL) {
+                        ret = -ENOMEM;
+                        break;
+                }
 
-                        ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
-                                                nlh->nlmsg_seq,
-                                                NFNL_MSG_TYPE(nlh->nlmsg_type),
-                                                NFNL_MSG_CTHELPER_NEW, cur);
-                        if (ret <= 0) {
-                                kfree_skb(skb2);
-                                break;
-                        }
+                ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
+                                              nlh->nlmsg_seq,
+                                              NFNL_MSG_TYPE(nlh->nlmsg_type),
+                                              NFNL_MSG_CTHELPER_NEW, cur);
+                if (ret <= 0) {
+                        kfree_skb(skb2);
+                        break;
+                }
 
-                        ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
-                                                MSG_DONTWAIT);
-                        if (ret > 0)
-                                ret = 0;
+                ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
+                                      MSG_DONTWAIT);
+                if (ret > 0)
+                        ret = 0;
 
-                        /* this avoids a loop in nfnetlink. */
-                        return ret == -EAGAIN ? -ENOBUFS : ret;
-                }
+                /* this avoids a loop in nfnetlink. */
+                return ret == -EAGAIN ? -ENOBUFS : ret;
         }
         return ret;
 }
@@ -576,10 +656,10 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
 {
         char *helper_name = NULL;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *tmp;
         struct nf_conntrack_tuple tuple;
         bool tuple_set = false, found = false;
-        int i, j = 0, ret;
+        struct nfnl_cthelper *nlcth, *n;
+        int j = 0, ret;
 
         if (tb[NFCTH_NAME])
                 helper_name = nla_data(tb[NFCTH_NAME]);
@@ -592,28 +672,27 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
-        for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
-                                                                hnode) {
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+        list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
+                j++;
 
-                        j++;
+                if (helper_name &&
+                    strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        if (helper_name && strncmp(cur->name, helper_name,
-                                                NF_CT_HELPER_NAME_LEN) != 0) {
-                                continue;
-                        }
-                        if (tuple_set &&
-                            (tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
+                if (tuple_set &&
+                    (tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        found = true;
-                        nf_conntrack_helper_unregister(cur);
-                }
+                found = true;
+                nf_conntrack_helper_unregister(cur);
+                kfree(cur->expect_policy);
+
+                list_del(&nlcth->list);
+                kfree(nlcth);
         }
+
         /* Make sure we return success if we flush and there is no helpers */
         return (found || j == 0) ? 0 : -ENOENT;
 }
@@ -662,20 +741,16 @@ err_out:
 static void __exit nfnl_cthelper_exit(void)
 {
         struct nf_conntrack_helper *cur;
-        struct hlist_node *tmp;
-        int i;
+        struct nfnl_cthelper *nlcth, *n;
 
         nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
 
-        for (i=0; i<nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
-                                                                        hnode) {
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+        list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
 
-                        nf_conntrack_helper_unregister(cur);
-                }
+                nf_conntrack_helper_unregister(cur);
+                kfree(cur->expect_policy);
+                kfree(nlcth);
         }
 }
 
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 139e0867e56e..47d6656c9119 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -646,8 +646,8 @@ static void __exit cttimeout_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
         RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+        synchronize_rcu();
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-        rcu_barrier();
 }
 
 module_init(cttimeout_init);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 3ee0b8a000a4..933509ebf3d3 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -443,7 +443,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         skb = alloc_skb(size, GFP_ATOMIC);
         if (!skb) {
                 skb_tx_error(entskb);
-                return NULL;
+                goto nlmsg_failure;
         }
 
         nlh = nlmsg_put(skb, 0, 0,
@@ -452,7 +452,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         if (!nlh) {
                 skb_tx_error(entskb);
                 kfree_skb(skb);
-                return NULL;
+                goto nlmsg_failure;
         }
         nfmsg = nlmsg_data(nlh);
         nfmsg->nfgen_family = entry->state.pf;
@@ -598,12 +598,17 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         }
 
         nlh->nlmsg_len = skb->len;
+        if (seclen)
+                security_release_secctx(secdata, seclen);
         return skb;
 
 nla_put_failure:
         skb_tx_error(entskb);
         kfree_skb(skb);
         net_err_ratelimited("nf_queue: error creating packet message\n");
+nlmsg_failure:
+        if (seclen)
+                security_release_secctx(secdata, seclen);
         return NULL;
 }
 
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index bf548a7a71ec..0264258c46fe 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -83,7 +83,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 
         switch (priv->key) {
         case NFT_CT_DIRECTION:
-                *dest = CTINFO2DIR(ctinfo);
+                nft_reg_store8(dest, CTINFO2DIR(ctinfo));
                 return;
         case NFT_CT_STATUS:
                 *dest = ct->status;
@@ -151,20 +151,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 return;
         }
         case NFT_CT_L3PROTOCOL:
-                *dest = nf_ct_l3num(ct);
+                nft_reg_store8(dest, nf_ct_l3num(ct));
                 return;
         case NFT_CT_PROTOCOL:
-                *dest = nf_ct_protonum(ct);
+                nft_reg_store8(dest, nf_ct_protonum(ct));
                 return;
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         case NFT_CT_ZONE: {
                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
+                u16 zoneid;
 
                 if (priv->dir < IP_CT_DIR_MAX)
-                        *dest = nf_ct_zone_id(zone, priv->dir);
+                        zoneid = nf_ct_zone_id(zone, priv->dir);
                 else
-                        *dest = zone->id;
+                        zoneid = zone->id;
 
+                nft_reg_store16(dest, zoneid);
                 return;
         }
 #endif
@@ -183,10 +185,10 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
                 return;
         case NFT_CT_PROTO_SRC:
-                *dest = (__force __u16)tuple->src.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->src.u.all);
                 return;
         case NFT_CT_PROTO_DST:
-                *dest = (__force __u16)tuple->dst.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
                 return;
         default:
                 break;
@@ -205,7 +207,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,
         const struct nft_ct *priv = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
         enum ip_conntrack_info ctinfo;
-        u16 value = regs->data[priv->sreg];
+        u16 value = nft_reg_load16(&regs->data[priv->sreg]);
         struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
@@ -542,7 +544,8 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
                 case IP_CT_DIR_REPLY:
                         break;
                 default:
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto err1;
                 }
         }
 
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index eb2721af898d..c4dad1254ead 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -21,6 +21,7 @@ struct nft_hash {
         enum nft_registers      sreg:8;
         enum nft_registers      dreg:8;
         u8                      len;
+        bool                    autogen_seed:1;
         u32                     modulus;
         u32                     seed;
         u32                     offset;
@@ -82,10 +83,12 @@ static int nft_hash_init(const struct nft_ctx *ctx,
         if (priv->offset + priv->modulus - 1 < priv->offset)
                 return -EOVERFLOW;
 
-        if (tb[NFTA_HASH_SEED])
+        if (tb[NFTA_HASH_SEED]) {
                 priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));
-        else
+        } else {
+                priv->autogen_seed = true;
                 get_random_bytes(&priv->seed, sizeof(priv->seed));
+        }
 
         return nft_validate_register_load(priv->sreg, len) &&
                nft_validate_register_store(ctx, priv->dreg, NULL,
@@ -105,7 +108,8 @@ static int nft_hash_dump(struct sk_buff *skb,
                 goto nla_put_failure;
         if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
                 goto nla_put_failure;
-        if (nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
+        if (!priv->autogen_seed &&
+            nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
                 goto nla_put_failure;
         if (priv->offset != 0)
                 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e1f5ca9b423b..7b60e01f38ff 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -45,16 +45,15 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                 *dest = skb->len;
                 break;
         case NFT_META_PROTOCOL:
-                *dest = 0;
-                *(__be16 *)dest = skb->protocol;
+                nft_reg_store16(dest, (__force u16)skb->protocol);
                 break;
         case NFT_META_NFPROTO:
-                *dest = nft_pf(pkt);
+                nft_reg_store8(dest, nft_pf(pkt));
                 break;
         case NFT_META_L4PROTO:
                 if (!pkt->tprot_set)
                         goto err;
-                *dest = pkt->tprot;
+                nft_reg_store8(dest, pkt->tprot);
                 break;
         case NFT_META_PRIORITY:
                 *dest = skb->priority;
@@ -85,14 +84,12 @@ void nft_meta_get_eval(const struct nft_expr *expr,
         case NFT_META_IIFTYPE:
                 if (in == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = in->type;
+                nft_reg_store16(dest, in->type);
                 break;
         case NFT_META_OIFTYPE:
                 if (out == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = out->type;
+                nft_reg_store16(dest, out->type);
                 break;
         case NFT_META_SKUID:
                 sk = skb_to_full_sk(skb);
@@ -142,19 +139,19 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 #endif
         case NFT_META_PKTTYPE:
                 if (skb->pkt_type != PACKET_LOOPBACK) {
-                        *dest = skb->pkt_type;
+                        nft_reg_store8(dest, skb->pkt_type);
                         break;
                 }
 
                 switch (nft_pf(pkt)) {
                 case NFPROTO_IPV4:
                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                         else
-                                *dest = PACKET_BROADCAST;
+                                nft_reg_store8(dest, PACKET_BROADCAST);
                         break;
                 case NFPROTO_IPV6:
-                        *dest = PACKET_MULTICAST;
+                        nft_reg_store8(dest, PACKET_MULTICAST);
                         break;
                 case NFPROTO_NETDEV:
                         switch (skb->protocol) {
@@ -168,14 +165,14 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                                         goto err;
 
                                 if (ipv4_is_multicast(iph->daddr))
-                                        *dest = PACKET_MULTICAST;
+                                        nft_reg_store8(dest, PACKET_MULTICAST);
                                 else
-                                        *dest = PACKET_BROADCAST;
+                                        nft_reg_store8(dest, PACKET_BROADCAST);
 
                                 break;
                         }
                         case htons(ETH_P_IPV6):
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                                 break;
                         default:
                                 WARN_ON_ONCE(1);
@@ -230,7 +227,9 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 {
         const struct nft_meta *meta = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
-        u32 value = regs->data[meta->sreg];
+        u32 *sreg = &regs->data[meta->sreg];
+        u32 value = *sreg;
+        u8 pkt_type;
 
         switch (meta->key) {
         case NFT_META_MARK:
@@ -240,9 +239,12 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 skb->priority = value;
                 break;
         case NFT_META_PKTTYPE:
-                if (skb->pkt_type != value &&
-                    skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = value;
+                pkt_type = nft_reg_load8(sreg);
+
+                if (skb->pkt_type != pkt_type &&
+                    skb_pkt_type_ok(pkt_type) &&
+                    skb_pkt_type_ok(skb->pkt_type))
+                        skb->pkt_type = pkt_type;
                 break;
         case NFT_META_NFTRACE:
                 skb->nf_trace = !!value;
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 19a7bf3236f9..439e0bd152a0 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -65,10 +65,10 @@ static void nft_nat_eval(const struct nft_expr *expr,
         }
 
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 152d226552c1..8ebbc2940f4c 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -15,6 +15,11 @@
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
 
+struct nft_bitmap_elem {
+        struct list_head        head;
+        struct nft_set_ext      ext;
+};
+
 /* This bitmap uses two bits to represent one element. These two bits determine
  * the element state in the current and the future generation.
  *
@@ -41,13 +46,22 @@
  *      restore its previous state.
  */
 struct nft_bitmap {
-        u16     bitmap_size;
-        u8      bitmap[];
+        struct  list_head       list;
+        u16                     bitmap_size;
+        u8                      bitmap[];
 };
 
-static inline void nft_bitmap_location(u32 key, u32 *idx, u32 *off)
+static inline void nft_bitmap_location(const struct nft_set *set,
+                                       const void *key,
+                                       u32 *idx, u32 *off)
 {
-        u32 k = (key << 1);
+        u32 k;
+
+        if (set->klen == 2)
+                k = *(u16 *)key;
+        else
+                k = *(u8 *)key;
+        k <<= 1;
 
         *idx = k / BITS_PER_BYTE;
         *off = k % BITS_PER_BYTE;
@@ -69,26 +83,48 @@ static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
         u8 genmask = nft_genmask_cur(net);
         u32 idx, off;
 
-        nft_bitmap_location(*key, &idx, &off);
+        nft_bitmap_location(set, key, &idx, &off);
 
         return nft_bitmap_active(priv->bitmap, idx, off, genmask);
 }
 
+static struct nft_bitmap_elem *
+nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
+                     u8 genmask)
+{
+        const struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *be;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (memcmp(nft_set_ext_key(&be->ext),
+                           nft_set_ext_key(&this->ext), set->klen) ||
+                    !nft_set_elem_active(&be->ext, genmask))
+                        continue;
+
+                return be;
+        }
+        return NULL;
+}
+
 static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
                              const struct nft_set_elem *elem,
-                             struct nft_set_ext **_ext)
+                             struct nft_set_ext **ext)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *new = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
-        if (nft_bitmap_active(priv->bitmap, idx, off, genmask))
+        be = nft_bitmap_elem_find(set, new, genmask);
+        if (be) {
+                *ext = &be->ext;
                 return -EEXIST;
+        }
 
+        nft_bitmap_location(set, nft_set_ext_key(&new->ext), &idx, &off);
         /* Enter 01 state. */
         priv->bitmap[idx] |= (genmask << off);
+        list_add_tail_rcu(&new->head, &priv->list);
 
         return 0;
 }
@@ -98,13 +134,14 @@ static void nft_bitmap_remove(const struct net *net,
                               const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 00 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        list_del_rcu(&be->head);
 }
 
 static void nft_bitmap_activate(const struct net *net,
@@ -112,74 +149,52 @@ static void nft_bitmap_activate(const struct net *net,
                                 const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 11 state. */
         priv->bitmap[idx] |= (genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 }
 
 static bool nft_bitmap_flush(const struct net *net,
-                             const struct nft_set *set, void *ext)
+                             const struct nft_set *set, void *_be)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
         u8 genmask = nft_genmask_next(net);
+        struct nft_bitmap_elem *be = _be;
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 10 state, similar to deactivation. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
         return true;
 }
 
-static struct nft_set_ext *nft_bitmap_ext_alloc(const struct nft_set *set,
-                                                const struct nft_set_elem *elem)
-{
-        struct nft_set_ext_tmpl tmpl;
-        struct nft_set_ext *ext;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        ext = kzalloc(tmpl.len, GFP_KERNEL);
-        if (!ext)
-                return NULL;
-
-        nft_set_ext_init(ext, &tmpl);
-        memcpy(nft_set_ext_key(ext), elem->key.val.data, set->klen);
-
-        return ext;
-}
-
 static void *nft_bitmap_deactivate(const struct net *net,
                                    const struct nft_set *set,
                                    const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *this = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
-        struct nft_set_ext *ext;
-        u32 idx, off, key = 0;
-
-        memcpy(&key, elem->key.val.data, set->klen);
-        nft_bitmap_location(key, &idx, &off);
+        u32 idx, off;
 
-        if (!nft_bitmap_active(priv->bitmap, idx, off, genmask))
-                return NULL;
+        nft_bitmap_location(set, elem->key.val.data, &idx, &off);
 
-        /* We have no real set extension since this is a bitmap, allocate this
-         * dummy object that is released from the commit/abort path.
-         */
-        ext = nft_bitmap_ext_alloc(set, elem);
-        if (!ext)
+        be = nft_bitmap_elem_find(set, this, genmask);
+        if (!be)
                 return NULL;
 
         /* Enter 10 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
-        return ext;
+        return be;
 }
 
 static void nft_bitmap_walk(const struct nft_ctx *ctx,
@@ -187,47 +202,23 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx,
                             struct nft_set_iter *iter)
 {
         const struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext_tmpl tmpl;
+        struct nft_bitmap_elem *be;
         struct nft_set_elem elem;
-        struct nft_set_ext *ext;
-        int idx, off;
-        u16 key;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        for (idx = 0; idx < priv->bitmap_size; idx++) {
-                for (off = 0; off < BITS_PER_BYTE; off += 2) {
-                        if (iter->count < iter->skip)
-                                goto cont;
-
-                        if (!nft_bitmap_active(priv->bitmap, idx, off,
-                                               iter->genmask))
-                                goto cont;
-
-                        ext = kzalloc(tmpl.len, GFP_KERNEL);
-                        if (!ext) {
-                                iter->err = -ENOMEM;
-                                return;
-                        }
-                        nft_set_ext_init(ext, &tmpl);
-                        key = ((idx * BITS_PER_BYTE) + off) >> 1;
-                        memcpy(nft_set_ext_key(ext), &key, set->klen);
-
-                        elem.priv = ext;
-                        iter->err = iter->fn(ctx, set, iter, &elem);
-
-                        /* On set flush, this dummy extension object is released
-                         * from the commit/abort path.
-                         */
-                        if (!iter->flush)
-                                kfree(ext);
-
-                        if (iter->err < 0)
-                                return;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (iter->count < iter->skip)
+                        goto cont;
+                if (!nft_set_elem_active(&be->ext, iter->genmask))
+                        goto cont;
+
+                elem.priv = be;
+
+                iter->err = iter->fn(ctx, set, iter, &elem);
+
+                if (iter->err < 0)
+                        return;
 cont:
-                        iter->count++;
-                }
+                iter->count++;
         }
 }
 
@@ -258,6 +249,7 @@ static int nft_bitmap_init(const struct nft_set *set,
 {
         struct nft_bitmap *priv = nft_set_priv(set);
 
+        INIT_LIST_HEAD(&priv->list);
         priv->bitmap_size = nft_bitmap_size(set->klen);
 
         return 0;
@@ -283,6 +275,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
 
 static struct nft_set_ops nft_bitmap_ops __read_mostly = {
         .privsize       = nft_bitmap_privsize,
+        .elemsize       = offsetof(struct nft_bitmap_elem, ext),
         .estimate       = nft_bitmap_estimate,
         .init           = nft_bitmap_init,
         .destroy        = nft_bitmap_destroy,
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 27241a767f17..c64aca611ac5 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
         tcp_hdrlen = tcph->doff * 4;
 
-        if (len < tcp_hdrlen)
+        if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
                 return -1;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -152,6 +152,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         if (len > tcp_hdrlen)
                 return 0;
 
+        /* tcph->doff has 4 bits, do not wrap it to 0 */
+        if (tcp_hdrlen >= 15 * 4)
+                return 0;
+
         /*
          * MSS Option not found ?! add it..
          */
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 80cb7babeb64..df7f1df00330 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -393,7 +393,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
 
         rcu_read_lock();
         indev = __in6_dev_get(skb->dev);
-        if (indev)
+        if (indev) {
+                read_lock_bh(&indev->lock);
                 list_for_each_entry(ifa, &indev->addr_list, if_list) {
                         if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
                                 continue;
@@ -401,6 +402,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
                         laddr = &ifa->addr;
                         break;
                 }
+                read_unlock_bh(&indev->lock);
+        }
         rcu_read_unlock();
 
         return laddr ? laddr : daddr;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7b73c7c161a9..596eaff66649 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -96,6 +96,44 @@ EXPORT_SYMBOL_GPL(nl_table);
 
 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 
+static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];
+
+static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
+        "nlk_cb_mutex-ROUTE",
+        "nlk_cb_mutex-1",
+        "nlk_cb_mutex-USERSOCK",
+        "nlk_cb_mutex-FIREWALL",
+        "nlk_cb_mutex-SOCK_DIAG",
+        "nlk_cb_mutex-NFLOG",
+        "nlk_cb_mutex-XFRM",
+        "nlk_cb_mutex-SELINUX",
+        "nlk_cb_mutex-ISCSI",
+        "nlk_cb_mutex-AUDIT",
+        "nlk_cb_mutex-FIB_LOOKUP",
+        "nlk_cb_mutex-CONNECTOR",
+        "nlk_cb_mutex-NETFILTER",
+        "nlk_cb_mutex-IP6_FW",
+        "nlk_cb_mutex-DNRTMSG",
+        "nlk_cb_mutex-KOBJECT_UEVENT",
+        "nlk_cb_mutex-GENERIC",
+        "nlk_cb_mutex-17",
+        "nlk_cb_mutex-SCSITRANSPORT",
+        "nlk_cb_mutex-ECRYPTFS",
+        "nlk_cb_mutex-RDMA",
+        "nlk_cb_mutex-CRYPTO",
+        "nlk_cb_mutex-SMC",
+        "nlk_cb_mutex-23",
+        "nlk_cb_mutex-24",
+        "nlk_cb_mutex-25",
+        "nlk_cb_mutex-26",
+        "nlk_cb_mutex-27",
+        "nlk_cb_mutex-28",
+        "nlk_cb_mutex-29",
+        "nlk_cb_mutex-30",
+        "nlk_cb_mutex-31",
+        "nlk_cb_mutex-MAX_LINKS"
+};
+
 static int netlink_dump(struct sock *sk);
 static void netlink_skb_destructor(struct sk_buff *skb);
 
@@ -585,6 +623,9 @@ static int __netlink_create(struct net *net, struct socket *sock,
         } else {
                 nlk->cb_mutex = &nlk->cb_def_mutex;
                 mutex_init(nlk->cb_mutex);
+                lockdep_set_class_and_name(nlk->cb_mutex,
+                                           nlk_cb_mutex_keys + protocol,
+                                           nlk_cb_mutex_key_strings[protocol]);
         }
         init_waitqueue_head(&nlk->wait);
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index fb6e10fdb217..92e0981f7404 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -783,8 +783,10 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 
                 if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
                                    cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                   skb, CTRL_CMD_NEWFAMILY) < 0)
+                                   skb, CTRL_CMD_NEWFAMILY) < 0) {
+                        n--;
                         break;
+                }
         }
 
         cb->args[0] = n;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e0a87776a010..7b2c2fce408a 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -643,8 +643,8 @@ static bool skb_nfct_cached(struct net *net,
                  */
                 if (nf_ct_is_confirmed(ct))
                         nf_ct_delete(ct, 0, 0);
-                else
-                        nf_conntrack_put(&ct->ct_general);
+
+                nf_conntrack_put(&ct->ct_general);
                 nf_ct_set(skb, NULL, 0);
                 return false;
         }
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d4bb8eb63f2..3f76cb765e5b 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -527,7 +527,7 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 
         /* Link layer. */
         clear_vlan(key);
-        if (key->mac_proto == MAC_PROTO_NONE) {
+        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
                 if (unlikely(eth_type_vlan(skb->protocol)))
                         return -EINVAL;
 
@@ -745,7 +745,13 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
 {
-        return key_extract(skb, key);
+        int res;
+
+        res = key_extract(skb, key);
+        if (!res)
+                key->mac_proto &= ~SW_FLOW_KEY_INVALID;
+
+        return res;
 }
 
 static int key_extract_mac_proto(struct sk_buff *skb)
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 6f5fa50f716d..1105a838bab8 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -604,7 +604,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         ipv4 = true;
                         break;
                 case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
-                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
+                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
                                         nla_get_in6_addr(a), is_mask);
                         ipv6 = true;
                         break;
@@ -665,6 +665,8 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         tun_flags |= TUNNEL_VXLAN_OPT;
                         opts_type = type;
                         break;
+                case OVS_TUNNEL_KEY_ATTR_PAD:
+                        break;
                 default:
                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
                                   type);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a0dbe7ca8f72..8489beff5c25 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3665,6 +3665,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
+                if (val > INT_MAX)
+                        return -EINVAL;
                 po->tp_reserve = val;
                 return 0;
         }
@@ -4193,8 +4195,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
                         goto out;
                 if (po->tp_version >= TPACKET_V3 &&
-                    (int)(req->tp_block_size -
-                          BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
+                    req->tp_block_size <=
+                          BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
                         goto out;
                 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
                                         po->tp_reserve))
@@ -4205,6 +4207,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                 if (unlikely(rb->frames_per_block == 0))
                         goto out;
+                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                        goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
                         goto out;
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index ae5ac175b2be..9da7368b0140 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -658,7 +658,9 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
         }
 
         if (plen != len) {
-                skb_pad(skb, plen - len);
+                rc = skb_pad(skb, plen - len);
+                if (rc)
+                        goto out_node;
                 skb_put(skb, plen - len);
         }
 
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 3f9d8d7ec632..b099b64366f3 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -275,6 +275,10 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 rxrpc_conn_retransmit_call(conn, skb);
                 return 0;
 
+        case RXRPC_PACKET_TYPE_BUSY:
+                /* Just ignore BUSY packets for now. */
+                return 0;
+
         case RXRPC_PACKET_TYPE_ABORT:
                 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
                                   &wtmp, sizeof(wtmp)) < 0)
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index b70aa57319ea..e05b924618a0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -529,20 +529,20 @@ errout:
         return err;
 }
 
-static int nla_memdup_cookie(struct tc_action *a, struct nlattr **tb)
+static struct tc_cookie *nla_memdup_cookie(struct nlattr **tb)
 {
-        a->act_cookie = kzalloc(sizeof(*a->act_cookie), GFP_KERNEL);
-        if (!a->act_cookie)
-                return -ENOMEM;
+        struct tc_cookie *c = kzalloc(sizeof(*c), GFP_KERNEL);
+        if (!c)
+                return NULL;
 
-        a->act_cookie->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
-        if (!a->act_cookie->data) {
-                kfree(a->act_cookie);
-                return -ENOMEM;
+        c->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
+        if (!c->data) {
+                kfree(c);
+                return NULL;
         }
-        a->act_cookie->len = nla_len(tb[TCA_ACT_COOKIE]);
+        c->len = nla_len(tb[TCA_ACT_COOKIE]);
 
-        return 0;
+        return c;
 }
 
 struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
@@ -551,6 +551,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 {
         struct tc_action *a;
         struct tc_action_ops *a_o;
+        struct tc_cookie *cookie = NULL;
         char act_name[IFNAMSIZ];
         struct nlattr *tb[TCA_ACT_MAX + 1];
         struct nlattr *kind;
@@ -566,6 +567,18 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
                         goto err_out;
                 if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ)
                         goto err_out;
+                if (tb[TCA_ACT_COOKIE]) {
+                        int cklen = nla_len(tb[TCA_ACT_COOKIE]);
+
+                        if (cklen > TC_COOKIE_MAX_SIZE)
+                                goto err_out;
+
+                        cookie = nla_memdup_cookie(tb);
+                        if (!cookie) {
+                                err = -ENOMEM;
+                                goto err_out;
+                        }
+                }
         } else {
                 err = -EINVAL;
                 if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ)
@@ -604,20 +617,12 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
         if (err < 0)
                 goto err_mod;
 
-        if (tb[TCA_ACT_COOKIE]) {
-                int cklen = nla_len(tb[TCA_ACT_COOKIE]);
-
-                if (cklen > TC_COOKIE_MAX_SIZE) {
-                        err = -EINVAL;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
-                }
-
-                if (nla_memdup_cookie(a, tb) < 0) {
-                        err = -ENOMEM;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
+        if (name == NULL && tb[TCA_ACT_COOKIE]) {
+                if (a->act_cookie) {
+                        kfree(a->act_cookie->data);
+                        kfree(a->act_cookie);
                 }
+                a->act_cookie = cookie;
         }
 
         /* module count goes up only when brand new policy is created
@@ -632,6 +637,10 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 err_mod:
         module_put(a_o->owner);
 err_out:
+        if (cookie) {
+                kfree(cookie->data);
+                kfree(cookie);
+        }
         return ERR_PTR(err);
 }
 
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 802ac7c2e5e8..5334e309f17f 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -201,9 +201,13 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
 
         if (p->set_tc_index) {
+                int wlen = skb_network_offset(skb);
+
                 switch (tc_skb_protocol(skb)) {
                 case htons(ETH_P_IP):
-                        if (skb_cow_head(skb, sizeof(struct iphdr)))
+                        wlen += sizeof(struct iphdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv4_get_dsfield(ip_hdr(skb))
@@ -211,7 +215,9 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                         break;
 
                 case htons(ETH_P_IPV6):
-                        if (skb_cow_head(skb, sizeof(struct ipv6hdr)))
+                        wlen += sizeof(struct ipv6hdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb))
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b052b27a984e..1a2f9e964330 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -794,7 +794,7 @@ static void attach_default_qdiscs(struct net_device *dev)
                 }
         }
 #ifdef CONFIG_NET_SCHED
-        if (dev->qdisc)
+        if (dev->qdisc != &noop_qdisc)
                 qdisc_hash_add(dev->qdisc);
 #endif
 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 2a6835b4562b..a9708da28eb5 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -71,9 +71,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 {
         struct net *net = sock_net(sk);
         struct sctp_sock *sp;
-        int i;
         sctp_paramhdr_t *p;
-        int err;
+        int i;
 
         /* Retrieve the SCTP per socket area.  */
         sp = sctp_sk((struct sock *)sk);
@@ -247,6 +246,9 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         if (!sctp_ulpq_init(&asoc->ulpq, asoc))
                 goto fail_init;
 
+        if (sctp_stream_new(asoc, gfp))
+                goto fail_init;
+
         /* Assume that peer would support both address types unless we are
          * told otherwise.
          */
@@ -264,9 +266,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         /* AUTH related initializations */
         INIT_LIST_HEAD(&asoc->endpoint_shared_keys);
-        err = sctp_auth_asoc_copy_shkeys(ep, asoc, gfp);
-        if (err)
-                goto fail_init;
+        if (sctp_auth_asoc_copy_shkeys(ep, asoc, gfp))
+                goto stream_free;
 
         asoc->active_key_id = ep->active_key_id;
         asoc->prsctp_enable = ep->prsctp_enable;
@@ -289,6 +290,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         return asoc;
 
+stream_free:
+        sctp_stream_free(asoc->stream);
 fail_init:
         sock_put(asoc->base.sk);
         sctp_endpoint_put(asoc->ep);
@@ -1409,7 +1412,7 @@ sctp_assoc_choose_alter_transport(struct sctp_association *asoc,
 /* Update the association's pmtu and frag_point by going through all the
  * transports. This routine is called when a transport's PMTU has changed.
  */
-void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
+void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
 {
         struct sctp_transport *t;
         __u32 pmtu = 0;
@@ -1421,8 +1424,8 @@ void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
         list_for_each_entry(t, &asoc->peer.transport_addr_list,
                                 transports) {
                 if (t->pmtu_pending && t->dst) {
-                        sctp_transport_update_pmtu(sk, t,
-                                                   SCTP_TRUNC4(dst_mtu(t->dst)));
+                        sctp_transport_update_pmtu(
+                                        t, SCTP_TRUNC4(dst_mtu(t->dst)));
                         t->pmtu_pending = 0;
                 }
                 if (!pmtu || (t->pathmtu < pmtu))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 2a28ab20487f..0e06a278d2a9 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -401,10 +401,10 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
 
         if (t->param_flags & SPP_PMTUD_ENABLE) {
                 /* Update transports view of the MTU */
-                sctp_transport_update_pmtu(sk, t, pmtu);
+                sctp_transport_update_pmtu(t, pmtu);
 
                 /* Update association pmtu. */
-                sctp_assoc_sync_pmtu(sk, asoc);
+                sctp_assoc_sync_pmtu(asoc);
         }
 
         /* Retransmit with the new pmtu setting.
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 71ce6b945dcb..1409a875ad8e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -86,43 +86,53 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
 {
         struct sctp_transport *tp = packet->transport;
         struct sctp_association *asoc = tp->asoc;
+        struct sock *sk;
 
         pr_debug("%s: packet:%p vtag:0x%x\n", __func__, packet, vtag);
-
         packet->vtag = vtag;
 
-        if (asoc && tp->dst) {
-                struct sock *sk = asoc->base.sk;
-
-                rcu_read_lock();
-                if (__sk_dst_get(sk) != tp->dst) {
-                        dst_hold(tp->dst);
-                        sk_setup_caps(sk, tp->dst);
-                }
-
-                if (sk_can_gso(sk)) {
-                        struct net_device *dev = tp->dst->dev;
+        /* do the following jobs only once for a flush schedule */
+        if (!sctp_packet_empty(packet))
+                return;
 
-                        packet->max_size = dev->gso_max_size;
-                } else {
-                        packet->max_size = asoc->pathmtu;
-                }
-                rcu_read_unlock();
+        /* set packet max_size with pathmtu */
+        packet->max_size = tp->pathmtu;
+        if (!asoc)
+                return;
 
-        } else {
-                packet->max_size = tp->pathmtu;
+        /* update dst or transport pathmtu if in need */
+        sk = asoc->base.sk;
+        if (!sctp_transport_dst_check(tp)) {
+                sctp_transport_route(tp, NULL, sctp_sk(sk));
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
-        if (ecn_capable && sctp_packet_empty(packet)) {
-                struct sctp_chunk *chunk;
+        /* If there a is a prepend chunk stick it on the list before
+         * any other chunks get appended.
+         */
+        if (ecn_capable) {
+                struct sctp_chunk *chunk = sctp_get_ecne_prepend(asoc);
 
-                /* If there a is a prepend chunk stick it on the list before
-                 * any other chunks get appended.
-                 */
-                chunk = sctp_get_ecne_prepend(asoc);
                 if (chunk)
                         sctp_packet_append_chunk(packet, chunk);
         }
+
+        if (!tp->dst)
+                return;
+
+        /* set packet max_size with gso_max_size if gso is enabled*/
+        rcu_read_lock();
+        if (__sk_dst_get(sk) != tp->dst) {
+                dst_hold(tp->dst);
+                sk_setup_caps(sk, tp->dst);
+        }
+        packet->max_size = sk_can_gso(sk) ? tp->dst->dev->gso_max_size
+                                          : asoc->pathmtu;
+        rcu_read_unlock();
 }
 
 /* Initialize the packet structure. */
@@ -546,7 +556,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         struct sctp_association *asoc = tp->asoc;
         struct sctp_chunk *chunk, *tmp;
         int pkt_count, gso = 0;
-        int confirm;
         struct dst_entry *dst;
         struct sk_buff *head;
         struct sctphdr *sh;
@@ -583,12 +592,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         sh->vtag = htonl(packet->vtag);
         sh->checksum = 0;
 
-        /* update dst if in need */
-        if (!sctp_transport_dst_check(tp)) {
-                sctp_transport_route(tp, NULL, sctp_sk(sk));
-                if (asoc && asoc->param_flags & SPP_PMTUD_ENABLE)
-                        sctp_assoc_sync_pmtu(sk, asoc);
-        }
+        /* drop packet if no dst */
         dst = dst_clone(tp->dst);
         if (!dst) {
                 IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -625,13 +629,13 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
                         asoc->peer.last_sent_to = tp;
         }
         head->ignore_df = packet->ipfragok;
-        confirm = tp->dst_pending_confirm;
-        if (confirm)
+        if (tp->dst_pending_confirm)
                 skb_set_dst_pending_confirm(head, 1);
         /* neighbour should be confirmed on successful transmission or
          * positive error
          */
-        if (tp->af_specific->sctp_xmit(head, tp) >= 0 && confirm)
+        if (tp->af_specific->sctp_xmit(head, tp) >= 0 &&
+            tp->dst_pending_confirm)
                 tp->dst_pending_confirm = 0;
 
 out:
@@ -705,7 +709,7 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
          */
 
         if ((sctp_sk(asoc->base.sk)->nodelay || inflight == 0) &&
-            !chunk->msg->force_delay)
+            !asoc->force_delay)
                 /* Nothing unacked */
                 return SCTP_XMIT_OK;
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index db352e5d61f8..8081476ed313 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -382,17 +382,18 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
 }
 
 static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
-                                    struct sctp_sndrcvinfo *sinfo,
-                                    struct list_head *queue, int msg_len)
+                                    struct sctp_sndrcvinfo *sinfo, int msg_len)
 {
+        struct sctp_outq *q = &asoc->outqueue;
         struct sctp_chunk *chk, *temp;
 
-        list_for_each_entry_safe(chk, temp, queue, list) {
+        list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
                 list_del_init(&chk->list);
+                q->out_qlen -= chk->skb->len;
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
 
@@ -431,9 +432,7 @@ void sctp_prsctp_prune(struct sctp_association *asoc,
                         return;
         }
 
-        sctp_prsctp_prune_unsent(asoc, sinfo,
-                                 &asoc->outqueue.out_chunk_list,
-                                 msg_len);
+        sctp_prsctp_prune_unsent(asoc, sinfo, msg_len);
 }
 
 /* Mark all the eligible packets on a transport for retransmission.  */
@@ -1027,8 +1026,7 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
                          */
-                        if (chunk->sinfo.sinfo_stream >=
-                            asoc->c.sinit_num_ostreams) {
+                        if (chunk->sinfo.sinfo_stream >= asoc->stream->outcnt) {
 
                                 /* Mark as failed send. */
                                 sctp_chunk_fail(chunk, SCTP_ERROR_INV_STRM);
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 206377fe91ec..a0b29d43627f 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -361,8 +361,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         sctp_seq_dump_remote_addrs(seq, assoc);
         seq_printf(seq, "\t%8lu %5d %5d %4d %4d %4d %8d "
                    "%8d %8d %8d %8d",
-                assoc->hbinterval, assoc->c.sinit_max_instreams,
-                assoc->c.sinit_num_ostreams, assoc->max_retrans,
+                assoc->hbinterval, assoc->stream->incnt,
+                assoc->stream->outcnt, assoc->max_retrans,
                 assoc->init_retries, assoc->shutdown_retries,
                 assoc->rtx_data_chunks,
                 atomic_read(&sk->sk_wmem_alloc),
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 969a30c7bb54..118faff6a332 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2460,15 +2460,10 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * association.
          */
         if (!asoc->temp) {
-                int error;
-
-                asoc->stream = sctp_stream_new(asoc->c.sinit_max_instreams,
-                                               asoc->c.sinit_num_ostreams, gfp);
-                if (!asoc->stream)
+                if (sctp_stream_init(asoc, gfp))
                         goto clean_up;
 
-                error = sctp_assoc_set_id(asoc, gfp);
-                if (error)
+                if (sctp_assoc_set_id(asoc, gfp))
                         goto clean_up;
         }
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index e03bb1aab4d0..24c6ccce7539 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3946,7 +3946,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
 
         /* Silently discard the chunk if stream-id is not valid */
         sctp_walk_fwdtsn(skip, chunk) {
-                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                if (ntohs(skip->stream) >= asoc->stream->incnt)
                         goto discard_noforce;
         }
 
@@ -4017,7 +4017,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
 
         /* Silently discard the chunk if stream-id is not valid */
         sctp_walk_fwdtsn(skip, chunk) {
-                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                if (ntohs(skip->stream) >= asoc->stream->incnt)
                         goto gen_shutdown;
         }
 
@@ -6353,7 +6353,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * and discard the DATA chunk.
          */
         sid = ntohs(data_hdr->stream);
-        if (sid >= asoc->c.sinit_max_instreams) {
+        if (sid >= asoc->stream->incnt) {
                 /* Mark tsn as received even though we drop it */
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 0f378ea2ae38..d9d4c92e06b3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1907,7 +1907,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         }
 
         if (asoc->pmtu_pending)
-                sctp_assoc_pending_pmtu(sk, asoc);
+                sctp_assoc_pending_pmtu(asoc);
 
         /* If fragmentation is disabled and the message length exceeds the
          * association fragmentation point, return EMSGSIZE.  The I-D
@@ -1920,7 +1920,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         }
 
         /* Check for invalid stream. */
-        if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
+        if (sinfo->sinfo_stream >= asoc->stream->outcnt) {
                 err = -EINVAL;
                 goto out_free;
         }
@@ -1965,7 +1965,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
                 err = PTR_ERR(datamsg);
                 goto out_free;
         }
-        datamsg->force_delay = !!(msg->msg_flags & MSG_MORE);
+        asoc->force_delay = !!(msg->msg_flags & MSG_MORE);
 
         /* Now send the (possibly) fragmented message. */
         list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
@@ -2435,7 +2435,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
         if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
                 if (trans) {
                         trans->pathmtu = params->spp_pathmtu;
-                        sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
+                        sctp_assoc_sync_pmtu(asoc);
                 } else if (asoc) {
                         asoc->pathmtu = params->spp_pathmtu;
                 } else {
@@ -2451,7 +2451,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                                 (trans->param_flags & ~SPP_PMTUD) | pmtud_change;
                         if (update) {
                                 sctp_transport_pmtu(trans, sctp_opt2sk(sp));
-                                sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
+                                sctp_assoc_sync_pmtu(asoc);
                         }
                 } else if (asoc) {
                         asoc->param_flags =
@@ -4461,8 +4461,8 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
         info->sctpi_rwnd = asoc->a_rwnd;
         info->sctpi_unackdata = asoc->unack_data;
         info->sctpi_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
-        info->sctpi_instrms = asoc->c.sinit_max_instreams;
-        info->sctpi_outstrms = asoc->c.sinit_num_ostreams;
+        info->sctpi_instrms = asoc->stream->incnt;
+        info->sctpi_outstrms = asoc->stream->outcnt;
         list_for_each(pos, &asoc->base.inqueue.in_chunk_list)
                 info->sctpi_inqueue++;
         list_for_each(pos, &asoc->outqueue.out_chunk_list)
@@ -4691,8 +4691,8 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
         status.sstat_unackdata = asoc->unack_data;
 
         status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
-        status.sstat_instrms = asoc->c.sinit_max_instreams;
-        status.sstat_outstrms = asoc->c.sinit_num_ostreams;
+        status.sstat_instrms = asoc->stream->incnt;
+        status.sstat_outstrms = asoc->stream->outcnt;
         status.sstat_fragmentation_point = asoc->frag_point;
         status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
         memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
@@ -7034,6 +7034,9 @@ int sctp_inet_listen(struct socket *sock, int backlog)
         if (sock->state != SS_UNCONNECTED)
                 goto out;
 
+        if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED))
+                goto out;
+
         /* If backlog is zero, disable listening. */
         if (!backlog) {
                 if (sctp_sstate(sk, CLOSED))
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 1c6cc04fa3a4..bbed997e1c5f 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -35,33 +35,60 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-struct sctp_stream *sctp_stream_new(__u16 incnt, __u16 outcnt, gfp_t gfp)
+int sctp_stream_new(struct sctp_association *asoc, gfp_t gfp)
 {
         struct sctp_stream *stream;
         int i;
 
         stream = kzalloc(sizeof(*stream), gfp);
         if (!stream)
-                return NULL;
+                return -ENOMEM;
 
-        stream->outcnt = outcnt;
+        stream->outcnt = asoc->c.sinit_num_ostreams;
         stream->out = kcalloc(stream->outcnt, sizeof(*stream->out), gfp);
         if (!stream->out) {
                 kfree(stream);
-                return NULL;
+                return -ENOMEM;
         }
         for (i = 0; i < stream->outcnt; i++)
                 stream->out[i].state = SCTP_STREAM_OPEN;
 
-        stream->incnt = incnt;
+        asoc->stream = stream;
+
+        return 0;
+}
+
+int sctp_stream_init(struct sctp_association *asoc, gfp_t gfp)
+{
+        struct sctp_stream *stream = asoc->stream;
+        int i;
+
+        /* Initial stream->out size may be very big, so free it and alloc
+         * a new one with new outcnt to save memory.
+         */
+        kfree(stream->out);
+        stream->outcnt = asoc->c.sinit_num_ostreams;
+        stream->out = kcalloc(stream->outcnt, sizeof(*stream->out), gfp);
+        if (!stream->out)
+                goto nomem;
+
+        for (i = 0; i < stream->outcnt; i++)
+                stream->out[i].state = SCTP_STREAM_OPEN;
+
+        stream->incnt = asoc->c.sinit_max_instreams;
         stream->in = kcalloc(stream->incnt, sizeof(*stream->in), gfp);
         if (!stream->in) {
                 kfree(stream->out);
-                kfree(stream);
-                return NULL;
+                goto nomem;
         }
 
-        return stream;
+        return 0;
+
+nomem:
+        asoc->stream = NULL;
+        kfree(stream);
+
+        return -ENOMEM;
 }
 
 void sctp_stream_free(struct sctp_stream *stream)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 3379668af368..721eeebfcd8a 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -251,14 +251,13 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
-void sctp_transport_update_pmtu(struct sock *sk, struct sctp_transport *t, u32 pmtu)
+void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 {
-        struct dst_entry *dst;
+        struct dst_entry *dst = sctp_transport_dst_check(t);
 
         if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
                 pr_warn("%s: Reported pmtu %d too low, using default minimum of %d\n",
-                        __func__, pmtu,
-                        SCTP_DEFAULT_MINSEGMENT);
+                        __func__, pmtu, SCTP_DEFAULT_MINSEGMENT);
                 /* Use default minimum segment size and disable
                  * pmtu discovery on this transport.
                  */
@@ -267,17 +266,13 @@ void sctp_transport_update_pmtu(struct sock *sk, struct sctp_transport *t, u32 p
                 t->pathmtu = pmtu;
         }
 
-        dst = sctp_transport_dst_check(t);
-        if (!dst)
-                t->af_specific->get_dst(t, &t->saddr, &t->fl, sk);
-
         if (dst) {
-                dst->ops->update_pmtu(dst, sk, NULL, pmtu);
-
+                dst->ops->update_pmtu(dst, t->asoc->base.sk, NULL, pmtu);
                 dst = sctp_transport_dst_check(t);
-                if (!dst)
-                        t->af_specific->get_dst(t, &t->saddr, &t->fl, sk);
         }
+
+        if (!dst)
+                t->af_specific->get_dst(t, &t->saddr, &t->fl, t->asoc->base.sk);
 }
 
 /* Caches the dst entry and source address for a transport's destination
diff --git a/net/socket.c b/net/socket.c
index e034fe4164be..985ef06792d6 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -652,6 +652,16 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
 }
 EXPORT_SYMBOL(kernel_sendmsg);
 
+static bool skb_is_err_queue(const struct sk_buff *skb)
+{
+        /* pkt_type of skbs enqueued on the error queue are set to
+         * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
+         * in recvmsg, since skbs received on a local socket will never
+         * have a pkt_type of PACKET_OUTGOING.
+         */
+        return skb->pkt_type == PACKET_OUTGOING;
+}
+
 /*
  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
  */
@@ -695,7 +705,8 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
                 put_cmsg(msg, SOL_SOCKET,
                          SCM_TIMESTAMPING, sizeof(tss), &tss);
 
-                if (skb->len && (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS))
+                if (skb_is_err_queue(skb) && skb->len &&
+                    SKB_EXT_ERR(skb)->opt_stats)
                         put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
                                  skb->len, skb->data);
         }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 8931e33b6541..2b720fa35c4f 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1635,6 +1635,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
 
         xprt = &svsk->sk_xprt;
         svc_xprt_init(net, &svc_tcp_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &svsk->sk_xprt.xpt_flags);
 
         serv->sv_bc_xprt = xprt;
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index c13a5c35ce14..fc8f14c7bfec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -127,6 +127,7 @@ static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *serv,
         xprt = &cma_xprt->sc_xprt;
 
         svc_xprt_init(net, &svc_rdma_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &xprt->xpt_flags);
         serv->sv_bc_xprt = xprt;
 
         dprintk("svcrdma: %s(%p)\n", __func__, xprt);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 9d94e65d0894..271cd66e4b3b 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -141,6 +141,11 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
 static void tipc_subscrp_timeout(unsigned long data)
 {
         struct tipc_subscription *sub = (struct tipc_subscription *)data;
+        struct tipc_subscriber *subscriber = sub->subscriber;
+
+        spin_lock_bh(&subscriber->lock);
+        tipc_nametbl_unsubscribe(sub);
+        spin_unlock_bh(&subscriber->lock);
 
         /* Notify subscriber of timeout */
         tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
@@ -173,7 +178,6 @@ static void tipc_subscrp_kref_release(struct kref *kref)
         struct tipc_subscriber *subscriber = sub->subscriber;
 
         spin_lock_bh(&subscriber->lock);
-        tipc_nametbl_unsubscribe(sub);
         list_del(&sub->subscrp_list);
         atomic_dec(&tn->subscription_count);
         spin_unlock_bh(&subscriber->lock);
@@ -205,6 +209,7 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
                 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
                         continue;
 
+                tipc_nametbl_unsubscribe(sub);
                 tipc_subscrp_get(sub);
                 spin_unlock_bh(&subscriber->lock);
                 tipc_subscrp_delete(sub);
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6a0d48525fcf..c36757e72844 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
+                BUG_ON(!atomic_long_read(&u->inflight));
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
@@ -341,6 +342,14 @@ void unix_gc(void)
         }
         list_del(&cursor);
 
+        /* Now gc_candidates contains only garbage.  Restore original
+         * inflight counters for these as well, and remove the skbuffs
+         * which are creating the cycle(s).
+         */
+        skb_queue_head_init(&hitlist);
+        list_for_each_entry(u, &gc_candidates, link)
+                scan_children(&u->sk, inc_inflight, &hitlist);
+
         /* not_cycle_list contains those sockets which do not make up a
          * cycle.  Restore these to the inflight list.
          */
@@ -350,14 +359,6 @@ void unix_gc(void)
                 list_move_tail(&u->link, &gc_inflight_list);
         }
 
-        /* Now gc_candidates contains only garbage.  Restore original
-         * inflight counters for these as well, and remove the skbuffs
-         * which are creating the cycle(s).
-         */
-        skb_queue_head_init(&hitlist);
-        list_for_each_entry(u, &gc_candidates, link)
-        scan_children(&u->sk, inc_inflight, &hitlist);
-
         spin_unlock(&unix_gc_lock);
 
         /* Here we are. Hitlist is filled. Die. */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9f770f33c100..6f7f6757ceef 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1102,10 +1102,19 @@ static const struct proto_ops vsock_dgram_ops = {
         .sendpage = sock_no_sendpage,
 };
 
+static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        if (!transport->cancel_pkt)
+                return -EOPNOTSUPP;
+
+        return transport->cancel_pkt(vsk);
+}
+
 static void vsock_connect_timeout(struct work_struct *work)
 {
         struct sock *sk;
         struct vsock_sock *vsk;
+        int cancel = 0;
 
         vsk = container_of(work, struct vsock_sock, dwork.work);
         sk = sk_vsock(vsk);
@@ -1116,8 +1125,11 @@ static void vsock_connect_timeout(struct work_struct *work)
                 sk->sk_state = SS_UNCONNECTED;
                 sk->sk_err = ETIMEDOUT;
                 sk->sk_error_report(sk);
+                cancel = 1;
         }
         release_sock(sk);
+        if (cancel)
+                vsock_transport_cancel_pkt(vsk);
 
         sock_put(sk);
 }
@@ -1224,11 +1236,13 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                         err = sock_intr_errno(timeout);
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 } else if (timeout == 0) {
                         err = -ETIMEDOUT;
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 }
 
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 9d24c0e958b1..68675a151f22 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -213,6 +213,47 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct virtio_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        vsock = virtio_vsock_get();
+        if (!vsock) {
+                return -ENODEV;
+        }
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= virtqueue_get_vring_size(rx_vq) &&
+                    new_cnt < virtqueue_get_vring_size(rx_vq))
+                        queue_work(virtio_vsock_workqueue, &vsock->rx_work);
+        }
+
+        return 0;
+}
+
 static void virtio_vsock_rx_fill(struct virtio_vsock *vsock)
 {
         int buf_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE;
@@ -462,6 +503,7 @@ static struct virtio_transport virtio_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = virtio_transport_cancel_pkt,
 
                 .dgram_bind               = virtio_transport_dgram_bind,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 8d592a45b597..af087b44ceea 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -58,6 +58,7 @@ virtio_transport_alloc_pkt(struct virtio_vsock_pkt_info *info,
         pkt->len                = len;
         pkt->hdr.len            = cpu_to_le32(len);
         pkt->reply              = info->reply;
+        pkt->vsk                = info->vsk;
 
         if (info->msg && len > 0) {
                 pkt->buf = kmalloc(len, GFP_KERNEL);
@@ -180,6 +181,7 @@ static int virtio_transport_send_credit_update(struct vsock_sock *vsk,
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_CREDIT_UPDATE,
                 .type = type,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -519,6 +521,7 @@ int virtio_transport_connect(struct vsock_sock *vsk)
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_REQUEST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -534,6 +537,7 @@ int virtio_transport_shutdown(struct vsock_sock *vsk, int mode)
                           VIRTIO_VSOCK_SHUTDOWN_RCV : 0) |
                          (mode & SEND_SHUTDOWN ?
                           VIRTIO_VSOCK_SHUTDOWN_SEND : 0),
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -560,6 +564,7 @@ virtio_transport_stream_enqueue(struct vsock_sock *vsk,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .msg = msg,
                 .pkt_len = len,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -581,6 +586,7 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
                 .op = VIRTIO_VSOCK_OP_RST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .reply = !!pkt,
+                .vsk = vsk,
         };
 
         /* Send RST only if the original pkt is not a RST pkt */
@@ -826,6 +832,7 @@ virtio_transport_send_response(struct vsock_sock *vsk,
                 .remote_cid = le64_to_cpu(pkt->hdr.src_cid),
                 .remote_port = le32_to_cpu(pkt->hdr.src_port),
                 .reply = true,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d7f8be4e321a..2312dc2ffdb9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -545,22 +545,18 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 {
         int err;
 
-        rtnl_lock();
-
         if (!cb->args[0]) {
                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                                   genl_family_attrbuf(&nl80211_fam),
                                   nl80211_fam.maxattr, nl80211_policy);
                 if (err)
-                        goto out_unlock;
+                        return err;
 
                 *wdev = __cfg80211_wdev_from_attrs(
                                         sock_net(skb->sk),
                                         genl_family_attrbuf(&nl80211_fam));
-                if (IS_ERR(*wdev)) {
-                        err = PTR_ERR(*wdev);
-                        goto out_unlock;
-                }
+                if (IS_ERR(*wdev))
+                        return PTR_ERR(*wdev);
                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
                 /* 0 is the first index - add 1 to parse only once */
                 cb->args[0] = (*rdev)->wiphy_idx + 1;
@@ -570,10 +566,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -584,21 +578,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         }
                 }
 
-                if (!*wdev) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!*wdev)
+                        return -ENODEV;
         }
 
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
-}
-
-static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
-{
-        rtnl_unlock();
 }
 
 /* IE validation */
@@ -2608,17 +2592,17 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int filter_wiphy = -1;
         struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
+        int ret;
 
         rtnl_lock();
         if (!cb->args[2]) {
                 struct nl80211_dump_wiphy_state state = {
                         .filter_wiphy = -1,
                 };
-                int ret;
 
                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
                 if (ret)
-                        return ret;
+                        goto out_unlock;
 
                 filter_wiphy = state.filter_wiphy;
 
@@ -2663,12 +2647,14 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 wp_idx++;
         }
  out:
-        rtnl_unlock();
-
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
 
-        return skb->len;
+        ret = skb->len;
+ out_unlock:
+        rtnl_unlock();
+
+        return ret;
 }
 
 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
@@ -4452,9 +4438,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!wdev->netdev) {
                 err = -EINVAL;
@@ -4489,7 +4476,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[2] = sta_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return err;
 }
@@ -5275,9 +5262,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpath) {
                 err = -EOPNOTSUPP;
@@ -5310,7 +5298,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -5470,9 +5458,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpp) {
                 err = -EOPNOTSUPP;
@@ -5505,7 +5494,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -7674,9 +7663,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         int start = cb->args[2], idx = 0;
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
-        if (err)
+        if (err) {
+                rtnl_unlock();
                 return err;
+        }
 
         wdev_lock(wdev);
         spin_lock_bh(&rdev->bss_lock);
@@ -7699,7 +7691,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         wdev_unlock(wdev);
 
         cb->args[2] = idx;
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return skb->len;
 }
@@ -7784,9 +7776,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         int res;
         bool radio_stats;
 
+        rtnl_lock();
         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (res)
-                return res;
+                goto out_err;
 
         /* prepare_wdev_dump parsed the attributes */
         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
@@ -7827,7 +7820,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         cb->args[2] = survey_idx;
         res = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return res;
 }
 
@@ -11508,17 +11501,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         void *data = NULL;
         unsigned int data_len = 0;
 
-        rtnl_lock();
-
         if (cb->args[0]) {
                 /* subtract the 1 again here */
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -11538,23 +11527,19 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                           attrbuf, nl80211_fam.maxattr, nl80211_policy);
         if (err)
-                goto out_unlock;
+                return err;
 
         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
-            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
-                err = -EINVAL;
-                goto out_unlock;
-        }
+            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
+                return -EINVAL;
 
         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
         if (IS_ERR(*wdev))
                 *wdev = NULL;
 
         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
-        if (IS_ERR(*rdev)) {
-                err = PTR_ERR(*rdev);
-                goto out_unlock;
-        }
+        if (IS_ERR(*rdev))
+                return PTR_ERR(*rdev);
 
         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
@@ -11567,19 +11552,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
                         continue;
 
-                if (!vcmd->dumpit) {
-                        err = -EOPNOTSUPP;
-                        goto out_unlock;
-                }
+                if (!vcmd->dumpit)
+                        return -EOPNOTSUPP;
 
                 vcmd_idx = i;
                 break;
         }
 
-        if (vcmd_idx < 0) {
-                err = -EOPNOTSUPP;
-                goto out_unlock;
-        }
+        if (vcmd_idx < 0)
+                return -EOPNOTSUPP;
 
         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
@@ -11596,9 +11577,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
 
         /* keep rtnl locked in successful case */
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
 }
 
 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
@@ -11613,9 +11591,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
         int err;
         struct nlattr *vendor_data;
 
+        rtnl_lock();
         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out;
 
         vcmd_idx = cb->args[2];
         data = (void *)cb->args[3];
@@ -11624,15 +11603,21 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
 
         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
-                if (!wdev)
-                        return -EINVAL;
+                if (!wdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
-                    !wdev->netdev)
-                        return -EINVAL;
+                    !wdev->netdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
 
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
-                        if (!wdev_running(wdev))
-                                return -ENETDOWN;
+                        if (!wdev_running(wdev)) {
+                                err = -ENETDOWN;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 16b6b5988be9..570a2b67ca10 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -132,12 +132,10 @@ static int wiphy_resume(struct device *dev)
         /* Age scan results with time spent in suspend */
         cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
 
-        if (rdev->ops->resume) {
-                rtnl_lock();
-                if (rdev->wiphy.registered)
-                        ret = rdev_resume(rdev);
-                rtnl_unlock();
-        }
+        rtnl_lock();
+        if (rdev->wiphy.registered && rdev->ops->resume)
+                ret = rdev_resume(rdev);
+        rtnl_unlock();
 
         return ret;
 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 9705c279494b..40a8aa39220d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
         up = nla_data(rp);
         ulen = xfrm_replay_state_esn_len(up);
 
-        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
+        /* Check the overall length and the internal bitmap length to avoid
+         * potential overflow. */
+        if (nla_len(rp) < ulen ||
+            xfrm_replay_state_esn_len(replay_esn) != ulen ||
+            replay_esn->bmp_len != up->bmp_len)
+                return -EINVAL;
+
+        if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
                 return -EINVAL;
 
         return 0;
diff --git a/samples/statx/test-statx.c b/samples/statx/test-statx.c
index 8571d766331d..d4d77b09412c 100644
--- a/samples/statx/test-statx.c
+++ b/samples/statx/test-statx.c
@@ -141,8 +141,8 @@ static void dump_statx(struct statx *stx)
         if (stx->stx_mask & STATX_BTIME)
                 print_time(" Birth: ", &stx->stx_btime);
 
-        if (stx->stx_attributes) {
-                unsigned char bits;
+        if (stx->stx_attributes_mask) {
+                unsigned char bits, mbits;
                 int loop, byte;
 
                 static char attr_representation[64 + 1] =
@@ -160,14 +160,18 @@ static void dump_statx(struct statx *stx)
                 printf("Attributes: %016llx (", stx->stx_attributes);
                 for (byte = 64 - 8; byte >= 0; byte -= 8) {
                         bits = stx->stx_attributes >> byte;
+                        mbits = stx->stx_attributes_mask >> byte;
                         for (loop = 7; loop >= 0; loop--) {
                                 int bit = byte + loop;
 
-                                if (bits & 0x80)
+                                if (!(mbits & 0x80))
+                                        putchar('.');   /* Not supported */
+                                else if (bits & 0x80)
                                         putchar(attr_representation[63 - bit]);
                                 else
-                                        putchar('-');
+                                        putchar('-');   /* Not set */
                                 bits <<= 1;
+                                mbits <<= 1;
                         }
                         if (byte)
                                 putchar(' ');
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index d6ca649cb0e9..afe3fd3af1e4 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -148,6 +148,10 @@ cc-fullversion = $(shell $(CONFIG_SHELL) \
 # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
 cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
 
+# cc-if-fullversion
+# Usage:  EXTRA_CFLAGS += $(call cc-if-fullversion, -lt, 040502, -O1)
+cc-if-fullversion = $(shell [ $(cc-fullversion) $(1) $(2) ] && echo $(3) || echo $(4))
+
 # cc-ldoption
 # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
 cc-ldoption = $(call try-run,\
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0a07f9014944..7234e61e7ce3 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -155,7 +155,7 @@ else
 # $(call addtree,-I$(obj)) locates .h files in srctree, from generated .c files
 #   and locates generated .h files
 # FIXME: Replace both with specific CFLAGS* statements in the makefiles
-__c_flags       = $(if $(obj),-I$(srctree)/$(src) -I$(obj)) \
+__c_flags       = $(if $(obj),$(call addtree,-I$(src)) -I$(obj)) \
                   $(call flags,_c_flags)
 __a_flags       = $(call flags,_a_flags)
 __cpp_flags     = $(call flags,_cpp_flags)
diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c
index 26d208b435a0..cfddddb9c9d7 100644
--- a/scripts/kconfig/gconf.c
+++ b/scripts/kconfig/gconf.c
@@ -914,7 +914,7 @@ on_treeview2_button_press_event(GtkWidget * widget,
                         current = menu;
                         display_tree_part();
                         gtk_widget_set_sensitive(back_btn, TRUE);
-                } else if ((col == COL_OPTION)) {
+                } else if (col == COL_OPTION) {
                         toggle_sym_value(menu);
                         gtk_tree_view_expand_row(view, path, TRUE);
                 }
diff --git a/security/keys/gc.c b/security/keys/gc.c
index addf060399e0..9cb4fe4478a1 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -46,7 +46,7 @@ static unsigned long key_gc_flags;
  * immediately unlinked.
  */
 struct key_type key_type_dead = {
-        .name = "dead",
+        .name = ".dead",
 };
 
 /*
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 52c34532c785..4ad3212adebe 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -273,7 +273,8 @@ error:
  * Create and join an anonymous session keyring or join a named session
  * keyring, creating it if necessary.  A named session keyring must have Search
  * permission for it to be joined.  Session keyrings without this permit will
- * be skipped over.
+ * be skipped over.  It is not permitted for userspace to create or join
+ * keyrings whose name begin with a dot.
  *
  * If successful, the ID of the joined session keyring will be returned.
  */
@@ -290,12 +291,16 @@ long keyctl_join_session_keyring(const char __user *_name)
                         ret = PTR_ERR(name);
                         goto error;
                 }
+
+                ret = -EPERM;
+                if (name[0] == '.')
+                        goto error_name;
         }
 
         /* join the session */
         ret = join_session_keyring(name);
+error_name:
         kfree(name);
-
 error:
         return ret;
 }
@@ -1253,8 +1258,8 @@ error:
  * Read or set the default keyring in which request_key() will cache keys and
  * return the old setting.
  *
- * If a process keyring is specified then this will be created if it doesn't
- * yet exist.  The old setting will be returned if successful.
+ * If a thread or process keyring is specified then it will be created if it
+ * doesn't yet exist.  The old setting will be returned if successful.
  */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
@@ -1279,11 +1284,8 @@ long keyctl_set_reqkey_keyring(int reqkey_defl)
 
         case KEY_REQKEY_DEFL_PROCESS_KEYRING:
                 ret = install_process_keyring_to_cred(new);
-                if (ret < 0) {
-                        if (ret != -EEXIST)
-                                goto error;
-                        ret = 0;
-                }
+                if (ret < 0)
+                        goto error;
                 goto set;
 
         case KEY_REQKEY_DEFL_DEFAULT:
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index b6fdd22205b1..9139b18fc863 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -128,13 +128,18 @@ error:
 }
 
 /*
- * Install a fresh thread keyring directly to new credentials.  This keyring is
- * allowed to overrun the quota.
+ * Install a thread keyring to the given credentials struct if it didn't have
+ * one already.  This is allowed to overrun the quota.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
  */
 int install_thread_keyring_to_cred(struct cred *new)
 {
         struct key *keyring;
 
+        if (new->thread_keyring)
+                return 0;
+
         keyring = keyring_alloc("_tid", new->uid, new->gid, new,
                                 KEY_POS_ALL | KEY_USR_VIEW,
                                 KEY_ALLOC_QUOTA_OVERRUN,
@@ -147,7 +152,9 @@ int install_thread_keyring_to_cred(struct cred *new)
 }
 
 /*
- * Install a fresh thread keyring, discarding the old one.
+ * Install a thread keyring to the current task if it didn't have one already.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
  */
 static int install_thread_keyring(void)
 {
@@ -158,8 +165,6 @@ static int install_thread_keyring(void)
         if (!new)
                 return -ENOMEM;
 
-        BUG_ON(new->thread_keyring);
-
         ret = install_thread_keyring_to_cred(new);
         if (ret < 0) {
                 abort_creds(new);
@@ -170,17 +175,17 @@ static int install_thread_keyring(void)
 }
 
 /*
- * Install a process keyring directly to a credentials struct.
+ * Install a process keyring to the given credentials struct if it didn't have
+ * one already.  This is allowed to overrun the quota.
  *
- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
- * and other value on any other error
+ * Return: 0 if a process keyring is now present; -errno on failure.
  */
 int install_process_keyring_to_cred(struct cred *new)
 {
         struct key *keyring;
 
         if (new->process_keyring)
-                return -EEXIST;
+                return 0;
 
         keyring = keyring_alloc("_pid", new->uid, new->gid, new,
                                 KEY_POS_ALL | KEY_USR_VIEW,
@@ -194,11 +199,9 @@ int install_process_keyring_to_cred(struct cred *new)
 }
 
 /*
- * Make sure a process keyring is installed for the current process.  The
- * existing process keyring is not replaced.
+ * Install a process keyring to the current task if it didn't have one already.
  *
- * Returns 0 if there is a process keyring by the end of this function, some
- * error otherwise.
+ * Return: 0 if a process keyring is now present; -errno on failure.
  */
 static int install_process_keyring(void)
 {
@@ -212,14 +215,18 @@ static int install_process_keyring(void)
         ret = install_process_keyring_to_cred(new);
         if (ret < 0) {
                 abort_creds(new);
-                return ret != -EEXIST ? ret : 0;
+                return ret;
         }
 
         return commit_creds(new);
 }
 
 /*
- * Install a session keyring directly to a credentials struct.
+ * Install the given keyring as the session keyring of the given credentials
+ * struct, replacing the existing one if any.  If the given keyring is NULL,
+ * then install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
  */
 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 {
@@ -254,8 +261,11 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 }
 
 /*
- * Install a session keyring, discarding the old one.  If a keyring is not
- * supplied, an empty one is invented.
+ * Install the given keyring as the session keyring of the current task,
+ * replacing the existing one if any.  If the given keyring is NULL, then
+ * install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
  */
 static int install_session_keyring(struct key *keyring)
 {
diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index d15b653de0bf..ee08c389b4d6 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -268,7 +268,7 @@ int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
         unsigned int offset;
         unsigned int counter = 0;
 
-        offset = snd_hdac_chip_readl(bus, LLCH);
+        offset = snd_hdac_chip_readw(bus, LLCH);
 
         /* Lets walk the linked capabilities list */
         do {
diff --git a/sound/soc/Kconfig b/sound/soc/Kconfig
index 182d92efc7c8..c0abad2067e1 100644
--- a/sound/soc/Kconfig
+++ b/sound/soc/Kconfig
@@ -47,6 +47,7 @@ source "sound/soc/cirrus/Kconfig"
 source "sound/soc/davinci/Kconfig"
 source "sound/soc/dwc/Kconfig"
 source "sound/soc/fsl/Kconfig"
+source "sound/soc/hisilicon/Kconfig"
 source "sound/soc/jz4740/Kconfig"
 source "sound/soc/nuc900/Kconfig"
 source "sound/soc/omap/Kconfig"
@@ -63,6 +64,7 @@ source "sound/soc/sh/Kconfig"
 source "sound/soc/sirf/Kconfig"
 source "sound/soc/spear/Kconfig"
 source "sound/soc/sti/Kconfig"
+source "sound/soc/stm/Kconfig"
 source "sound/soc/sunxi/Kconfig"
 source "sound/soc/tegra/Kconfig"
 source "sound/soc/txx9/Kconfig"
diff --git a/sound/soc/Makefile b/sound/soc/Makefile
index 9a30f21d16ee..39c27a58158d 100644
--- a/sound/soc/Makefile
+++ b/sound/soc/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_SND_SOC)	+= cirrus/
 obj-$(CONFIG_SND_SOC)   += davinci/
 obj-$(CONFIG_SND_SOC)   += dwc/
 obj-$(CONFIG_SND_SOC)   += fsl/
+obj-$(CONFIG_SND_SOC)   += hisilicon/
 obj-$(CONFIG_SND_SOC)   += jz4740/
 obj-$(CONFIG_SND_SOC)   += img/
 obj-$(CONFIG_SND_SOC)   += intel/
@@ -43,6 +44,7 @@ obj-$(CONFIG_SND_SOC)	+= sh/
 obj-$(CONFIG_SND_SOC)   += sirf/
 obj-$(CONFIG_SND_SOC)   += spear/
 obj-$(CONFIG_SND_SOC)   += sti/
+obj-$(CONFIG_SND_SOC)   += stm/
 obj-$(CONFIG_SND_SOC)   += sunxi/
 obj-$(CONFIG_SND_SOC)   += tegra/
 obj-$(CONFIG_SND_SOC)   += txx9/
diff --git a/sound/soc/blackfin/bfin-eval-adau1373.c b/sound/soc/blackfin/bfin-eval-adau1373.c
index 72ac78988426..64b88fdc1f6c 100644
--- a/sound/soc/blackfin/bfin-eval-adau1373.c
+++ b/sound/soc/blackfin/bfin-eval-adau1373.c
@@ -119,7 +119,7 @@ static int bfin_eval_adau1373_codec_init(struct snd_soc_pcm_runtime *rtd)
 
         return ret;
 }
-static struct snd_soc_ops bfin_eval_adau1373_ops = {
+static const struct snd_soc_ops bfin_eval_adau1373_ops = {
         .hw_params = bfin_eval_adau1373_hw_params,
 };
 
diff --git a/sound/soc/blackfin/bfin-eval-adav80x.c b/sound/soc/blackfin/bfin-eval-adav80x.c
index 1037477d10b2..99e5ecabdcda 100644
--- a/sound/soc/blackfin/bfin-eval-adav80x.c
+++ b/sound/soc/blackfin/bfin-eval-adav80x.c
@@ -64,7 +64,7 @@ static int bfin_eval_adav80x_codec_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static struct snd_soc_ops bfin_eval_adav80x_ops = {
+static const struct snd_soc_ops bfin_eval_adav80x_ops = {
         .hw_params = bfin_eval_adav80x_hw_params,
 };
 
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index e49e9da7f1f6..883ed4c8a551 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -49,6 +49,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_CS35L32 if I2C
         select SND_SOC_CS35L33 if I2C
         select SND_SOC_CS35L34 if I2C
+        select SND_SOC_CS35L35 if I2C
         select SND_SOC_CS42L42 if I2C
         select SND_SOC_CS42L51_I2C if I2C
         select SND_SOC_CS42L52 if I2C && INPUT
@@ -69,9 +70,11 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_DA7219 if I2C
         select SND_SOC_DA732X if I2C
         select SND_SOC_DA9055 if I2C
+        select SND_SOC_DIO2125
         select SND_SOC_DMIC
         select SND_SOC_ES8328_SPI if SPI_MASTER
         select SND_SOC_ES8328_I2C if I2C
+        select SND_SOC_ES7134
         select SND_SOC_GTM601
         select SND_SOC_HDAC_HDMI
         select SND_SOC_ICS43432
@@ -89,6 +92,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_MAX9867 if I2C
         select SND_SOC_MAX98925 if I2C
         select SND_SOC_MAX98926 if I2C
+        select SND_SOC_MAX98927 if I2C
         select SND_SOC_MAX9850 if I2C
         select SND_SOC_MAX9860 if I2C
         select SND_SOC_MAX9768 if I2C
@@ -97,6 +101,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_ML26124 if I2C
         select SND_SOC_NAU8540 if I2C
         select SND_SOC_NAU8810 if I2C
+        select SND_SOC_NAU8824 if I2C
         select SND_SOC_NAU8825 if I2C
         select SND_SOC_HDMI_CODEC
         select SND_SOC_PCM1681 if I2C
@@ -303,12 +308,14 @@ config SND_SOC_ADAU1761
         select SND_SOC_ADAU17X1
 
 config SND_SOC_ADAU1761_I2C
-        tristate
+        tristate "Analog Devices AU1761 CODEC - I2C"
+        depends on I2C
         select SND_SOC_ADAU1761
         select REGMAP_I2C
 
 config SND_SOC_ADAU1761_SPI
-        tristate
+        tristate "Analog Devices AU1761 CODEC - SPI"
+        depends on SPI
         select SND_SOC_ADAU1761
         select REGMAP_SPI
 
@@ -408,6 +415,10 @@ config SND_SOC_CS35L34
         tristate "Cirrus Logic CS35L34 CODEC"
         depends on I2C
 
+config SND_SOC_CS35L35
+        tristate "Cirrus Logic CS35L35 CODEC"
+        depends on I2C
+
 config SND_SOC_CS42L42
         tristate "Cirrus Logic CS42L42 CODEC"
         depends on I2C
@@ -516,6 +527,10 @@ config SND_SOC_DA732X
 config SND_SOC_DA9055
         tristate
 
+config SND_SOC_DIO2125
+        tristate "Dioo DIO2125 Amplifier"
+        select GPIOLIB
+
 config SND_SOC_DMIC
         tristate
 
@@ -525,6 +540,9 @@ config SND_SOC_HDMI_CODEC
         select SND_PCM_IEC958
         select HDMI
 
+config SND_SOC_ES7134
+       tristate "Everest Semi ES7134 CODEC"
+
 config SND_SOC_ES8328
         tristate
 
@@ -588,6 +606,10 @@ config SND_SOC_MAX98925
 config SND_SOC_MAX98926
         tristate
 
+config SND_SOC_MAX98927
+        tristate "Maxim Integrated MAX98927 Speaker Amplifier"
+        depends on I2C
+
 config SND_SOC_MAX9850
         tristate
 
@@ -1116,6 +1138,10 @@ config SND_SOC_NAU8810
         tristate "Nuvoton Technology Corporation NAU88C10 CODEC"
         depends on I2C
 
+config SND_SOC_NAU8824
+        tristate "Nuvoton Technology Corporation NAU88L24 CODEC"
+        depends on I2C
+
 config SND_SOC_NAU8825
         tristate
 
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 1796cb987e71..28a63fdaf982 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -39,6 +39,7 @@ snd-soc-cq93vc-objs := cq93vc.o
 snd-soc-cs35l32-objs := cs35l32.o
 snd-soc-cs35l33-objs := cs35l33.o
 snd-soc-cs35l34-objs := cs35l34.o
+snd-soc-cs35l35-objs := cs35l35.o
 snd-soc-cs42l42-objs := cs42l42.o
 snd-soc-cs42l51-objs := cs42l51.o
 snd-soc-cs42l51-i2c-objs := cs42l51-i2c.o
@@ -63,6 +64,7 @@ snd-soc-da7219-objs := da7219.o da7219-aad.o
 snd-soc-da732x-objs := da732x.o
 snd-soc-da9055-objs := da9055.o
 snd-soc-dmic-objs := dmic.o
+snd-soc-es7134-objs := es7134.o
 snd-soc-es8328-objs := es8328.o
 snd-soc-es8328-i2c-objs := es8328-i2c.o
 snd-soc-es8328-spi-objs := es8328-spi.o
@@ -84,6 +86,7 @@ snd-soc-max98371-objs := max98371.o
 snd-soc-max9867-objs := max9867.o
 snd-soc-max98925-objs := max98925.o
 snd-soc-max98926-objs := max98926.o
+snd-soc-max98927-objs := max98927.o
 snd-soc-max9850-objs := max9850.o
 snd-soc-max9860-objs := max9860.o
 snd-soc-mc13783-objs := mc13783.o
@@ -92,6 +95,7 @@ snd-soc-msm8916-analog-objs := msm8916-wcd-analog.o
 snd-soc-msm8916-digital-objs := msm8916-wcd-digital.o
 snd-soc-nau8540-objs := nau8540.o
 snd-soc-nau8810-objs := nau8810.o
+snd-soc-nau8824-objs := nau8824.o
 snd-soc-nau8825-objs := nau8825.o
 snd-soc-hdmi-codec-objs := hdmi-codec.o
 snd-soc-pcm1681-objs := pcm1681.o
@@ -221,6 +225,7 @@ snd-soc-wm9712-objs := wm9712.o
 snd-soc-wm9713-objs := wm9713.o
 snd-soc-wm-hubs-objs := wm_hubs.o
 # Amp
+snd-soc-dio2125-objs := dio2125.o
 snd-soc-max9877-objs := max9877.o
 snd-soc-max98504-objs := max98504.o
 snd-soc-tpa6130a2-objs := tpa6130a2.o
@@ -269,6 +274,7 @@ obj-$(CONFIG_SND_SOC_CQ0093VC) += snd-soc-cq93vc.o
 obj-$(CONFIG_SND_SOC_CS35L32)   += snd-soc-cs35l32.o
 obj-$(CONFIG_SND_SOC_CS35L33)   += snd-soc-cs35l33.o
 obj-$(CONFIG_SND_SOC_CS35L34)   += snd-soc-cs35l34.o
+obj-$(CONFIG_SND_SOC_CS35L35)   += snd-soc-cs35l35.o
 obj-$(CONFIG_SND_SOC_CS42L42)   += snd-soc-cs42l42.o
 obj-$(CONFIG_SND_SOC_CS42L51)   += snd-soc-cs42l51.o
 obj-$(CONFIG_SND_SOC_CS42L51_I2C)       += snd-soc-cs42l51-i2c.o
@@ -293,6 +299,7 @@ obj-$(CONFIG_SND_SOC_DA7219)	+= snd-soc-da7219.o
 obj-$(CONFIG_SND_SOC_DA732X)    += snd-soc-da732x.o
 obj-$(CONFIG_SND_SOC_DA9055)    += snd-soc-da9055.o
 obj-$(CONFIG_SND_SOC_DMIC)      += snd-soc-dmic.o
+obj-$(CONFIG_SND_SOC_ES7134)    += snd-soc-es7134.o
 obj-$(CONFIG_SND_SOC_ES8328)    += snd-soc-es8328.o
 obj-$(CONFIG_SND_SOC_ES8328_I2C)+= snd-soc-es8328-i2c.o
 obj-$(CONFIG_SND_SOC_ES8328_SPI)+= snd-soc-es8328-spi.o
@@ -313,6 +320,7 @@ obj-$(CONFIG_SND_SOC_MAX98357A)	+= snd-soc-max98357a.o
 obj-$(CONFIG_SND_SOC_MAX9867)   += snd-soc-max9867.o
 obj-$(CONFIG_SND_SOC_MAX98925)  += snd-soc-max98925.o
 obj-$(CONFIG_SND_SOC_MAX98926)  += snd-soc-max98926.o
+obj-$(CONFIG_SND_SOC_MAX98927)  += snd-soc-max98927.o
 obj-$(CONFIG_SND_SOC_MAX9850)   += snd-soc-max9850.o
 obj-$(CONFIG_SND_SOC_MAX9860)   += snd-soc-max9860.o
 obj-$(CONFIG_SND_SOC_MC13783)   += snd-soc-mc13783.o
@@ -321,6 +329,7 @@ obj-$(CONFIG_SND_SOC_MSM8916_WCD_ANALOG) +=snd-soc-msm8916-analog.o
 obj-$(CONFIG_SND_SOC_MSM8916_WCD_DIGITAL) +=snd-soc-msm8916-digital.o
 obj-$(CONFIG_SND_SOC_NAU8540)   += snd-soc-nau8540.o
 obj-$(CONFIG_SND_SOC_NAU8810)   += snd-soc-nau8810.o
+obj-$(CONFIG_SND_SOC_NAU8824)   += snd-soc-nau8824.o
 obj-$(CONFIG_SND_SOC_NAU8825)   += snd-soc-nau8825.o
 obj-$(CONFIG_SND_SOC_HDMI_CODEC)        += snd-soc-hdmi-codec.o
 obj-$(CONFIG_SND_SOC_PCM1681)   += snd-soc-pcm1681.o
@@ -448,6 +457,7 @@ obj-$(CONFIG_SND_SOC_WM_ADSP)	+= snd-soc-wm-adsp.o
 obj-$(CONFIG_SND_SOC_WM_HUBS)   += snd-soc-wm-hubs.o
 
 # Amp
+obj-$(CONFIG_SND_SOC_DIO2125)   += snd-soc-dio2125.o
 obj-$(CONFIG_SND_SOC_MAX9877)   += snd-soc-max9877.o
 obj-$(CONFIG_SND_SOC_MAX98504)  += snd-soc-max98504.o
 obj-$(CONFIG_SND_SOC_TPA6130A2) += snd-soc-tpa6130a2.o
diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c
index e819dd8c82fd..b2dfddead227 100644
--- a/sound/soc/codecs/ak4613.c
+++ b/sound/soc/codecs/ak4613.c
@@ -75,6 +75,12 @@
 #define DFS_DOUBLE_SPEED        (1 << 2)
 #define DFS_QUAD_SPEED          (2 << 2)
 
+/* ICTRL */
+#define ICTRL_MASK      (0x3)
+
+/* OCTRL */
+#define OCTRL_MASK      (0x3F)
+
 struct ak4613_formats {
         unsigned int width;
         unsigned int fmt;
@@ -365,8 +371,8 @@ static int ak4613_dai_hw_params(struct snd_pcm_substream *substream,
         snd_soc_update_bits(codec, CTRL1, FMT_MASK, fmt_ctrl);
         snd_soc_update_bits(codec, CTRL2, DFS_MASK, ctrl2);
 
-        snd_soc_write(codec, ICTRL, priv->ic);
-        snd_soc_write(codec, OCTRL, priv->oc);
+        snd_soc_update_bits(codec, ICTRL, ICTRL_MASK, priv->ic);
+        snd_soc_update_bits(codec, OCTRL, OCTRL_MASK, priv->oc);
 
 hw_params_end:
         if (ret < 0)
diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
new file mode 100644
index 000000000000..f8aef5869b03
--- /dev/null
+++ b/sound/soc/codecs/cs35l35.c
@@ -0,0 +1,1580 @@
+/*
+ * cs35l35.c -- CS35L35 ALSA SoC audio driver
+ *
+ * Copyright 2017 Cirrus Logic, Inc.
+ *
+ * Author: Brian Austin <brian.austin@cirrus.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gpio/consumer.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/regmap.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <linux/gpio.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+#include <sound/cs35l35.h>
+#include <linux/of_irq.h>
+#include <linux/completion.h>
+
+#include "cs35l35.h"
+
+/*
+ * Some fields take zero as a valid value so use a high bit flag that won't
+ * get written to the device to mark those.
+ */
+#define CS35L35_VALID_PDATA 0x80000000
+
+static const struct reg_default cs35l35_reg[] = {
+        {CS35L35_PWRCTL1,               0x01},
+        {CS35L35_PWRCTL2,               0x11},
+        {CS35L35_PWRCTL3,               0x00},
+        {CS35L35_CLK_CTL1,              0x04},
+        {CS35L35_CLK_CTL2,              0x12},
+        {CS35L35_CLK_CTL3,              0xCF},
+        {CS35L35_SP_FMT_CTL1,           0x20},
+        {CS35L35_SP_FMT_CTL2,           0x00},
+        {CS35L35_SP_FMT_CTL3,           0x02},
+        {CS35L35_MAG_COMP_CTL,          0x00},
+        {CS35L35_AMP_INP_DRV_CTL,       0x01},
+        {CS35L35_AMP_DIG_VOL_CTL,       0x12},
+        {CS35L35_AMP_DIG_VOL,           0x00},
+        {CS35L35_ADV_DIG_VOL,           0x00},
+        {CS35L35_PROTECT_CTL,           0x06},
+        {CS35L35_AMP_GAIN_AUD_CTL,      0x13},
+        {CS35L35_AMP_GAIN_PDM_CTL,      0x00},
+        {CS35L35_AMP_GAIN_ADV_CTL,      0x00},
+        {CS35L35_GPI_CTL,               0x00},
+        {CS35L35_BST_CVTR_V_CTL,        0x00},
+        {CS35L35_BST_PEAK_I,            0x07},
+        {CS35L35_BST_RAMP_CTL,          0x85},
+        {CS35L35_BST_CONV_COEF_1,       0x24},
+        {CS35L35_BST_CONV_COEF_2,       0x24},
+        {CS35L35_BST_CONV_SLOPE_COMP,   0x4E},
+        {CS35L35_BST_CONV_SW_FREQ,      0x04},
+        {CS35L35_CLASS_H_CTL,           0x0B},
+        {CS35L35_CLASS_H_HEADRM_CTL,    0x0B},
+        {CS35L35_CLASS_H_RELEASE_RATE,  0x08},
+        {CS35L35_CLASS_H_FET_DRIVE_CTL, 0x41},
+        {CS35L35_CLASS_H_VP_CTL,        0xC5},
+        {CS35L35_VPBR_CTL,              0x0A},
+        {CS35L35_VPBR_VOL_CTL,          0x90},
+        {CS35L35_VPBR_TIMING_CTL,       0x6A},
+        {CS35L35_VPBR_MODE_VOL_CTL,     0x00},
+        {CS35L35_SPKR_MON_CTL,          0xC0},
+        {CS35L35_IMON_SCALE_CTL,        0x30},
+        {CS35L35_AUDIN_RXLOC_CTL,       0x00},
+        {CS35L35_ADVIN_RXLOC_CTL,       0x80},
+        {CS35L35_VMON_TXLOC_CTL,        0x00},
+        {CS35L35_IMON_TXLOC_CTL,        0x80},
+        {CS35L35_VPMON_TXLOC_CTL,       0x04},
+        {CS35L35_VBSTMON_TXLOC_CTL,     0x84},
+        {CS35L35_VPBR_STATUS_TXLOC_CTL, 0x04},
+        {CS35L35_ZERO_FILL_LOC_CTL,     0x00},
+        {CS35L35_AUDIN_DEPTH_CTL,       0x0F},
+        {CS35L35_SPKMON_DEPTH_CTL,      0x0F},
+        {CS35L35_SUPMON_DEPTH_CTL,      0x0F},
+        {CS35L35_ZEROFILL_DEPTH_CTL,    0x00},
+        {CS35L35_MULT_DEV_SYNCH1,       0x02},
+        {CS35L35_MULT_DEV_SYNCH2,       0x80},
+        {CS35L35_PROT_RELEASE_CTL,      0x00},
+        {CS35L35_DIAG_MODE_REG_LOCK,    0x00},
+        {CS35L35_DIAG_MODE_CTL_1,       0x40},
+        {CS35L35_DIAG_MODE_CTL_2,       0x00},
+        {CS35L35_INT_MASK_1,            0xFF},
+        {CS35L35_INT_MASK_2,            0xFF},
+        {CS35L35_INT_MASK_3,            0xFF},
+        {CS35L35_INT_MASK_4,            0xFF},
+
+};
+
+static bool cs35l35_volatile_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_INT_STATUS_1:
+        case CS35L35_INT_STATUS_2:
+        case CS35L35_INT_STATUS_3:
+        case CS35L35_INT_STATUS_4:
+        case CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool cs35l35_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_DEVID_AB ... CS35L35_PWRCTL3:
+        case CS35L35_CLK_CTL1 ... CS35L35_SP_FMT_CTL3:
+        case CS35L35_MAG_COMP_CTL ... CS35L35_AMP_GAIN_AUD_CTL:
+        case CS35L35_AMP_GAIN_PDM_CTL ... CS35L35_BST_PEAK_I:
+        case CS35L35_BST_RAMP_CTL ... CS35L35_BST_CONV_SW_FREQ:
+        case CS35L35_CLASS_H_CTL ... CS35L35_CLASS_H_VP_CTL:
+        case CS35L35_CLASS_H_STATUS:
+        case CS35L35_VPBR_CTL ... CS35L35_VPBR_MODE_VOL_CTL:
+        case CS35L35_VPBR_ATTEN_STATUS:
+        case CS35L35_SPKR_MON_CTL:
+        case CS35L35_IMON_SCALE_CTL ... CS35L35_ZEROFILL_DEPTH_CTL:
+        case CS35L35_MULT_DEV_SYNCH1 ... CS35L35_PROT_RELEASE_CTL:
+        case CS35L35_DIAG_MODE_REG_LOCK ... CS35L35_DIAG_MODE_CTL_2:
+        case CS35L35_INT_MASK_1 ... CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool cs35l35_precious_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_INT_STATUS_1:
+        case CS35L35_INT_STATUS_2:
+        case CS35L35_INT_STATUS_3:
+        case CS35L35_INT_STATUS_4:
+        case CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static int cs35l35_wait_for_pdn(struct cs35l35_private *cs35l35)
+{
+        int ret;
+
+        if (cs35l35->pdata.ext_bst) {
+                usleep_range(5000, 5500);
+                return 0;
+        }
+
+        reinit_completion(&cs35l35->pdn_done);
+
+        ret = wait_for_completion_timeout(&cs35l35->pdn_done,
+                                          msecs_to_jiffies(100));
+        if (ret == 0) {
+                dev_err(cs35l35->dev, "PDN_DONE did not complete\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static int cs35l35_sdin_event(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        int ret = 0;
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                        CS35L35_MCLK_DIS_MASK,
+                                        0 << CS35L35_MCLK_DIS_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_DISCHG_FILT_MASK,
+                                        0 << CS35L35_DISCHG_FILT_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_PDN_ALL_MASK, 0);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_DISCHG_FILT_MASK,
+                                        1 << CS35L35_DISCHG_FILT_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                          CS35L35_PDN_ALL_MASK, 1);
+
+                /* Already muted, so disable volume ramp for faster shutdown */
+                regmap_update_bits(cs35l35->regmap, CS35L35_AMP_DIG_VOL_CTL,
+                                   CS35L35_AMP_DIGSFT_MASK, 0);
+
+                ret = cs35l35_wait_for_pdn(cs35l35);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                        CS35L35_MCLK_DIS_MASK,
+                                        1 << CS35L35_MCLK_DIS_SHIFT);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_AMP_DIG_VOL_CTL,
+                                   CS35L35_AMP_DIGSFT_MASK,
+                                   1 << CS35L35_AMP_DIGSFT_SHIFT);
+                break;
+        default:
+                dev_err(codec->dev, "Invalid event = 0x%x\n", event);
+                ret = -EINVAL;
+        }
+        return ret;
+}
+
+static int cs35l35_main_amp_event(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg[4];
+        int i;
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                if (cs35l35->pdata.bst_pdn_fet_on)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                0 << CS35L35_PDN_BST_FETON_SHIFT);
+                else
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                0 << CS35L35_PDN_BST_FETOFF_SHIFT);
+                break;
+        case SND_SOC_DAPM_POST_PMU:
+                usleep_range(5000, 5100);
+                /* If in PDM mode we must use VP for Voltage control */
+                if (cs35l35->pdm_mode)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_BST_CVTR_V_CTL,
+                                        CS35L35_BST_CTL_MASK,
+                                        0 << CS35L35_BST_CTL_SHIFT);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                        CS35L35_AMP_MUTE_MASK, 0);
+
+                for (i = 0; i < 2; i++)
+                        regmap_bulk_read(cs35l35->regmap, CS35L35_INT_STATUS_1,
+                                        &reg, ARRAY_SIZE(reg));
+
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                                CS35L35_AMP_MUTE_MASK,
+                                1 << CS35L35_AMP_MUTE_SHIFT);
+                if (cs35l35->pdata.bst_pdn_fet_on)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                1 << CS35L35_PDN_BST_FETON_SHIFT);
+                else
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                1 << CS35L35_PDN_BST_FETOFF_SHIFT);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                usleep_range(5000, 5100);
+                /*
+                 * If PDM mode we should switch back to pdata value
+                 * for Voltage control when we go down
+                 */
+                if (cs35l35->pdm_mode)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_BST_CVTR_V_CTL,
+                                        CS35L35_BST_CTL_MASK,
+                                        cs35l35->pdata.bst_vctl
+                                        << CS35L35_BST_CTL_SHIFT);
+
+                break;
+        default:
+                dev_err(codec->dev, "Invalid event = 0x%x\n", event);
+        }
+        return 0;
+}
+
+static DECLARE_TLV_DB_SCALE(amp_gain_tlv, 0, 1, 1);
+static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10200, 50, 0);
+
+static const struct snd_kcontrol_new cs35l35_aud_controls[] = {
+        SOC_SINGLE_SX_TLV("Digital Audio Volume", CS35L35_AMP_DIG_VOL,
+                      0, 0x34, 0xE4, dig_vol_tlv),
+        SOC_SINGLE_TLV("Analog Audio Volume", CS35L35_AMP_GAIN_AUD_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+        SOC_SINGLE_TLV("PDM Volume", CS35L35_AMP_GAIN_PDM_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+};
+
+static const struct snd_kcontrol_new cs35l35_adv_controls[] = {
+        SOC_SINGLE_SX_TLV("Digital Advisory Volume", CS35L35_ADV_DIG_VOL,
+                      0, 0x34, 0xE4, dig_vol_tlv),
+        SOC_SINGLE_TLV("Analog Advisory Volume", CS35L35_AMP_GAIN_ADV_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+};
+
+static const struct snd_soc_dapm_widget cs35l35_dapm_widgets[] = {
+        SND_SOC_DAPM_AIF_IN_E("SDIN", NULL, 0, CS35L35_PWRCTL3, 1, 1,
+                                cs35l35_sdin_event, SND_SOC_DAPM_PRE_PMU |
+                                SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_AIF_OUT("SDOUT", NULL, 0, CS35L35_PWRCTL3, 2, 1),
+
+        SND_SOC_DAPM_OUTPUT("SPK"),
+
+        SND_SOC_DAPM_INPUT("VP"),
+        SND_SOC_DAPM_INPUT("VBST"),
+        SND_SOC_DAPM_INPUT("ISENSE"),
+        SND_SOC_DAPM_INPUT("VSENSE"),
+
+        SND_SOC_DAPM_ADC("VMON ADC", NULL, CS35L35_PWRCTL2, 7, 1),
+        SND_SOC_DAPM_ADC("IMON ADC", NULL, CS35L35_PWRCTL2, 6, 1),
+        SND_SOC_DAPM_ADC("VPMON ADC", NULL, CS35L35_PWRCTL3, 3, 1),
+        SND_SOC_DAPM_ADC("VBSTMON ADC", NULL, CS35L35_PWRCTL3, 4, 1),
+        SND_SOC_DAPM_ADC("CLASS H", NULL, CS35L35_PWRCTL2, 5, 1),
+
+        SND_SOC_DAPM_OUT_DRV_E("Main AMP", CS35L35_PWRCTL2, 0, 1, NULL, 0,
+                cs35l35_main_amp_event, SND_SOC_DAPM_PRE_PMU |
+                                SND_SOC_DAPM_POST_PMD | SND_SOC_DAPM_POST_PMU |
+                                SND_SOC_DAPM_PRE_PMD),
+};
+
+static const struct snd_soc_dapm_route cs35l35_audio_map[] = {
+        {"VPMON ADC", NULL, "VP"},
+        {"VBSTMON ADC", NULL, "VBST"},
+        {"IMON ADC", NULL, "ISENSE"},
+        {"VMON ADC", NULL, "VSENSE"},
+        {"SDOUT", NULL, "IMON ADC"},
+        {"SDOUT", NULL, "VMON ADC"},
+        {"SDOUT", NULL, "VBSTMON ADC"},
+        {"SDOUT", NULL, "VPMON ADC"},
+        {"AMP Capture", NULL, "SDOUT"},
+
+        {"SDIN", NULL, "AMP Playback"},
+        {"CLASS H", NULL, "SDIN"},
+        {"Main AMP", NULL, "CLASS H"},
+        {"SPK", NULL, "Main AMP"},
+};
+
+static int cs35l35_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                    CS35L35_MS_MASK, 1 << CS35L35_MS_SHIFT);
+                cs35l35->slave_mode = false;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                    CS35L35_MS_MASK, 0 << CS35L35_MS_SHIFT);
+                cs35l35->slave_mode = true;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                cs35l35->i2s_mode = true;
+                cs35l35->pdm_mode = false;
+                break;
+        case SND_SOC_DAIFMT_PDM:
+                cs35l35->pdm_mode = true;
+                cs35l35->i2s_mode = false;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+struct cs35l35_sysclk_config {
+        int sysclk;
+        int srate;
+        u8 clk_cfg;
+};
+
+static struct cs35l35_sysclk_config cs35l35_clk_ctl[] = {
+
+        /* SYSCLK, Sample Rate, Serial Port Cfg */
+        {5644800, 44100, 0x00},
+        {5644800, 88200, 0x40},
+        {6144000, 48000, 0x10},
+        {6144000, 96000, 0x50},
+        {11289600, 44100, 0x01},
+        {11289600, 88200, 0x41},
+        {11289600, 176400, 0x81},
+        {12000000, 44100, 0x03},
+        {12000000, 48000, 0x13},
+        {12000000, 88200, 0x43},
+        {12000000, 96000, 0x53},
+        {12000000, 176400, 0x83},
+        {12000000, 192000, 0x93},
+        {12288000, 48000, 0x11},
+        {12288000, 96000, 0x51},
+        {12288000, 192000, 0x91},
+        {13000000, 44100, 0x07},
+        {13000000, 48000, 0x17},
+        {13000000, 88200, 0x47},
+        {13000000, 96000, 0x57},
+        {13000000, 176400, 0x87},
+        {13000000, 192000, 0x97},
+        {22579200, 44100, 0x02},
+        {22579200, 88200, 0x42},
+        {22579200, 176400, 0x82},
+        {24000000, 44100, 0x0B},
+        {24000000, 48000, 0x1B},
+        {24000000, 88200, 0x4B},
+        {24000000, 96000, 0x5B},
+        {24000000, 176400, 0x8B},
+        {24000000, 192000, 0x9B},
+        {24576000, 48000, 0x12},
+        {24576000, 96000, 0x52},
+        {24576000, 192000, 0x92},
+        {26000000, 44100, 0x0F},
+        {26000000, 48000, 0x1F},
+        {26000000, 88200, 0x4F},
+        {26000000, 96000, 0x5F},
+        {26000000, 176400, 0x8F},
+        {26000000, 192000, 0x9F},
+};
+
+static int cs35l35_get_clk_config(int sysclk, int srate)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cs35l35_clk_ctl); i++) {
+                if (cs35l35_clk_ctl[i].sysclk == sysclk &&
+                        cs35l35_clk_ctl[i].srate == srate)
+                        return cs35l35_clk_ctl[i].clk_cfg;
+        }
+        return -EINVAL;
+}
+
+static int cs35l35_hw_params(struct snd_pcm_substream *substream,
+                                 struct snd_pcm_hw_params *params,
+                                 struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        struct classh_cfg *classh = &cs35l35->pdata.classh_algo;
+        int srate = params_rate(params);
+        int ret = 0;
+        u8 sp_sclks;
+        int audin_format;
+        int errata_chk;
+
+        int clk_ctl = cs35l35_get_clk_config(cs35l35->sysclk, srate);
+
+        if (clk_ctl < 0) {
+                dev_err(codec->dev, "Invalid CLK:Rate %d:%d\n",
+                        cs35l35->sysclk, srate);
+                return -EINVAL;
+        }
+
+        ret = regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL2,
+                          CS35L35_CLK_CTL2_MASK, clk_ctl);
+        if (ret != 0) {
+                dev_err(codec->dev, "Failed to set port config %d\n", ret);
+                return ret;
+        }
+
+        /*
+         * Rev A0 Errata
+         * When configured for the weak-drive detection path (CH_WKFET_DIS = 0)
+         * the Class H algorithm does not enable weak-drive operation for
+         * nonzero values of CH_WKFET_DELAY if SP_RATE = 01 or 10
+         */
+        errata_chk = clk_ctl & CS35L35_SP_RATE_MASK;
+
+        if (classh->classh_wk_fet_disable == 0x00 &&
+                (errata_chk == 0x01 || errata_chk == 0x03)) {
+                ret = regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DEL_MASK,
+                                        0 << CS35L35_CH_WKFET_DEL_SHIFT);
+                if (ret != 0) {
+                        dev_err(codec->dev, "Failed to set fet config %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        /*
+         * You can pull more Monitor data from the SDOUT pin than going to SDIN
+         * Just make sure your SCLK is fast enough to fill the frame
+         */
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                switch (params_width(params)) {
+                case 8:
+                        audin_format = CS35L35_SDIN_DEPTH_8;
+                        break;
+                case 16:
+                        audin_format = CS35L35_SDIN_DEPTH_16;
+                        break;
+                case 24:
+                        audin_format = CS35L35_SDIN_DEPTH_24;
+                        break;
+                default:
+                        dev_err(codec->dev, "Unsupported Width %d\n",
+                                params_width(params));
+                        return -EINVAL;
+                }
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_AUDIN_DEPTH_CTL,
+                                CS35L35_AUDIN_DEPTH_MASK,
+                                audin_format <<
+                                CS35L35_AUDIN_DEPTH_SHIFT);
+                if (cs35l35->pdata.stereo) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_AUDIN_DEPTH_CTL,
+                                        CS35L35_ADVIN_DEPTH_MASK,
+                                        audin_format <<
+                                        CS35L35_ADVIN_DEPTH_SHIFT);
+                }
+        }
+
+        if (cs35l35->i2s_mode) {
+                /* We have to take the SCLK to derive num sclks
+                 * to configure the CLOCK_CTL3 register correctly
+                 */
+                if ((cs35l35->sclk / srate) % 4) {
+                        dev_err(codec->dev, "Unsupported sclk/fs ratio %d:%d\n",
+                                        cs35l35->sclk, srate);
+                        return -EINVAL;
+                }
+                sp_sclks = ((cs35l35->sclk / srate) / 4) - 1;
+
+                /* Only certain ratios are supported in I2S Slave Mode */
+                if (cs35l35->slave_mode) {
+                        switch (sp_sclks) {
+                        case CS35L35_SP_SCLKS_32FS:
+                        case CS35L35_SP_SCLKS_48FS:
+                        case CS35L35_SP_SCLKS_64FS:
+                                break;
+                        default:
+                                dev_err(codec->dev, "ratio not supported\n");
+                                return -EINVAL;
+                        }
+                } else {
+                        /* Only certain ratios supported in I2S MASTER Mode */
+                        switch (sp_sclks) {
+                        case CS35L35_SP_SCLKS_32FS:
+                        case CS35L35_SP_SCLKS_64FS:
+                                break;
+                        default:
+                                dev_err(codec->dev, "ratio not supported\n");
+                                return -EINVAL;
+                        }
+                }
+                ret = regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLK_CTL3,
+                                        CS35L35_SP_SCLKS_MASK, sp_sclks <<
+                                        CS35L35_SP_SCLKS_SHIFT);
+                if (ret != 0) {
+                        dev_err(codec->dev, "Failed to set fsclk %d\n", ret);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+static const unsigned int cs35l35_src_rates[] = {
+        44100, 48000, 88200, 96000, 176400, 192000
+};
+
+static const struct snd_pcm_hw_constraint_list cs35l35_constraints = {
+        .count  = ARRAY_SIZE(cs35l35_src_rates),
+        .list   = cs35l35_src_rates,
+};
+
+static int cs35l35_pcm_startup(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        if (!substream->runtime)
+                return 0;
+
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE, &cs35l35_constraints);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_AMP_INP_DRV_CTL,
+                                        CS35L35_PDM_MODE_MASK,
+                                        0 << CS35L35_PDM_MODE_SHIFT);
+
+        return 0;
+}
+
+static const unsigned int cs35l35_pdm_rates[] = {
+        44100, 48000, 88200, 96000
+};
+
+static const struct snd_pcm_hw_constraint_list cs35l35_pdm_constraints = {
+        .count  = ARRAY_SIZE(cs35l35_pdm_rates),
+        .list   = cs35l35_pdm_rates,
+};
+
+static int cs35l35_pdm_startup(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        if (!substream->runtime)
+                return 0;
+
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE,
+                                &cs35l35_pdm_constraints);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_AMP_INP_DRV_CTL,
+                                        CS35L35_PDM_MODE_MASK,
+                                        1 << CS35L35_PDM_MODE_SHIFT);
+
+        return 0;
+}
+
+static int cs35l35_dai_set_sysclk(struct snd_soc_dai *dai,
+                                int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        /* Need the SCLK Frequency regardless of sysclk source for I2S */
+        cs35l35->sclk = freq;
+
+        return 0;
+}
+
+static const struct snd_soc_dai_ops cs35l35_ops = {
+        .startup = cs35l35_pcm_startup,
+        .set_fmt = cs35l35_set_dai_fmt,
+        .hw_params = cs35l35_hw_params,
+        .set_sysclk = cs35l35_dai_set_sysclk,
+};
+
+static const struct snd_soc_dai_ops cs35l35_pdm_ops = {
+        .startup = cs35l35_pdm_startup,
+        .set_fmt = cs35l35_set_dai_fmt,
+        .hw_params = cs35l35_hw_params,
+};
+
+static struct snd_soc_dai_driver cs35l35_dai[] = {
+        {
+                .name = "cs35l35-pcm",
+                .id = 0,
+                .playback = {
+                        .stream_name = "AMP Playback",
+                        .channels_min = 1,
+                        .channels_max = 8,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "AMP Capture",
+                        .channels_min = 1,
+                        .channels_max = 8,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .ops = &cs35l35_ops,
+                .symmetric_rates = 1,
+        },
+        {
+                .name = "cs35l35-pdm",
+                .id = 1,
+                .playback = {
+                        .stream_name = "PDM Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .ops = &cs35l35_pdm_ops,
+        },
+};
+
+static int cs35l35_codec_set_sysclk(struct snd_soc_codec *codec,
+                                int clk_id, int source, unsigned int freq,
+                                int dir)
+{
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        int clksrc;
+        int ret = 0;
+
+        switch (clk_id) {
+        case 0:
+                clksrc = CS35L35_CLK_SOURCE_MCLK;
+                break;
+        case 1:
+                clksrc = CS35L35_CLK_SOURCE_SCLK;
+                break;
+        case 2:
+                clksrc = CS35L35_CLK_SOURCE_PDM;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid CLK Source\n");
+                return -EINVAL;
+        }
+
+        switch (freq) {
+        case 5644800:
+        case 6144000:
+        case 11289600:
+        case 12000000:
+        case 12288000:
+        case 13000000:
+        case 22579200:
+        case 24000000:
+        case 24576000:
+        case 26000000:
+                cs35l35->sysclk = freq;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid CLK Frequency Input : %d\n", freq);
+                return -EINVAL;
+        }
+
+        ret = regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                CS35L35_CLK_SOURCE_MASK,
+                                clksrc << CS35L35_CLK_SOURCE_SHIFT);
+        if (ret != 0) {
+                dev_err(codec->dev, "Failed to set sysclk %d\n", ret);
+                return ret;
+        }
+
+        return ret;
+}
+
+static int cs35l35_codec_probe(struct snd_soc_codec *codec)
+{
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        struct classh_cfg *classh = &cs35l35->pdata.classh_algo;
+        struct monitor_cfg *monitor_config = &cs35l35->pdata.mon_cfg;
+        int ret;
+
+        /* Set Platform Data */
+        if (cs35l35->pdata.bst_vctl)
+                regmap_update_bits(cs35l35->regmap, CS35L35_BST_CVTR_V_CTL,
+                                CS35L35_BST_CTL_MASK,
+                                cs35l35->pdata.bst_vctl);
+
+        if (cs35l35->pdata.bst_ipk)
+                regmap_update_bits(cs35l35->regmap, CS35L35_BST_PEAK_I,
+                                CS35L35_BST_IPK_MASK,
+                                cs35l35->pdata.bst_ipk <<
+                                CS35L35_BST_IPK_SHIFT);
+
+        if (cs35l35->pdata.gain_zc)
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                                CS35L35_AMP_GAIN_ZC_MASK,
+                                cs35l35->pdata.gain_zc <<
+                                CS35L35_AMP_GAIN_ZC_SHIFT);
+
+        if (cs35l35->pdata.aud_channel)
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_AUDIN_RXLOC_CTL,
+                                CS35L35_AUD_IN_LR_MASK,
+                                cs35l35->pdata.aud_channel <<
+                                CS35L35_AUD_IN_LR_SHIFT);
+
+        if (cs35l35->pdata.stereo) {
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_ADVIN_RXLOC_CTL,
+                                CS35L35_ADV_IN_LR_MASK,
+                                cs35l35->pdata.adv_channel <<
+                                CS35L35_ADV_IN_LR_SHIFT);
+                if (cs35l35->pdata.shared_bst)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_STEREO_MASK,
+                                        1 << CS35L35_CH_STEREO_SHIFT);
+                ret = snd_soc_add_codec_controls(codec, cs35l35_adv_controls,
+                                        ARRAY_SIZE(cs35l35_adv_controls));
+                if (ret)
+                        return ret;
+        }
+
+        if (cs35l35->pdata.sp_drv_str)
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                CS35L35_SP_DRV_MASK,
+                                cs35l35->pdata.sp_drv_str <<
+                                CS35L35_SP_DRV_SHIFT);
+        if (cs35l35->pdata.sp_drv_unused)
+                regmap_update_bits(cs35l35->regmap, CS35L35_SP_FMT_CTL3,
+                                   CS35L35_SP_I2S_DRV_MASK,
+                                   cs35l35->pdata.sp_drv_unused <<
+                                   CS35L35_SP_I2S_DRV_SHIFT);
+
+        if (classh->classh_algo_enable) {
+                if (classh->classh_bst_override)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_BST_OVR_MASK,
+                                        classh->classh_bst_override <<
+                                        CS35L35_CH_BST_OVR_SHIFT);
+                if (classh->classh_bst_max_limit)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_BST_LIM_MASK,
+                                        classh->classh_bst_max_limit <<
+                                        CS35L35_CH_BST_LIM_SHIFT);
+                if (classh->classh_mem_depth)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_MEM_DEPTH_MASK,
+                                        classh->classh_mem_depth <<
+                                        CS35L35_CH_MEM_DEPTH_SHIFT);
+                if (classh->classh_headroom)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_HEADRM_CTL,
+                                        CS35L35_CH_HDRM_CTL_MASK,
+                                        classh->classh_headroom <<
+                                        CS35L35_CH_HDRM_CTL_SHIFT);
+                if (classh->classh_release_rate)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_RELEASE_RATE,
+                                        CS35L35_CH_REL_RATE_MASK,
+                                        classh->classh_release_rate <<
+                                        CS35L35_CH_REL_RATE_SHIFT);
+                if (classh->classh_wk_fet_disable)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DIS_MASK,
+                                        classh->classh_wk_fet_disable <<
+                                        CS35L35_CH_WKFET_DIS_SHIFT);
+                if (classh->classh_wk_fet_delay)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DEL_MASK,
+                                        classh->classh_wk_fet_delay <<
+                                        CS35L35_CH_WKFET_DEL_SHIFT);
+                if (classh->classh_wk_fet_thld)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_THLD_MASK,
+                                        classh->classh_wk_fet_thld <<
+                                        CS35L35_CH_WKFET_THLD_SHIFT);
+                if (classh->classh_vpch_auto)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_AUTO_MASK,
+                                        classh->classh_vpch_auto <<
+                                        CS35L35_CH_VP_AUTO_SHIFT);
+                if (classh->classh_vpch_rate)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_RATE_MASK,
+                                        classh->classh_vpch_rate <<
+                                        CS35L35_CH_VP_RATE_SHIFT);
+                if (classh->classh_vpch_man)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_MAN_MASK,
+                                        classh->classh_vpch_man <<
+                                        CS35L35_CH_VP_MAN_SHIFT);
+        }
+
+        if (monitor_config->is_present) {
+                if (monitor_config->vmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SPKMON_DEPTH_CTL,
+                                        CS35L35_VMON_DEPTH_MASK,
+                                        monitor_config->vmon_dpth <<
+                                        CS35L35_VMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->imon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SPKMON_DEPTH_CTL,
+                                        CS35L35_IMON_DEPTH_MASK,
+                                        monitor_config->imon_dpth <<
+                                        CS35L35_IMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->imon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->imon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_SCALE_CTL,
+                                        CS35L35_IMON_SCALE_MASK,
+                                        monitor_config->imon_scale <<
+                                        CS35L35_IMON_SCALE_SHIFT);
+                }
+                if (monitor_config->vpmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VPMON_DEPTH_MASK,
+                                        monitor_config->vpmon_dpth <<
+                                        CS35L35_VPMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vpmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vpmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->vbstmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VBSTMON_DEPTH_MASK,
+                                        monitor_config->vpmon_dpth <<
+                                        CS35L35_VBSTMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VBSTMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vbstmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VBSTMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vbstmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->vpbrstat_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VPBRSTAT_DEPTH_MASK,
+                                        monitor_config->vpbrstat_dpth <<
+                                        CS35L35_VPBRSTAT_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPBR_STATUS_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vpbrstat_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPBR_STATUS_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vpbrstat_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->zerofill_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_ZEROFILL_DEPTH_MASK,
+                                        monitor_config->zerofill_dpth <<
+                                        CS35L35_ZEROFILL_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_ZERO_FILL_LOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->zerofill_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_ZERO_FILL_LOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->zerofill_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+        }
+
+        return 0;
+}
+
+static struct snd_soc_codec_driver soc_codec_dev_cs35l35 = {
+        .probe = cs35l35_codec_probe,
+        .set_sysclk = cs35l35_codec_set_sysclk,
+        .component_driver = {
+                .dapm_widgets = cs35l35_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(cs35l35_dapm_widgets),
+
+                .dapm_routes = cs35l35_audio_map,
+                .num_dapm_routes = ARRAY_SIZE(cs35l35_audio_map),
+
+                .controls = cs35l35_aud_controls,
+                .num_controls = ARRAY_SIZE(cs35l35_aud_controls),
+        },
+
+};
+
+static struct regmap_config cs35l35_regmap = {
+        .reg_bits = 8,
+        .val_bits = 8,
+
+        .max_register = CS35L35_MAX_REGISTER,
+        .reg_defaults = cs35l35_reg,
+        .num_reg_defaults = ARRAY_SIZE(cs35l35_reg),
+        .volatile_reg = cs35l35_volatile_register,
+        .readable_reg = cs35l35_readable_register,
+        .precious_reg = cs35l35_precious_register,
+        .cache_type = REGCACHE_RBTREE,
+};
+
+static irqreturn_t cs35l35_irq(int irq, void *data)
+{
+        struct cs35l35_private *cs35l35 = data;
+        unsigned int sticky1, sticky2, sticky3, sticky4;
+        unsigned int mask1, mask2, mask3, mask4, current1;
+
+        /* ack the irq by reading all status registers */
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_4, &sticky4);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_3, &sticky3);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_2, &sticky2);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_1, &sticky1);
+
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_4, &mask4);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_3, &mask3);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_2, &mask2);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_1, &mask1);
+
+        /* Check to see if unmasked bits are active */
+        if (!(sticky1 & ~mask1) && !(sticky2 & ~mask2) && !(sticky3 & ~mask3)
+                        && !(sticky4 & ~mask4))
+                return IRQ_NONE;
+
+        if (sticky2 & CS35L35_PDN_DONE)
+                complete(&cs35l35->pdn_done);
+
+        /* read the current values */
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_1, &current1);
+
+        /* handle the interrupts */
+        if (sticky1 & CS35L35_CAL_ERR) {
+                dev_crit(cs35l35->dev, "Calibration Error\n");
+
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_CAL_ERR)) {
+                        pr_debug("%s : Cal error release\n", __func__);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS,
+                                        CS35L35_CAL_ERR_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_AMP_SHORT) {
+                dev_crit(cs35l35->dev, "AMP Short Error\n");
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_AMP_SHORT)) {
+                        dev_dbg(cs35l35->dev, "Amp short error release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS,
+                                        CS35L35_SHORT_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_OTW) {
+                dev_warn(cs35l35->dev, "Over temperature warning\n");
+
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_OTW)) {
+                        dev_dbg(cs35l35->dev, "Over temperature warn release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS,
+                                        CS35L35_OTW_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_OTE) {
+                dev_crit(cs35l35->dev, "Over temperature error\n");
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_OTE)) {
+                        dev_dbg(cs35l35->dev, "Over temperature error release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS,
+                                        CS35L35_OTE_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS, 0);
+                }
+        }
+
+        if (sticky3 & CS35L35_BST_HIGH) {
+                dev_crit(cs35l35->dev, "VBST error: powering off!\n");
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PDN_AMP, CS35L35_PDN_AMP);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                        CS35L35_PDN_ALL, CS35L35_PDN_ALL);
+        }
+
+        if (sticky3 & CS35L35_LBST_SHORT) {
+                dev_crit(cs35l35->dev, "LBST error: powering off!\n");
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PDN_AMP, CS35L35_PDN_AMP);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                        CS35L35_PDN_ALL, CS35L35_PDN_ALL);
+        }
+
+        if (sticky2 & CS35L35_VPBR_ERR)
+                dev_dbg(cs35l35->dev, "Error: Reactive Brownout\n");
+
+        if (sticky4 & CS35L35_VMON_OVFL)
+                dev_dbg(cs35l35->dev, "Error: VMON overflow\n");
+
+        if (sticky4 & CS35L35_IMON_OVFL)
+                dev_dbg(cs35l35->dev, "Error: IMON overflow\n");
+
+        return IRQ_HANDLED;
+}
+
+
+static int cs35l35_handle_of_data(struct i2c_client *i2c_client,
+                                struct cs35l35_platform_data *pdata)
+{
+        struct device_node *np = i2c_client->dev.of_node;
+        struct device_node *classh, *signal_format;
+        struct classh_cfg *classh_config = &pdata->classh_algo;
+        struct monitor_cfg *monitor_config = &pdata->mon_cfg;
+        unsigned int val32 = 0;
+        u8 monitor_array[4];
+        const int imon_array_size = ARRAY_SIZE(monitor_array);
+        const int mon_array_size = imon_array_size - 1;
+        int ret = 0;
+
+        if (!np)
+                return 0;
+
+        pdata->bst_pdn_fet_on = of_property_read_bool(np,
+                                        "cirrus,boost-pdn-fet-on");
+
+        ret = of_property_read_u32(np, "cirrus,boost-ctl-millivolt", &val32);
+        if (ret >= 0) {
+                if (val32 < 2600 || val32 > 9000) {
+                        dev_err(&i2c_client->dev,
+                                "Invalid Boost Voltage %d mV\n", val32);
+                        return -EINVAL;
+                }
+                pdata->bst_vctl = ((val32 - 2600) / 100) + 1;
+        }
+
+        ret = of_property_read_u32(np, "cirrus,boost-peak-milliamp", &val32);
+        if (ret >= 0) {
+                if (val32 < 1680 || val32 > 4480) {
+                        dev_err(&i2c_client->dev,
+                                "Invalid Boost Peak Current %u mA\n", val32);
+                        return -EINVAL;
+                }
+
+                pdata->bst_ipk = (val32 - 1680) / 110;
+        }
+
+        if (of_property_read_u32(np, "cirrus,sp-drv-strength", &val32) >= 0)
+                pdata->sp_drv_str = val32;
+        if (of_property_read_u32(np, "cirrus,sp-drv-unused", &val32) >= 0)
+                pdata->sp_drv_unused = val32 | CS35L35_VALID_PDATA;
+
+        pdata->stereo = of_property_read_bool(np, "cirrus,stereo-config");
+
+        if (pdata->stereo) {
+                ret = of_property_read_u32(np, "cirrus,audio-channel", &val32);
+                if (ret >= 0)
+                        pdata->aud_channel = val32;
+
+                ret = of_property_read_u32(np, "cirrus,advisory-channel",
+                                           &val32);
+                if (ret >= 0)
+                        pdata->adv_channel = val32;
+
+                pdata->shared_bst = of_property_read_bool(np,
+                                                "cirrus,shared-boost");
+        }
+
+        pdata->ext_bst = of_property_read_bool(np, "cirrus,external-boost");
+
+        pdata->gain_zc = of_property_read_bool(np, "cirrus,amp-gain-zc");
+
+        classh = of_get_child_by_name(np, "cirrus,classh-internal-algo");
+        classh_config->classh_algo_enable = classh ? true : false;
+
+        if (classh_config->classh_algo_enable) {
+                classh_config->classh_bst_override =
+                        of_property_read_bool(np, "cirrus,classh-bst-overide");
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-bst-max-limit",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_bst_max_limit = val32;
+                }
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-bst-max-limit",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_bst_max_limit = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-mem-depth",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_mem_depth = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-release-rate",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_release_rate = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-headroom",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_headroom = val32;
+                }
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-wk-fet-disable",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_wk_fet_disable = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-wk-fet-delay",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_wk_fet_delay = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-wk-fet-thld",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_wk_fet_thld = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-auto",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_vpch_auto = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-rate",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_vpch_rate = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-man",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_vpch_man = val32;
+        }
+        of_node_put(classh);
+
+        /* frame depth location */
+        signal_format = of_get_child_by_name(np, "cirrus,monitor-signal-format");
+        monitor_config->is_present = signal_format ? true : false;
+        if (monitor_config->is_present) {
+                ret = of_property_read_u8_array(signal_format, "cirrus,imon",
+                                                monitor_array, imon_array_size);
+                if (!ret) {
+                        monitor_config->imon_specs = true;
+                        monitor_config->imon_dpth = monitor_array[0];
+                        monitor_config->imon_loc = monitor_array[1];
+                        monitor_config->imon_frm = monitor_array[2];
+                        monitor_config->imon_scale = monitor_array[3];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vmon_specs = true;
+                        monitor_config->vmon_dpth = monitor_array[0];
+                        monitor_config->vmon_loc = monitor_array[1];
+                        monitor_config->vmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vpmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vpmon_specs = true;
+                        monitor_config->vpmon_dpth = monitor_array[0];
+                        monitor_config->vpmon_loc = monitor_array[1];
+                        monitor_config->vpmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vbstmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vbstmon_specs = true;
+                        monitor_config->vbstmon_dpth = monitor_array[0];
+                        monitor_config->vbstmon_loc = monitor_array[1];
+                        monitor_config->vbstmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vpbrstat",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vpbrstat_specs = true;
+                        monitor_config->vpbrstat_dpth = monitor_array[0];
+                        monitor_config->vpbrstat_loc = monitor_array[1];
+                        monitor_config->vpbrstat_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,zerofill",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->zerofill_specs = true;
+                        monitor_config->zerofill_dpth = monitor_array[0];
+                        monitor_config->zerofill_loc = monitor_array[1];
+                        monitor_config->zerofill_frm = monitor_array[2];
+                }
+        }
+        of_node_put(signal_format);
+
+        return 0;
+}
+
+/* Errata Rev A0 */
+static const struct reg_sequence cs35l35_errata_patch[] = {
+
+        { 0x7F, 0x99 },
+        { 0x00, 0x99 },
+        { 0x52, 0x22 },
+        { 0x04, 0x14 },
+        { 0x6D, 0x44 },
+        { 0x24, 0x10 },
+        { 0x58, 0xC4 },
+        { 0x00, 0x98 },
+        { 0x18, 0x08 },
+        { 0x00, 0x00 },
+        { 0x7F, 0x00 },
+};
+
+static int cs35l35_i2c_probe(struct i2c_client *i2c_client,
+                              const struct i2c_device_id *id)
+{
+        struct cs35l35_private *cs35l35;
+        struct device *dev = &i2c_client->dev;
+        struct cs35l35_platform_data *pdata = dev_get_platdata(dev);
+        int i;
+        int ret;
+        unsigned int devid = 0;
+        unsigned int reg;
+
+        cs35l35 = devm_kzalloc(dev, sizeof(struct cs35l35_private), GFP_KERNEL);
+        if (!cs35l35)
+                return -ENOMEM;
+
+        cs35l35->dev = dev;
+
+        i2c_set_clientdata(i2c_client, cs35l35);
+        cs35l35->regmap = devm_regmap_init_i2c(i2c_client, &cs35l35_regmap);
+        if (IS_ERR(cs35l35->regmap)) {
+                ret = PTR_ERR(cs35l35->regmap);
+                dev_err(dev, "regmap_init() failed: %d\n", ret);
+                goto err;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(cs35l35_supplies); i++)
+                cs35l35->supplies[i].supply = cs35l35_supplies[i];
+
+        cs35l35->num_supplies = ARRAY_SIZE(cs35l35_supplies);
+
+        ret = devm_regulator_bulk_get(dev, cs35l35->num_supplies,
+                                      cs35l35->supplies);
+        if (ret != 0) {
+                dev_err(dev, "Failed to request core supplies: %d\n", ret);
+                return ret;
+        }
+
+        if (pdata) {
+                cs35l35->pdata = *pdata;
+        } else {
+                pdata = devm_kzalloc(dev, sizeof(struct cs35l35_platform_data),
+                                     GFP_KERNEL);
+                if (!pdata)
+                        return -ENOMEM;
+                if (i2c_client->dev.of_node) {
+                        ret = cs35l35_handle_of_data(i2c_client, pdata);
+                        if (ret != 0)
+                                return ret;
+
+                }
+                cs35l35->pdata = *pdata;
+        }
+
+        ret = regulator_bulk_enable(cs35l35->num_supplies,
+                                        cs35l35->supplies);
+        if (ret != 0) {
+                dev_err(dev, "Failed to enable core supplies: %d\n", ret);
+                return ret;
+        }
+
+        /* returning NULL can be valid if in stereo mode */
+        cs35l35->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+                                                      GPIOD_OUT_LOW);
+        if (IS_ERR(cs35l35->reset_gpio)) {
+                ret = PTR_ERR(cs35l35->reset_gpio);
+                cs35l35->reset_gpio = NULL;
+                if (ret == -EBUSY) {
+                        dev_info(dev,
+                                 "Reset line busy, assuming shared reset\n");
+                } else {
+                        dev_err(dev, "Failed to get reset GPIO: %d\n", ret);
+                        goto err;
+                }
+        }
+
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 1);
+
+        init_completion(&cs35l35->pdn_done);
+
+        ret = devm_request_threaded_irq(dev, i2c_client->irq, NULL, cs35l35_irq,
+                                        IRQF_ONESHOT | IRQF_TRIGGER_LOW |
+                                        IRQF_SHARED, "cs35l35", cs35l35);
+        if (ret != 0) {
+                dev_err(dev, "Failed to request IRQ: %d\n", ret);
+                goto err;
+        }
+        /* initialize codec */
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_AB, &reg);
+
+        devid = (reg & 0xFF) << 12;
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_CD, &reg);
+        devid |= (reg & 0xFF) << 4;
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_E, &reg);
+        devid |= (reg & 0xF0) >> 4;
+
+        if (devid != CS35L35_CHIP_ID) {
+                dev_err(dev, "CS35L35 Device ID (%X). Expected ID %X\n",
+                        devid, CS35L35_CHIP_ID);
+                ret = -ENODEV;
+                goto err;
+        }
+
+        ret = regmap_read(cs35l35->regmap, CS35L35_REV_ID, &reg);
+        if (ret < 0) {
+                dev_err(dev, "Get Revision ID failed: %d\n", ret);
+                goto err;
+        }
+
+        ret = regmap_register_patch(cs35l35->regmap, cs35l35_errata_patch,
+                                    ARRAY_SIZE(cs35l35_errata_patch));
+        if (ret < 0) {
+                dev_err(dev, "Failed to apply errata patch: %d\n", ret);
+                goto err;
+        }
+
+        dev_info(dev, "Cirrus Logic CS35L35 (%x), Revision: %02X\n",
+                 devid, reg & 0xFF);
+
+        /* Set the INT Masks for critical errors */
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_1,
+                                CS35L35_INT1_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_2,
+                                CS35L35_INT2_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_3,
+                                CS35L35_INT3_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_4,
+                                CS35L35_INT4_CRIT_MASK);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PWR2_PDN_MASK,
+                        CS35L35_PWR2_PDN_MASK);
+
+        if (cs35l35->pdata.bst_pdn_fet_on)
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                        CS35L35_PDN_BST_MASK,
+                                        1 << CS35L35_PDN_BST_FETON_SHIFT);
+        else
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                        CS35L35_PDN_BST_MASK,
+                                        1 << CS35L35_PDN_BST_FETOFF_SHIFT);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL3,
+                        CS35L35_PWR3_PDN_MASK,
+                        CS35L35_PWR3_PDN_MASK);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                CS35L35_AMP_MUTE_MASK, 1 << CS35L35_AMP_MUTE_SHIFT);
+
+        ret =  snd_soc_register_codec(dev, &soc_codec_dev_cs35l35, cs35l35_dai,
+                                      ARRAY_SIZE(cs35l35_dai));
+        if (ret < 0) {
+                dev_err(dev, "Failed to register codec: %d\n", ret);
+                goto err;
+        }
+
+        return 0;
+
+err:
+        regulator_bulk_disable(cs35l35->num_supplies,
+                               cs35l35->supplies);
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
+
+        return ret;
+}
+
+static int cs35l35_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct of_device_id cs35l35_of_match[] = {
+        {.compatible = "cirrus,cs35l35"},
+        {},
+};
+MODULE_DEVICE_TABLE(of, cs35l35_of_match);
+
+static const struct i2c_device_id cs35l35_id[] = {
+        {"cs35l35", 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, cs35l35_id);
+
+static struct i2c_driver cs35l35_i2c_driver = {
+        .driver = {
+                .name = "cs35l35",
+                .of_match_table = cs35l35_of_match,
+        },
+        .id_table = cs35l35_id,
+        .probe = cs35l35_i2c_probe,
+        .remove = cs35l35_i2c_remove,
+};
+
+module_i2c_driver(cs35l35_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC CS35L35 driver");
+MODULE_AUTHOR("Brian Austin, Cirrus Logic Inc, <brian.austin@cirrus.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/cs35l35.h b/sound/soc/codecs/cs35l35.h
new file mode 100644
index 000000000000..5a6e43a87c4d
--- /dev/null
+++ b/sound/soc/codecs/cs35l35.h
@@ -0,0 +1,294 @@
+/*
+ * cs35l35.h -- CS35L35 ALSA SoC audio driver
+ *
+ * Copyright 2016 Cirrus Logic, Inc.
+ *
+ * Author: Brian Austin <brian.austin@cirrus.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef __CS35L35_H__
+#define __CS35L35_H__
+
+#define CS35L35_FIRSTREG                0x01
+#define CS35L35_LASTREG                 0x7E
+#define CS35L35_CHIP_ID                 0x00035A35
+#define CS35L35_DEVID_AB                0x01    /* Device ID A & B [RO] */
+#define CS35L35_DEVID_CD                0x02    /* Device ID C & D [RO] */
+#define CS35L35_DEVID_E                 0x03    /* Device ID E [RO] */
+#define CS35L35_FAB_ID                  0x04    /* Fab ID [RO] */
+#define CS35L35_REV_ID                  0x05    /* Revision ID [RO] */
+#define CS35L35_PWRCTL1                 0x06    /* Power Ctl 1 */
+#define CS35L35_PWRCTL2                 0x07    /* Power Ctl 2 */
+#define CS35L35_PWRCTL3                 0x08    /* Power Ctl 3 */
+#define CS35L35_CLK_CTL1                0x0A    /* Clocking Ctl 1 */
+#define CS35L35_CLK_CTL2                0x0B    /* Clocking Ctl 2 */
+#define CS35L35_CLK_CTL3                0x0C    /* Clocking Ctl 3 */
+#define CS35L35_SP_FMT_CTL1             0x0D    /* Serial Port Format CTL1 */
+#define CS35L35_SP_FMT_CTL2             0x0E    /* Serial Port Format CTL2 */
+#define CS35L35_SP_FMT_CTL3             0x0F    /* Serial Port Format CTL3 */
+#define CS35L35_MAG_COMP_CTL            0x13    /* Magnitude Comp CTL */
+#define CS35L35_AMP_INP_DRV_CTL         0x14    /* Amp Input Drive Ctl */
+#define CS35L35_AMP_DIG_VOL_CTL         0x15    /* Amplifier Dig Volume Ctl */
+#define CS35L35_AMP_DIG_VOL             0x16    /* Amplifier Dig Volume */
+#define CS35L35_ADV_DIG_VOL             0x17    /* Advisory Digital Volume */
+#define CS35L35_PROTECT_CTL             0x18    /* Amp Gain - Prot Ctl Param */
+#define CS35L35_AMP_GAIN_AUD_CTL        0x19    /* Amp Serial Port Gain Ctl */
+#define CS35L35_AMP_GAIN_PDM_CTL        0x1A    /* Amplifier Gain PDM Ctl */
+#define CS35L35_AMP_GAIN_ADV_CTL        0x1B    /* Amplifier Gain Ctl */
+#define CS35L35_GPI_CTL                 0x1C    /* GPI Ctl */
+#define CS35L35_BST_CVTR_V_CTL          0x1D    /* Boost Conv Voltage Ctl */
+#define CS35L35_BST_PEAK_I              0x1E    /* Boost Conv Peak Current */
+#define CS35L35_BST_RAMP_CTL            0x20    /* Boost Conv Soft Ramp Ctl */
+#define CS35L35_BST_CONV_COEF_1         0x21    /* Boost Conv Coefficients 1 */
+#define CS35L35_BST_CONV_COEF_2         0x22    /* Boost Conv Coefficients 2 */
+#define CS35L35_BST_CONV_SLOPE_COMP     0x23    /* Boost Conv Slope Comp */
+#define CS35L35_BST_CONV_SW_FREQ        0x24    /* Boost Conv L BST SW Freq */
+#define CS35L35_CLASS_H_CTL             0x30    /* CLS H Control */
+#define CS35L35_CLASS_H_HEADRM_CTL      0x31    /* CLS H Headroom Ctl */
+#define CS35L35_CLASS_H_RELEASE_RATE    0x32    /* CLS H Release Rate */
+#define CS35L35_CLASS_H_FET_DRIVE_CTL   0x33    /* CLS H Weak FET Drive Ctl */
+#define CS35L35_CLASS_H_VP_CTL          0x34    /* CLS H VP Ctl */
+#define CS35L35_CLASS_H_STATUS          0x38    /* CLS H Status */
+#define CS35L35_VPBR_CTL                0x3A    /* VPBR Ctl */
+#define CS35L35_VPBR_VOL_CTL            0x3B    /* VPBR Volume Ctl */
+#define CS35L35_VPBR_TIMING_CTL         0x3C    /* VPBR Timing Ctl */
+#define CS35L35_VPBR_MODE_VOL_CTL       0x3D    /* VPBR Mode/Attack Vol Ctl */
+#define CS35L35_VPBR_ATTEN_STATUS       0x4B    /* VPBR Attenuation Status */
+#define CS35L35_SPKR_MON_CTL            0x4E    /* Speaker Monitoring Ctl */
+#define CS35L35_IMON_SCALE_CTL          0x51    /* IMON Scale Ctl */
+#define CS35L35_AUDIN_RXLOC_CTL         0x52    /* Audio Input RX Loc Ctl */
+#define CS35L35_ADVIN_RXLOC_CTL         0x53    /* Advisory Input RX Loc Ctl */
+#define CS35L35_VMON_TXLOC_CTL          0x54    /* VMON TX Loc Ctl */
+#define CS35L35_IMON_TXLOC_CTL          0x55    /* IMON TX Loc Ctl */
+#define CS35L35_VPMON_TXLOC_CTL         0x56    /* VPMON TX Loc Ctl */
+#define CS35L35_VBSTMON_TXLOC_CTL       0x57    /* VBSTMON TX Loc Ctl */
+#define CS35L35_VPBR_STATUS_TXLOC_CTL   0x58    /* VPBR Status TX Loc Ctl */
+#define CS35L35_ZERO_FILL_LOC_CTL       0x59    /* Zero Fill Loc Ctl */
+#define CS35L35_AUDIN_DEPTH_CTL         0x5A    /* Audio Input Depth Ctl */
+#define CS35L35_SPKMON_DEPTH_CTL        0x5B    /* SPK Mon Output Depth Ctl */
+#define CS35L35_SUPMON_DEPTH_CTL        0x5C    /* Supply Mon Out Depth Ctl */
+#define CS35L35_ZEROFILL_DEPTH_CTL      0x5D    /* Zero Fill Mon Output Ctl */
+#define CS35L35_MULT_DEV_SYNCH1         0x62    /* Multidevice Synch */
+#define CS35L35_MULT_DEV_SYNCH2         0x63    /* Multidevice Synch 2 */
+#define CS35L35_PROT_RELEASE_CTL        0x64    /* Protection Release Ctl */
+#define CS35L35_DIAG_MODE_REG_LOCK      0x68    /* Diagnostic Mode Reg Lock */
+#define CS35L35_DIAG_MODE_CTL_1         0x69    /* Diagnostic Mode Ctl 1 */
+#define CS35L35_DIAG_MODE_CTL_2         0x6A    /* Diagnostic Mode Ctl 2 */
+#define CS35L35_INT_MASK_1              0x70    /* Interrupt Mask 1 */
+#define CS35L35_INT_MASK_2              0x71    /* Interrupt Mask 2 */
+#define CS35L35_INT_MASK_3              0x72    /* Interrupt Mask 3 */
+#define CS35L35_INT_MASK_4              0x73    /* Interrupt Mask 4 */
+#define CS35L35_INT_STATUS_1            0x74    /* Interrupt Status 1 */
+#define CS35L35_INT_STATUS_2            0x75    /* Interrupt Status 2 */
+#define CS35L35_INT_STATUS_3            0x76    /* Interrupt Status 3 */
+#define CS35L35_INT_STATUS_4            0x77    /* Interrupt Status 4 */
+#define CS35L35_PLL_STATUS              0x78    /* PLL Status */
+#define CS35L35_OTP_TRIM_STATUS         0x7E    /* OTP Trim Status */
+
+#define CS35L35_MAX_REGISTER            0x7F
+
+/* CS35L35_PWRCTL1 */
+#define CS35L35_SFT_RST                 0x80
+#define CS35L35_DISCHG_FLT              0x02
+#define CS35L35_PDN_ALL                 0x01
+
+/* CS35L35_PWRCTL2 */
+#define CS35L35_PDN_VMON                0x80
+#define CS35L35_PDN_IMON                0x40
+#define CS35L35_PDN_CLASSH              0x20
+#define CS35L35_PDN_VPBR                0x10
+#define CS35L35_PDN_BST                 0x04
+#define CS35L35_PDN_AMP                 0x01
+
+/* CS35L35_PWRCTL3 */
+#define CS35L35_PDN_VBSTMON_OUT         0x10
+#define CS35L35_PDN_VMON_OUT            0x08
+
+#define CS35L35_AUDIN_DEPTH_MASK        0x03
+#define CS35L35_AUDIN_DEPTH_SHIFT       0
+#define CS35L35_ADVIN_DEPTH_MASK        0x0C
+#define CS35L35_ADVIN_DEPTH_SHIFT       2
+#define CS35L35_SDIN_DEPTH_8            0x01
+#define CS35L35_SDIN_DEPTH_16           0x02
+#define CS35L35_SDIN_DEPTH_24           0x03
+
+#define CS35L35_SDOUT_DEPTH_8           0x01
+#define CS35L35_SDOUT_DEPTH_12          0x02
+#define CS35L35_SDOUT_DEPTH_16          0x03
+
+#define CS35L35_AUD_IN_LR_MASK          0x80
+#define CS35L35_AUD_IN_LR_SHIFT         7
+#define CS35L35_ADV_IN_LR_MASK          0x80
+#define CS35L35_ADV_IN_LR_SHIFT         7
+#define CS35L35_AUD_IN_LOC_MASK         0x0F
+#define CS35L35_AUD_IN_LOC_SHIFT        0
+#define CS35L35_ADV_IN_LOC_MASK         0x0F
+#define CS35L35_ADV_IN_LOC_SHIFT        0
+
+#define CS35L35_IMON_DEPTH_MASK         0x03
+#define CS35L35_IMON_DEPTH_SHIFT        0
+#define CS35L35_VMON_DEPTH_MASK         0x0C
+#define CS35L35_VMON_DEPTH_SHIFT        2
+#define CS35L35_VBSTMON_DEPTH_MASK      0x03
+#define CS35L35_VBSTMON_DEPTH_SHIFT     0
+#define CS35L35_VPMON_DEPTH_MASK        0x0C
+#define CS35L35_VPMON_DEPTH_SHIFT       2
+#define CS35L35_VPBRSTAT_DEPTH_MASK     0x30
+#define CS35L35_VPBRSTAT_DEPTH_SHIFT    4
+#define CS35L35_ZEROFILL_DEPTH_MASK     0x03
+#define CS35L35_ZEROFILL_DEPTH_SHIFT    0x00
+
+#define CS35L35_MON_TXLOC_MASK          0x3F
+#define CS35L35_MON_TXLOC_SHIFT         0
+#define CS35L35_MON_FRM_MASK            0x80
+#define CS35L35_MON_FRM_SHIFT           7
+
+#define CS35L35_IMON_SCALE_MASK         0xF8
+#define CS35L35_IMON_SCALE_SHIFT        3
+
+#define CS35L35_MS_MASK                 0x80
+#define CS35L35_MS_SHIFT                7
+#define CS35L35_SPMODE_MASK             0x40
+#define CS35L35_SP_DRV_MASK             0x10
+#define CS35L35_SP_DRV_SHIFT            4
+#define CS35L35_CLK_CTL2_MASK           0xFF
+#define CS35L35_PDM_MODE_MASK           0x40
+#define CS35L35_PDM_MODE_SHIFT          6
+#define CS35L35_CLK_SOURCE_MASK         0x03
+#define CS35L35_CLK_SOURCE_SHIFT        0
+#define CS35L35_CLK_SOURCE_MCLK         0
+#define CS35L35_CLK_SOURCE_SCLK         1
+#define CS35L35_CLK_SOURCE_PDM          2
+
+#define CS35L35_SP_SCLKS_MASK           0x0F
+#define CS35L35_SP_SCLKS_SHIFT          0x00
+#define CS35L35_SP_SCLKS_16FS           0x03
+#define CS35L35_SP_SCLKS_32FS           0x07
+#define CS35L35_SP_SCLKS_48FS           0x0B
+#define CS35L35_SP_SCLKS_64FS           0x0F
+#define CS35L35_SP_RATE_MASK            0xC0
+
+#define CS35L35_PDN_BST_MASK            0x06
+#define CS35L35_PDN_BST_FETON_SHIFT     1
+#define CS35L35_PDN_BST_FETOFF_SHIFT    2
+#define CS35L35_PWR2_PDN_MASK           0xE0
+#define CS35L35_PWR3_PDN_MASK           0x1E
+#define CS35L35_PDN_ALL_MASK            0x01
+#define CS35L35_DISCHG_FILT_MASK        0x02
+#define CS35L35_DISCHG_FILT_SHIFT       1
+#define CS35L35_MCLK_DIS_MASK           0x04
+#define CS35L35_MCLK_DIS_SHIFT          2
+
+#define CS35L35_BST_CTL_MASK            0x7F
+#define CS35L35_BST_CTL_SHIFT           0
+#define CS35L35_BST_IPK_MASK            0x1F
+#define CS35L35_BST_IPK_SHIFT           0
+#define CS35L35_AMP_MUTE_MASK           0x20
+#define CS35L35_AMP_MUTE_SHIFT          5
+#define CS35L35_AMP_GAIN_ZC_MASK        0x10
+#define CS35L35_AMP_GAIN_ZC_SHIFT       4
+
+#define CS35L35_AMP_DIGSFT_MASK         0x02
+#define CS35L35_AMP_DIGSFT_SHIFT        1
+
+/* CS35L35_SP_FMT_CTL3 */
+#define CS35L35_SP_I2S_DRV_MASK         0x03
+#define CS35L35_SP_I2S_DRV_SHIFT        0
+
+/* Class H Algorithm Control */
+#define CS35L35_CH_STEREO_MASK          0x40
+#define CS35L35_CH_STEREO_SHIFT         6
+#define CS35L35_CH_BST_OVR_MASK         0x04
+#define CS35L35_CH_BST_OVR_SHIFT        2
+#define CS35L35_CH_BST_LIM_MASK         0x08
+#define CS35L35_CH_BST_LIM_SHIFT        3
+#define CS35L35_CH_MEM_DEPTH_MASK       0x01
+#define CS35L35_CH_MEM_DEPTH_SHIFT      0
+#define CS35L35_CH_HDRM_CTL_MASK        0x3F
+#define CS35L35_CH_HDRM_CTL_SHIFT       0
+#define CS35L35_CH_REL_RATE_MASK        0xFF
+#define CS35L35_CH_REL_RATE_SHIFT       0
+#define CS35L35_CH_WKFET_DIS_MASK       0x80
+#define CS35L35_CH_WKFET_DIS_SHIFT      7
+#define CS35L35_CH_WKFET_DEL_MASK       0x70
+#define CS35L35_CH_WKFET_DEL_SHIFT      4
+#define CS35L35_CH_WKFET_THLD_MASK      0x0F
+#define CS35L35_CH_WKFET_THLD_SHIFT     0
+#define CS35L35_CH_VP_AUTO_MASK         0x80
+#define CS35L35_CH_VP_AUTO_SHIFT        7
+#define CS35L35_CH_VP_RATE_MASK         0x60
+#define CS35L35_CH_VP_RATE_SHIFT        5
+#define CS35L35_CH_VP_MAN_MASK          0x1F
+#define CS35L35_CH_VP_MAN_SHIFT         0
+
+/* CS35L35_PROT_RELEASE_CTL */
+#define CS35L35_CAL_ERR_RLS             0x80
+#define CS35L35_SHORT_RLS               0x04
+#define CS35L35_OTW_RLS                 0x02
+#define CS35L35_OTE_RLS                 0x01
+
+/* INT Mask Registers */
+#define CS35L35_INT1_CRIT_MASK          0x38
+#define CS35L35_INT2_CRIT_MASK          0xEF
+#define CS35L35_INT3_CRIT_MASK          0xEE
+#define CS35L35_INT4_CRIT_MASK          0xFF
+
+/* PDN DONE Masks */
+#define CS35L35_M_PDN_DONE_SHIFT        4
+#define CS35L35_M_PDN_DONE_MASK         0x10
+
+/* CS35L35_INT_1 */
+#define CS35L35_CAL_ERR                 0x80
+#define CS35L35_OTP_ERR                 0x40
+#define CS35L35_LRCLK_ERR               0x20
+#define CS35L35_SPCLK_ERR               0x10
+#define CS35L35_MCLK_ERR                0x08
+#define CS35L35_AMP_SHORT               0x04
+#define CS35L35_OTW                     0x02
+#define CS35L35_OTE                     0x01
+
+/* CS35L35_INT_2 */
+#define CS35L35_PDN_DONE                0x10
+#define CS35L35_VPBR_ERR                0x02
+#define CS35L35_VPBR_CLR                0x01
+
+/* CS35L35_INT_3 */
+#define CS35L35_BST_HIGH                0x10
+#define CS35L35_BST_HIGH_FLAG           0x08
+#define CS35L35_BST_IPK_FLAG            0x04
+#define CS35L35_LBST_SHORT              0x01
+
+/* CS35L35_INT_4 */
+#define CS35L35_VMON_OVFL               0x08
+#define CS35L35_IMON_OVFL               0x04
+
+#define CS35L35_FORMATS (SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+struct  cs35l35_private {
+        struct device *dev;
+        struct cs35l35_platform_data pdata;
+        struct regmap *regmap;
+        struct regulator_bulk_data supplies[2];
+        int num_supplies;
+        int sysclk;
+        int sclk;
+        bool pdm_mode;
+        bool i2s_mode;
+        bool slave_mode;
+        /* GPIO for /RST */
+        struct gpio_desc *reset_gpio;
+        struct completion pdn_done;
+};
+
+static const char * const cs35l35_supplies[] = {
+        "VA",
+        "VP",
+};
+
+#endif
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 8c0f3b89b5bc..e78b5f055f25 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -498,7 +498,7 @@ static int cs4271_reset(struct snd_soc_codec *codec)
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
         if (gpio_is_valid(cs4271->gpio_nreset)) {
-                gpio_set_value(cs4271->gpio_nreset, 0);
+                gpio_direction_output(cs4271->gpio_nreset, 0);
                 mdelay(1);
                 gpio_set_value(cs4271->gpio_nreset, 1);
                 mdelay(1);
diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
index cb47fb595ff4..1e0d5973b758 100644
--- a/sound/soc/codecs/cs53l30.c
+++ b/sound/soc/codecs/cs53l30.c
@@ -1130,6 +1130,7 @@ MODULE_DEVICE_TABLE(i2c, cs53l30_id);
 static struct i2c_driver cs53l30_i2c_driver = {
         .driver = {
                 .name = "cs53l30",
+                .of_match_table = cs53l30_of_match,
                 .pm = &cs53l30_runtime_pm,
         },
         .id_table = cs53l30_id,
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 12da55882c06..6dd7578f0bb8 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -12,6 +12,7 @@
  * option) any later version.
  */
 
+#include <linux/acpi.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
@@ -1528,12 +1529,23 @@ static int da7213_set_bias_level(struct snd_soc_codec *codec,
         return 0;
 }
 
+#if defined(CONFIG_OF)
 /* DT */
 static const struct of_device_id da7213_of_match[] = {
         { .compatible = "dlg,da7213", },
         { }
 };
 MODULE_DEVICE_TABLE(of, da7213_of_match);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id da7213_acpi_match[] = {
+        { "DLGS7212", 0},
+        { "DLGS7213", 0},
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, da7213_acpi_match);
+#endif
 
 static enum da7213_micbias_voltage
         da7213_of_micbias_lvl(struct snd_soc_codec *codec, u32 val)
@@ -1844,6 +1856,7 @@ static struct i2c_driver da7213_i2c_driver = {
         .driver = {
                 .name = "da7213",
                 .of_match_table = of_match_ptr(da7213_of_match),
+                .acpi_match_table = ACPI_PTR(da7213_acpi_match),
         },
         .probe          = da7213_i2c_probe,
         .remove         = da7213_remove,
diff --git a/sound/soc/codecs/dio2125.c b/sound/soc/codecs/dio2125.c
new file mode 100644
index 000000000000..09451cd44f9b
--- /dev/null
+++ b/sound/soc/codecs/dio2125.c
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2017 BayLibre, SAS.
+ * Author: Jerome Brunet <jbrunet@baylibre.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/module.h>
+#include <sound/soc.h>
+
+#define DRV_NAME "dio2125"
+
+struct dio2125 {
+        struct gpio_desc *gpiod_enable;
+};
+
+static int drv_event(struct snd_soc_dapm_widget *w,
+                     struct snd_kcontrol *control, int event)
+{
+        struct snd_soc_component *c = snd_soc_dapm_to_component(w->dapm);
+        struct dio2125 *priv = snd_soc_component_get_drvdata(c);
+        int val;
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                val = 1;
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                val = 0;
+                break;
+        default:
+                WARN(1, "Unexpected event");
+                return -EINVAL;
+        }
+
+        gpiod_set_value_cansleep(priv->gpiod_enable, val);
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget dio2125_dapm_widgets[] = {
+        SND_SOC_DAPM_INPUT("INL"),
+        SND_SOC_DAPM_INPUT("INR"),
+        SND_SOC_DAPM_OUT_DRV_E("DRV", SND_SOC_NOPM, 0, 0, NULL, 0, drv_event,
+                               (SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD)),
+        SND_SOC_DAPM_OUTPUT("OUTL"),
+        SND_SOC_DAPM_OUTPUT("OUTR"),
+};
+
+static const struct snd_soc_dapm_route dio2125_dapm_routes[] = {
+        { "DRV", NULL, "INL" },
+        { "DRV", NULL, "INR" },
+        { "OUTL", NULL, "DRV" },
+        { "OUTR", NULL, "DRV" },
+};
+
+static const struct snd_soc_component_driver dio2125_component_driver = {
+        .dapm_widgets           = dio2125_dapm_widgets,
+        .num_dapm_widgets       = ARRAY_SIZE(dio2125_dapm_widgets),
+        .dapm_routes            = dio2125_dapm_routes,
+        .num_dapm_routes        = ARRAY_SIZE(dio2125_dapm_routes),
+};
+
+static int dio2125_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct dio2125 *priv;
+        int err;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (priv == NULL)
+                return -ENOMEM;
+        platform_set_drvdata(pdev, priv);
+
+        priv->gpiod_enable = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
+        if (IS_ERR(priv->gpiod_enable)) {
+                err = PTR_ERR(priv->gpiod_enable);
+                if (err != -EPROBE_DEFER)
+                        dev_err(dev, "Failed to get 'enable' gpio: %d", err);
+                return err;
+        }
+
+        return devm_snd_soc_register_component(dev, &dio2125_component_driver,
+                                               NULL, 0);
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id dio2125_ids[] = {
+        { .compatible = "dioo,dio2125", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, dio2125_ids);
+#endif
+
+static struct platform_driver dio2125_driver = {
+        .driver = {
+                .name = DRV_NAME,
+                .of_match_table = of_match_ptr(dio2125_ids),
+        },
+        .probe = dio2125_probe,
+};
+
+module_platform_driver(dio2125_driver);
+
+MODULE_DESCRIPTION("ASoC DIO2125 output driver");
+MODULE_AUTHOR("Jerome Brunet <jbrunet@baylibre.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/es7134.c b/sound/soc/codecs/es7134.c
new file mode 100644
index 000000000000..25ede825d349
--- /dev/null
+++ b/sound/soc/codecs/es7134.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2017 BayLibre, SAS.
+ * Author: Jerome Brunet <jbrunet@baylibre.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ */
+
+#include <linux/module.h>
+#include <sound/soc.h>
+
+/*
+ * The everest 7134 is a very simple DA converter with no register
+ */
+
+static int es7134_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        fmt &= (SND_SOC_DAIFMT_FORMAT_MASK | SND_SOC_DAIFMT_INV_MASK |
+                SND_SOC_DAIFMT_MASTER_MASK);
+
+        if (fmt != (SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                    SND_SOC_DAIFMT_CBS_CFS)) {
+                dev_err(codec_dai->dev, "Invalid DAI format\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_dai_ops es7134_dai_ops = {
+        .set_fmt        = es7134_set_fmt,
+};
+
+static struct snd_soc_dai_driver es7134_dai = {
+        .name = "es7134-hifi",
+        .playback = {
+                .stream_name = "Playback",
+                .channels_min = 2,
+                .channels_max = 2,
+                .rates = SNDRV_PCM_RATE_8000_192000,
+                .formats = (SNDRV_PCM_FMTBIT_S16_LE  |
+                            SNDRV_PCM_FMTBIT_S18_3LE |
+                            SNDRV_PCM_FMTBIT_S20_3LE |
+                            SNDRV_PCM_FMTBIT_S24_3LE |
+                            SNDRV_PCM_FMTBIT_S24_LE),
+        },
+        .ops = &es7134_dai_ops,
+};
+
+static const struct snd_soc_dapm_widget es7134_dapm_widgets[] = {
+        SND_SOC_DAPM_OUTPUT("AOUTL"),
+        SND_SOC_DAPM_OUTPUT("AOUTR"),
+        SND_SOC_DAPM_DAC("DAC", "Playback", SND_SOC_NOPM, 0, 0),
+};
+
+static const struct snd_soc_dapm_route es7134_dapm_routes[] = {
+        { "AOUTL", NULL, "DAC" },
+        { "AOUTR", NULL, "DAC" },
+};
+
+static struct snd_soc_codec_driver es7134_codec_driver = {
+        .component_driver = {
+                .dapm_widgets           = es7134_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(es7134_dapm_widgets),
+                .dapm_routes            = es7134_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(es7134_dapm_routes),
+        },
+};
+
+static int es7134_probe(struct platform_device *pdev)
+{
+        return snd_soc_register_codec(&pdev->dev,
+                                      &es7134_codec_driver,
+                                      &es7134_dai, 1);
+}
+
+static int es7134_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_codec(&pdev->dev);
+        return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id es7134_ids[] = {
+        { .compatible = "everest,es7134", },
+        { .compatible = "everest,es7144", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, es7134_ids);
+#endif
+
+static struct platform_driver es7134_driver = {
+        .driver = {
+                .name = "es7134",
+                .of_match_table = of_match_ptr(es7134_ids),
+        },
+        .probe = es7134_probe,
+        .remove = es7134_remove,
+};
+
+module_platform_driver(es7134_driver);
+
+MODULE_DESCRIPTION("ASoC ES7134 audio codec driver");
+MODULE_AUTHOR("Jerome Brunet <jbrunet@baylibre.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index 3f84fbd071e2..ed7cc42d1ee2 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -69,14 +69,10 @@ static const char * const supply_names[ES8328_SUPPLY_NUM] = {
         "HPVDD",
 };
 
-#define ES8328_RATES (SNDRV_PCM_RATE_96000 | \
-                SNDRV_PCM_RATE_48000 | \
-                SNDRV_PCM_RATE_44100 | \
-                SNDRV_PCM_RATE_32000 | \
-                SNDRV_PCM_RATE_22050 | \
-                SNDRV_PCM_RATE_16000 | \
-                SNDRV_PCM_RATE_11025 | \
-                SNDRV_PCM_RATE_8000)
+#define ES8328_RATES (SNDRV_PCM_RATE_192000 | \
+                SNDRV_PCM_RATE_96000 | \
+                SNDRV_PCM_RATE_88200 | \
+                SNDRV_PCM_RATE_8000_48000)
 #define ES8328_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
                 SNDRV_PCM_FMTBIT_S18_3LE | \
                 SNDRV_PCM_FMTBIT_S20_3LE | \
@@ -91,6 +87,7 @@ struct es8328_priv {
         int mclkdiv2;
         const struct snd_pcm_hw_constraint_list *sysclk_constraints;
         const int *mclk_ratios;
+        bool master;
         struct regulator_bulk_data supplies[ES8328_SUPPLY_NUM];
 };
 
@@ -469,7 +466,7 @@ static int es8328_startup(struct snd_pcm_substream *substream,
         struct snd_soc_codec *codec = dai->codec;
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
 
-        if (es8328->sysclk_constraints)
+        if (es8328->master && es8328->sysclk_constraints)
                 snd_pcm_hw_constraint_list(substream->runtime, 0,
                                 SNDRV_PCM_HW_PARAM_RATE,
                                 es8328->sysclk_constraints);
@@ -488,27 +485,34 @@ static int es8328_hw_params(struct snd_pcm_substream *substream,
         int wl;
         int ratio;
 
-        if (!es8328->sysclk_constraints) {
-                dev_err(codec->dev, "No MCLK configured\n");
-                return -EINVAL;
-        }
-
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 reg = ES8328_DACCONTROL2;
         else
                 reg = ES8328_ADCCONTROL5;
 
-        for (i = 0; i < es8328->sysclk_constraints->count; i++)
-                if (es8328->sysclk_constraints->list[i] == params_rate(params))
-                        break;
+        if (es8328->master) {
+                if (!es8328->sysclk_constraints) {
+                        dev_err(codec->dev, "No MCLK configured\n");
+                        return -EINVAL;
+                }
 
-        if (i == es8328->sysclk_constraints->count) {
-                dev_err(codec->dev, "LRCLK %d unsupported with current clock\n",
-                        params_rate(params));
-                return -EINVAL;
+                for (i = 0; i < es8328->sysclk_constraints->count; i++)
+                        if (es8328->sysclk_constraints->list[i] ==
+                            params_rate(params))
+                                break;
+
+                if (i == es8328->sysclk_constraints->count) {
+                        dev_err(codec->dev,
+                                "LRCLK %d unsupported with current clock\n",
+                                params_rate(params));
+                        return -EINVAL;
+                }
+                ratio = es8328->mclk_ratios[i];
+        } else {
+                ratio = 0;
+                es8328->mclkdiv2 = 0;
         }
 
-        ratio = es8328->mclk_ratios[i];
         snd_soc_update_bits(codec, ES8328_MASTERMODE,
                         ES8328_MASTERMODE_MCLKDIV2,
                         es8328->mclkdiv2 ? ES8328_MASTERMODE_MCLKDIV2 : 0);
@@ -586,6 +590,7 @@ static int es8328_set_dai_fmt(struct snd_soc_dai *codec_dai,
                 unsigned int fmt)
 {
         struct snd_soc_codec *codec = codec_dai->codec;
+        struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
         u8 dac_mode = 0;
         u8 adc_mode = 0;
 
@@ -595,11 +600,13 @@ static int es8328_set_dai_fmt(struct snd_soc_dai *codec_dai,
                 snd_soc_update_bits(codec, ES8328_MASTERMODE,
                                     ES8328_MASTERMODE_MSC,
                                     ES8328_MASTERMODE_MSC);
+                es8328->master = true;
                 break;
         case SND_SOC_DAIFMT_CBS_CFS:
                 /* Slave serial port mode */
                 snd_soc_update_bits(codec, ES8328_MASTERMODE,
                                     ES8328_MASTERMODE_MSC, 0);
+                es8328->master = false;
                 break;
         default:
                 return -EINVAL;
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index fd272a40485b..bc2e74ff3b2d 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -469,7 +469,7 @@ static int hdac_hdmi_set_hw_params(struct snd_pcm_substream *substream,
 
         format = snd_hdac_calc_stream_format(params_rate(hparams),
                         params_channels(hparams), params_format(hparams),
-                        24, 0);
+                        dai->driver->playback.sig_bits, 0);
 
         pcm = hdac_hdmi_get_pcm_from_cvt(hdmi, dai_map->cvt);
         if (!pcm)
@@ -1419,8 +1419,8 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdac,
                 hdmi_dais[i].playback.rate_min = rate_min;
                 hdmi_dais[i].playback.channels_min = 2;
                 hdmi_dais[i].playback.channels_max = 2;
+                hdmi_dais[i].playback.sig_bits = bps;
                 hdmi_dais[i].ops = &hdmi_dai_ops;
-
                 i++;
         }
 
diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
index 6cdf15ab46de..0247edc9c84e 100644
--- a/sound/soc/codecs/max9867.c
+++ b/sound/soc/codecs/max9867.c
@@ -516,13 +516,13 @@ static const struct i2c_device_id max9867_i2c_id[] = {
         { "max9867", 0 },
         { }
 };
+MODULE_DEVICE_TABLE(i2c, max9867_i2c_id);
 
 static const struct of_device_id max9867_of_match[] = {
         { .compatible = "maxim,max9867", },
         { }
 };
-
-MODULE_DEVICE_TABLE(i2c, max9867_i2c_id);
+MODULE_DEVICE_TABLE(of, max9867_of_match);
 
 static const struct dev_pm_ops max9867_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(max9867_suspend, max9867_resume)
diff --git a/sound/soc/codecs/max98927.c b/sound/soc/codecs/max98927.c
new file mode 100644
index 000000000000..b5ee29499e16
--- /dev/null
+++ b/sound/soc/codecs/max98927.c
@@ -0,0 +1,841 @@
+/*
+ * max98927.c  --  MAX98927 ALSA Soc Audio driver
+ *
+ * Copyright (C) 2016 Maxim Integrated Products
+ * Author: Ryan Lee <ryans.lee@maximintegrated.com>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ */
+
+#include <linux/acpi.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <sound/tlv.h>
+#include "max98927.h"
+
+static struct reg_default max98927_reg[] = {
+        {MAX98927_R0001_INT_RAW1,  0x00},
+        {MAX98927_R0002_INT_RAW2,  0x00},
+        {MAX98927_R0003_INT_RAW3,  0x00},
+        {MAX98927_R0004_INT_STATE1,  0x00},
+        {MAX98927_R0005_INT_STATE2,  0x00},
+        {MAX98927_R0006_INT_STATE3,  0x00},
+        {MAX98927_R0007_INT_FLAG1,  0x00},
+        {MAX98927_R0008_INT_FLAG2,  0x00},
+        {MAX98927_R0009_INT_FLAG3,  0x00},
+        {MAX98927_R000A_INT_EN1,  0x00},
+        {MAX98927_R000B_INT_EN2,  0x00},
+        {MAX98927_R000C_INT_EN3,  0x00},
+        {MAX98927_R000D_INT_FLAG_CLR1,  0x00},
+        {MAX98927_R000E_INT_FLAG_CLR2,  0x00},
+        {MAX98927_R000F_INT_FLAG_CLR3,  0x00},
+        {MAX98927_R0010_IRQ_CTRL,  0x00},
+        {MAX98927_R0011_CLK_MON,  0x00},
+        {MAX98927_R0012_WDOG_CTRL,  0x00},
+        {MAX98927_R0013_WDOG_RST,  0x00},
+        {MAX98927_R0014_MEAS_ADC_THERM_WARN_THRESH,  0x00},
+        {MAX98927_R0015_MEAS_ADC_THERM_SHDN_THRESH,  0x00},
+        {MAX98927_R0016_MEAS_ADC_THERM_HYSTERESIS,  0x00},
+        {MAX98927_R0017_PIN_CFG,  0x55},
+        {MAX98927_R0018_PCM_RX_EN_A,  0x00},
+        {MAX98927_R0019_PCM_RX_EN_B,  0x00},
+        {MAX98927_R001A_PCM_TX_EN_A,  0x00},
+        {MAX98927_R001B_PCM_TX_EN_B,  0x00},
+        {MAX98927_R001C_PCM_TX_HIZ_CTRL_A,  0x00},
+        {MAX98927_R001D_PCM_TX_HIZ_CTRL_B,  0x00},
+        {MAX98927_R001E_PCM_TX_CH_SRC_A,  0x00},
+        {MAX98927_R001F_PCM_TX_CH_SRC_B,  0x00},
+        {MAX98927_R0020_PCM_MODE_CFG,  0x40},
+        {MAX98927_R0021_PCM_MASTER_MODE,  0x00},
+        {MAX98927_R0022_PCM_CLK_SETUP,  0x22},
+        {MAX98927_R0023_PCM_SR_SETUP1,  0x00},
+        {MAX98927_R0024_PCM_SR_SETUP2,  0x00},
+        {MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,  0x00},
+        {MAX98927_R0026_PCM_TO_SPK_MONOMIX_B,  0x00},
+        {MAX98927_R0027_ICC_RX_EN_A,  0x00},
+        {MAX98927_R0028_ICC_RX_EN_B,  0x00},
+        {MAX98927_R002B_ICC_TX_EN_A,  0x00},
+        {MAX98927_R002C_ICC_TX_EN_B,  0x00},
+        {MAX98927_R002E_ICC_HIZ_MANUAL_MODE,  0x00},
+        {MAX98927_R002F_ICC_TX_HIZ_EN_A,  0x00},
+        {MAX98927_R0030_ICC_TX_HIZ_EN_B,  0x00},
+        {MAX98927_R0031_ICC_LNK_EN,  0x00},
+        {MAX98927_R0032_PDM_TX_EN,  0x00},
+        {MAX98927_R0033_PDM_TX_HIZ_CTRL,  0x00},
+        {MAX98927_R0034_PDM_TX_CTRL,  0x00},
+        {MAX98927_R0035_PDM_RX_CTRL,  0x00},
+        {MAX98927_R0036_AMP_VOL_CTRL,  0x00},
+        {MAX98927_R0037_AMP_DSP_CFG,  0x02},
+        {MAX98927_R0038_TONE_GEN_DC_CFG,  0x00},
+        {MAX98927_R0039_DRE_CTRL,  0x01},
+        {MAX98927_R003A_AMP_EN,  0x00},
+        {MAX98927_R003B_SPK_SRC_SEL,  0x00},
+        {MAX98927_R003C_SPK_GAIN,  0x00},
+        {MAX98927_R003D_SSM_CFG,  0x01},
+        {MAX98927_R003E_MEAS_EN,  0x00},
+        {MAX98927_R003F_MEAS_DSP_CFG,  0x04},
+        {MAX98927_R0040_BOOST_CTRL0,  0x00},
+        {MAX98927_R0041_BOOST_CTRL3,  0x00},
+        {MAX98927_R0042_BOOST_CTRL1,  0x00},
+        {MAX98927_R0043_MEAS_ADC_CFG,  0x00},
+        {MAX98927_R0044_MEAS_ADC_BASE_MSB,  0x00},
+        {MAX98927_R0045_MEAS_ADC_BASE_LSB,  0x00},
+        {MAX98927_R0046_ADC_CH0_DIVIDE,  0x00},
+        {MAX98927_R0047_ADC_CH1_DIVIDE,  0x00},
+        {MAX98927_R0048_ADC_CH2_DIVIDE,  0x00},
+        {MAX98927_R0049_ADC_CH0_FILT_CFG,  0x00},
+        {MAX98927_R004A_ADC_CH1_FILT_CFG,  0x00},
+        {MAX98927_R004B_ADC_CH2_FILT_CFG,  0x00},
+        {MAX98927_R004C_MEAS_ADC_CH0_READ,  0x00},
+        {MAX98927_R004D_MEAS_ADC_CH1_READ,  0x00},
+        {MAX98927_R004E_MEAS_ADC_CH2_READ,  0x00},
+        {MAX98927_R0051_BROWNOUT_STATUS,  0x00},
+        {MAX98927_R0052_BROWNOUT_EN,  0x00},
+        {MAX98927_R0053_BROWNOUT_INFINITE_HOLD,  0x00},
+        {MAX98927_R0054_BROWNOUT_INFINITE_HOLD_CLR,  0x00},
+        {MAX98927_R0055_BROWNOUT_LVL_HOLD,  0x00},
+        {MAX98927_R005A_BROWNOUT_LVL1_THRESH,  0x00},
+        {MAX98927_R005B_BROWNOUT_LVL2_THRESH,  0x00},
+        {MAX98927_R005C_BROWNOUT_LVL3_THRESH,  0x00},
+        {MAX98927_R005D_BROWNOUT_LVL4_THRESH,  0x00},
+        {MAX98927_R005E_BROWNOUT_THRESH_HYSTERYSIS,  0x00},
+        {MAX98927_R005F_BROWNOUT_AMP_LIMITER_ATK_REL,  0x00},
+        {MAX98927_R0060_BROWNOUT_AMP_GAIN_ATK_REL,  0x00},
+        {MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE,  0x00},
+        {MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT,  0x00},
+        {MAX98927_R0073_BROWNOUT_LVL1_AMP1_CTRL1,  0x00},
+        {MAX98927_R0074_BROWNOUT_LVL1_AMP1_CTRL2,  0x00},
+        {MAX98927_R0075_BROWNOUT_LVL1_AMP1_CTRL3,  0x00},
+        {MAX98927_R0076_BROWNOUT_LVL2_CUR_LIMIT,  0x00},
+        {MAX98927_R0077_BROWNOUT_LVL2_AMP1_CTRL1,  0x00},
+        {MAX98927_R0078_BROWNOUT_LVL2_AMP1_CTRL2,  0x00},
+        {MAX98927_R0079_BROWNOUT_LVL2_AMP1_CTRL3,  0x00},
+        {MAX98927_R007A_BROWNOUT_LVL3_CUR_LIMIT,  0x00},
+        {MAX98927_R007B_BROWNOUT_LVL3_AMP1_CTRL1,  0x00},
+        {MAX98927_R007C_BROWNOUT_LVL3_AMP1_CTRL2,  0x00},
+        {MAX98927_R007D_BROWNOUT_LVL3_AMP1_CTRL3,  0x00},
+        {MAX98927_R007E_BROWNOUT_LVL4_CUR_LIMIT,  0x00},
+        {MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1,  0x00},
+        {MAX98927_R0080_BROWNOUT_LVL4_AMP1_CTRL2,  0x00},
+        {MAX98927_R0081_BROWNOUT_LVL4_AMP1_CTRL3,  0x00},
+        {MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM,  0x00},
+        {MAX98927_R0083_ENV_TRACK_BOOST_VOUT_DELAY,  0x00},
+        {MAX98927_R0084_ENV_TRACK_REL_RATE,  0x00},
+        {MAX98927_R0085_ENV_TRACK_HOLD_RATE,  0x00},
+        {MAX98927_R0086_ENV_TRACK_CTRL,  0x00},
+        {MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ,  0x00},
+        {MAX98927_R00FF_GLOBAL_SHDN,  0x00},
+        {MAX98927_R0100_SOFT_RESET,  0x00},
+        {MAX98927_R01FF_REV_ID,  0x40},
+};
+
+static int max98927_dai_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+        unsigned int mode = 0;
+        unsigned int format = 0;
+        unsigned int invert = 0;
+
+        dev_dbg(codec->dev, "%s: fmt 0x%08X\n", __func__, fmt);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBS_CFS:
+                mode = MAX98927_PCM_MASTER_MODE_SLAVE;
+                break;
+        case SND_SOC_DAIFMT_CBM_CFM:
+                max98927->master = true;
+                mode = MAX98927_PCM_MASTER_MODE_MASTER;
+                break;
+        default:
+                dev_err(codec->dev, "DAI clock mode unsupported");
+                return -EINVAL;
+        }
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0021_PCM_MASTER_MODE,
+                MAX98927_PCM_MASTER_MODE_MASK,
+                mode);
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                invert = MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE;
+                break;
+        default:
+                dev_err(codec->dev, "DAI invert mode unsupported");
+                return -EINVAL;
+        }
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0020_PCM_MODE_CFG,
+                MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE,
+                invert);
+
+        /* interface format */
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                max98927->iface |= SND_SOC_DAIFMT_I2S;
+                format = MAX98927_PCM_FORMAT_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                max98927->iface |= SND_SOC_DAIFMT_LEFT_J;
+                format = MAX98927_PCM_FORMAT_LJ;
+                break;
+        case SND_SOC_DAIFMT_PDM:
+                max98927->iface |= SND_SOC_DAIFMT_PDM;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* pcm channel configuration */
+        if (max98927->iface & (SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_LEFT_J)) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0018_PCM_RX_EN_A,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0020_PCM_MODE_CFG,
+                        MAX98927_PCM_MODE_CFG_FORMAT_MASK,
+                        format << MAX98927_PCM_MODE_CFG_FORMAT_SHIFT);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003B_SPK_SRC_SEL,
+                        MAX98927_SPK_SRC_MASK, 0);
+
+        } else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0018_PCM_RX_EN_A,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN, 0);
+
+        /* pdm channel configuration */
+        if (max98927->iface & SND_SOC_DAIFMT_PDM) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0035_PDM_RX_CTRL,
+                        MAX98927_PDM_RX_EN_MASK, 1);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003B_SPK_SRC_SEL,
+                        MAX98927_SPK_SRC_MASK, 3);
+        } else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0035_PDM_RX_CTRL,
+                        MAX98927_PDM_RX_EN_MASK, 0);
+        return 0;
+}
+
+/* codec MCLK rate in master mode */
+static const int rate_table[] = {
+        5644800, 6000000, 6144000, 6500000,
+        9600000, 11289600, 12000000, 12288000,
+        13000000, 19200000,
+};
+
+static int max98927_set_clock(struct max98927_priv *max98927,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_codec *codec = max98927->codec;
+        /* BCLK/LRCLK ratio calculation */
+        int blr_clk_ratio = params_channels(params) * max98927->ch_size;
+        int value;
+
+        if (max98927->master) {
+                int i;
+                /* match rate to closest value */
+                for (i = 0; i < ARRAY_SIZE(rate_table); i++) {
+                        if (rate_table[i] >= max98927->sysclk)
+                                break;
+                }
+                if (i == ARRAY_SIZE(rate_table)) {
+                        dev_err(codec->dev, "failed to find proper clock rate.\n");
+                        return -EINVAL;
+                }
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0021_PCM_MASTER_MODE,
+                        MAX98927_PCM_MASTER_MODE_MCLK_MASK,
+                        i << MAX98927_PCM_MASTER_MODE_MCLK_RATE_SHIFT);
+        }
+
+        switch (blr_clk_ratio) {
+        case 32:
+                value = 2;
+                break;
+        case 48:
+                value = 3;
+                break;
+        case 64:
+                value = 4;
+                break;
+        default:
+                return -EINVAL;
+        }
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0022_PCM_CLK_SETUP,
+                MAX98927_PCM_CLK_SETUP_BSEL_MASK,
+                value);
+        return 0;
+}
+
+static int max98927_dai_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params,
+        struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+        unsigned int sampling_rate = 0;
+        unsigned int chan_sz = 0;
+
+        /* pcm mode configuration */
+        switch (snd_pcm_format_width(params_format(params))) {
+        case 16:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_16;
+                break;
+        case 24:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_24;
+                break;
+        case 32:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_32;
+                break;
+        default:
+                dev_err(codec->dev, "format unsupported %d",
+                        params_format(params));
+                goto err;
+        }
+
+        max98927->ch_size = snd_pcm_format_width(params_format(params));
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0020_PCM_MODE_CFG,
+                MAX98927_PCM_MODE_CFG_CHANSZ_MASK, chan_sz);
+
+        dev_dbg(codec->dev, "format supported %d",
+                params_format(params));
+
+        /* sampling rate configuration */
+        switch (params_rate(params)) {
+        case 8000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_8000;
+                break;
+        case 11025:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_11025;
+                break;
+        case 12000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_12000;
+                break;
+        case 16000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_16000;
+                break;
+        case 22050:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_22050;
+                break;
+        case 24000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_24000;
+                break;
+        case 32000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_32000;
+                break;
+        case 44100:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_44100;
+                break;
+        case 48000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_48000;
+                break;
+        default:
+                dev_err(codec->dev, "rate %d not supported\n",
+                        params_rate(params));
+                goto err;
+        }
+        /* set DAI_SR to correct LRCLK frequency */
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0023_PCM_SR_SETUP1,
+                MAX98927_PCM_SR_SET1_SR_MASK,
+                sampling_rate);
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0024_PCM_SR_SETUP2,
+                MAX98927_PCM_SR_SET2_SR_MASK,
+                sampling_rate << MAX98927_PCM_SR_SET2_SR_SHIFT);
+
+        /* set sampling rate of IV */
+        if (max98927->interleave_mode &&
+            sampling_rate > MAX98927_PCM_SR_SET1_SR_16000)
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0024_PCM_SR_SETUP2,
+                        MAX98927_PCM_SR_SET2_IVADC_SR_MASK,
+                        sampling_rate - 3);
+        else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0024_PCM_SR_SETUP2,
+                        MAX98927_PCM_SR_SET2_IVADC_SR_MASK,
+                        sampling_rate);
+        return max98927_set_clock(max98927, params);
+err:
+        return -EINVAL;
+}
+
+#define MAX98927_RATES SNDRV_PCM_RATE_8000_48000
+
+#define MAX98927_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
+        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+static int max98927_dai_set_sysclk(struct snd_soc_dai *dai,
+        int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        max98927->sysclk = freq;
+        return 0;
+}
+
+static const struct snd_soc_dai_ops max98927_dai_ops = {
+        .set_sysclk = max98927_dai_set_sysclk,
+        .set_fmt = max98927_dai_set_fmt,
+        .hw_params = max98927_dai_hw_params,
+};
+
+static int max98927_dac_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003A_AMP_EN,
+                        MAX98927_AMP_EN_MASK, 1);
+                /* enable VMON and IMON */
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003E_MEAS_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R00FF_GLOBAL_SHDN,
+                        MAX98927_GLOBAL_EN_MASK, 1);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R00FF_GLOBAL_SHDN,
+                        MAX98927_GLOBAL_EN_MASK, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003A_AMP_EN,
+                        MAX98927_AMP_EN_MASK, 0);
+                /* disable VMON and IMON */
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003E_MEAS_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN, 0);
+                break;
+        default:
+                return 0;
+        }
+        return 0;
+}
+
+static const char * const max98927_switch_text[] = {
+        "Left", "Right", "LeftRight"};
+
+static const struct soc_enum dai_sel_enum =
+        SOC_ENUM_SINGLE(MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,
+                MAX98927_PCM_TO_SPK_MONOMIX_CFG_SHIFT,
+                3, max98927_switch_text);
+
+static const struct snd_kcontrol_new max98927_dai_controls =
+        SOC_DAPM_ENUM("DAI Sel", dai_sel_enum);
+
+static const struct snd_soc_dapm_widget max98927_dapm_widgets[] = {
+        SND_SOC_DAPM_AIF_IN("DAI_OUT", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_DAC_E("Amp Enable", "HiFi Playback", MAX98927_R003A_AMP_EN,
+                0, 0, max98927_dac_event,
+                SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_MUX("DAI Sel Mux", SND_SOC_NOPM, 0, 0,
+                &max98927_dai_controls),
+        SND_SOC_DAPM_OUTPUT("BE_OUT"),
+};
+
+static DECLARE_TLV_DB_SCALE(max98927_spk_tlv, 300, 300, 0);
+static DECLARE_TLV_DB_SCALE(max98927_digital_tlv, -1600, 25, 0);
+
+static bool max98927_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case MAX98927_R0001_INT_RAW1 ... MAX98927_R0028_ICC_RX_EN_B:
+        case MAX98927_R002B_ICC_TX_EN_A ... MAX98927_R002C_ICC_TX_EN_B:
+        case MAX98927_R002E_ICC_HIZ_MANUAL_MODE
+                ... MAX98927_R004E_MEAS_ADC_CH2_READ:
+        case MAX98927_R0051_BROWNOUT_STATUS
+                ... MAX98927_R0055_BROWNOUT_LVL_HOLD:
+        case MAX98927_R005A_BROWNOUT_LVL1_THRESH
+                ... MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE:
+        case MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT
+                ... MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ:
+        case MAX98927_R00FF_GLOBAL_SHDN:
+        case MAX98927_R0100_SOFT_RESET:
+        case MAX98927_R01FF_REV_ID:
+                return true;
+        default:
+                return false;
+        }
+};
+
+static bool max98927_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case MAX98927_R0001_INT_RAW1 ... MAX98927_R0009_INT_FLAG3:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const char * const max98927_boost_voltage_text[] = {
+        "6.5V", "6.625V", "6.75V", "6.875V", "7V", "7.125V", "7.25V", "7.375V",
+        "7.5V", "7.625V", "7.75V", "7.875V", "8V", "8.125V", "8.25V", "8.375V",
+        "8.5V", "8.625V", "8.75V", "8.875V", "9V", "9.125V", "9.25V", "9.375V",
+        "9.5V", "9.625V", "9.75V", "9.875V", "10V"
+};
+
+static SOC_ENUM_SINGLE_DECL(max98927_boost_voltage,
+                MAX98927_R0040_BOOST_CTRL0, 0,
+                max98927_boost_voltage_text);
+
+static const char * const max98927_current_limit_text[] = {
+        "1.00A", "1.10A", "1.20A", "1.30A", "1.40A", "1.50A", "1.60A", "1.70A",
+        "1.80A", "1.90A", "2.00A", "2.10A", "2.20A", "2.30A", "2.40A", "2.50A",
+        "2.60A", "2.70A", "2.80A", "2.90A", "3.00A", "3.10A", "3.20A", "3.30A",
+        "3.40A", "3.50A", "3.60A", "3.70A", "3.80A", "3.90A", "4.00A", "4.10A"
+};
+
+static SOC_ENUM_SINGLE_DECL(max98927_current_limit,
+                MAX98927_R0042_BOOST_CTRL1, 1,
+                max98927_current_limit_text);
+
+static const struct snd_kcontrol_new max98927_snd_controls[] = {
+        SOC_SINGLE_TLV("Speaker Volume", MAX98927_R003C_SPK_GAIN,
+                0, 6, 0,
+                max98927_spk_tlv),
+        SOC_SINGLE_TLV("Digital Volume", MAX98927_R0036_AMP_VOL_CTRL,
+                0, (1<<MAX98927_AMP_VOL_WIDTH)-1, 0,
+                max98927_digital_tlv),
+        SOC_SINGLE("Amp DSP Switch", MAX98927_R0052_BROWNOUT_EN,
+                MAX98927_BROWNOUT_DSP_SHIFT, 1, 0),
+        SOC_SINGLE("Ramp Switch", MAX98927_R0037_AMP_DSP_CFG,
+                MAX98927_AMP_DSP_CFG_RMP_SHIFT, 1, 0),
+        SOC_SINGLE("DRE Switch", MAX98927_R0039_DRE_CTRL,
+                MAX98927_DRE_EN_SHIFT, 1, 0),
+        SOC_SINGLE("Volume Location Switch", MAX98927_R0036_AMP_VOL_CTRL,
+                MAX98927_AMP_VOL_SEL_SHIFT, 1, 0),
+        SOC_ENUM("Boost Output Voltage", max98927_boost_voltage),
+        SOC_ENUM("Current Limit", max98927_current_limit),
+};
+
+static const struct snd_soc_dapm_route max98927_audio_map[] = {
+        {"Amp Enable", NULL, "DAI_OUT"},
+        {"DAI Sel Mux", "Left", "Amp Enable"},
+        {"DAI Sel Mux", "Right", "Amp Enable"},
+        {"DAI Sel Mux", "LeftRight", "Amp Enable"},
+        {"BE_OUT", NULL, "DAI Sel Mux"},
+};
+
+static struct snd_soc_dai_driver max98927_dai[] = {
+        {
+                .name = "max98927-aif1",
+                .playback = {
+                        .stream_name = "HiFi Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = MAX98927_RATES,
+                        .formats = MAX98927_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "HiFi Capture",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = MAX98927_RATES,
+                        .formats = MAX98927_FORMATS,
+                },
+                .ops = &max98927_dai_ops,
+        }
+};
+
+static int max98927_probe(struct snd_soc_codec *codec)
+{
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        max98927->codec = codec;
+        codec->control_data = max98927->regmap;
+        codec->cache_bypass = 1;
+
+        /* Software Reset */
+        regmap_write(max98927->regmap,
+                MAX98927_R0100_SOFT_RESET, MAX98927_SOFT_RESET);
+
+        /* IV default slot configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                0xFF);
+        regmap_write(max98927->regmap,
+                MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                0xFF);
+        regmap_write(max98927->regmap,
+                MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,
+                0x80);
+        regmap_write(max98927->regmap,
+                MAX98927_R0026_PCM_TO_SPK_MONOMIX_B,
+                0x1);
+        /* Set inital volume (+13dB) */
+        regmap_write(max98927->regmap,
+                MAX98927_R0036_AMP_VOL_CTRL,
+                0x38);
+        regmap_write(max98927->regmap,
+                MAX98927_R003C_SPK_GAIN,
+                0x05);
+        /* Enable DC blocker */
+        regmap_write(max98927->regmap,
+                MAX98927_R0037_AMP_DSP_CFG,
+                0x03);
+        /* Enable IMON VMON DC blocker */
+        regmap_write(max98927->regmap,
+                MAX98927_R003F_MEAS_DSP_CFG,
+                0xF7);
+        /* Boost Output Voltage & Current limit */
+        regmap_write(max98927->regmap,
+                MAX98927_R0040_BOOST_CTRL0,
+                0x1C);
+        regmap_write(max98927->regmap,
+                MAX98927_R0042_BOOST_CTRL1,
+                0x3E);
+        /* Measurement ADC config */
+        regmap_write(max98927->regmap,
+                MAX98927_R0043_MEAS_ADC_CFG,
+                0x04);
+        regmap_write(max98927->regmap,
+                MAX98927_R0044_MEAS_ADC_BASE_MSB,
+                0x00);
+        regmap_write(max98927->regmap,
+                MAX98927_R0045_MEAS_ADC_BASE_LSB,
+                0x24);
+        /* Brownout Level */
+        regmap_write(max98927->regmap,
+                MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1,
+                0x06);
+        /* Envelope Tracking configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM,
+                0x08);
+        regmap_write(max98927->regmap,
+                MAX98927_R0086_ENV_TRACK_CTRL,
+                0x01);
+        regmap_write(max98927->regmap,
+                MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ,
+                0x10);
+
+        /* voltage, current slot configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R001E_PCM_TX_CH_SRC_A,
+                (max98927->i_l_slot<<MAX98927_PCM_TX_CH_SRC_A_I_SHIFT|
+                max98927->v_l_slot)&0xFF);
+
+        if (max98927->v_l_slot < 8) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                        1 << max98927->v_l_slot, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001A_PCM_TX_EN_A,
+                        1 << max98927->v_l_slot,
+                        1 << max98927->v_l_slot);
+        } else {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                        1 << (max98927->v_l_slot - 8), 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001B_PCM_TX_EN_B,
+                        1 << (max98927->v_l_slot - 8),
+                        1 << (max98927->v_l_slot - 8));
+        }
+
+        if (max98927->i_l_slot < 8) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                        1 << max98927->i_l_slot, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001A_PCM_TX_EN_A,
+                        1 << max98927->i_l_slot,
+                        1 << max98927->i_l_slot);
+        } else {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                        1 << (max98927->i_l_slot - 8), 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001B_PCM_TX_EN_B,
+                        1 << (max98927->i_l_slot - 8),
+                        1 << (max98927->i_l_slot - 8));
+        }
+
+        /* Set interleave mode */
+        if (max98927->interleave_mode)
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001F_PCM_TX_CH_SRC_B,
+                        MAX98927_PCM_TX_CH_INTERLEAVE_MASK,
+                        MAX98927_PCM_TX_CH_INTERLEAVE_MASK);
+        return 0;
+}
+
+static const struct snd_soc_codec_driver soc_codec_dev_max98927 = {
+        .probe = max98927_probe,
+        .component_driver = {
+                .controls = max98927_snd_controls,
+                .num_controls = ARRAY_SIZE(max98927_snd_controls),
+                .dapm_widgets = max98927_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(max98927_dapm_widgets),
+                .dapm_routes = max98927_audio_map,
+                .num_dapm_routes = ARRAY_SIZE(max98927_audio_map),
+        },
+};
+
+static const struct regmap_config max98927_regmap = {
+        .reg_bits         = 16,
+        .val_bits         = 8,
+        .max_register     = MAX98927_R01FF_REV_ID,
+        .reg_defaults     = max98927_reg,
+        .num_reg_defaults = ARRAY_SIZE(max98927_reg),
+        .readable_reg     = max98927_readable_register,
+        .volatile_reg     = max98927_volatile_reg,
+        .cache_type       = REGCACHE_RBTREE,
+};
+
+static void max98927_slot_config(struct i2c_client *i2c,
+        struct max98927_priv *max98927)
+{
+        int value;
+
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "vmon-slot-no", &value))
+                max98927->v_l_slot = value & 0xF;
+        else
+                max98927->v_l_slot = 0;
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "imon-slot-no", &value))
+                max98927->i_l_slot = value & 0xF;
+        else
+                max98927->i_l_slot = 1;
+}
+
+static int max98927_i2c_probe(struct i2c_client *i2c,
+        const struct i2c_device_id *id)
+{
+
+        int ret = 0, value;
+        int reg = 0;
+        struct max98927_priv *max98927 = NULL;
+
+        max98927 = devm_kzalloc(&i2c->dev,
+                sizeof(*max98927), GFP_KERNEL);
+
+        if (!max98927) {
+                ret = -ENOMEM;
+                return ret;
+        }
+        i2c_set_clientdata(i2c, max98927);
+
+        /* update interleave mode info */
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "interleave_mode", &value)) {
+                if (value > 0)
+                        max98927->interleave_mode = 1;
+                else
+                        max98927->interleave_mode = 0;
+        } else
+                max98927->interleave_mode = 0;
+
+        /* regmap initialization */
+        max98927->regmap
+                = devm_regmap_init_i2c(i2c, &max98927_regmap);
+        if (IS_ERR(max98927->regmap)) {
+                ret = PTR_ERR(max98927->regmap);
+                dev_err(&i2c->dev,
+                        "Failed to allocate regmap: %d\n", ret);
+                return ret;
+        }
+
+        /* Check Revision ID */
+        ret = regmap_read(max98927->regmap,
+                MAX98927_R01FF_REV_ID, &reg);
+        if (ret < 0) {
+                dev_err(&i2c->dev,
+                        "Failed to read: 0x%02X\n", MAX98927_R01FF_REV_ID);
+                return ret;
+        }
+        dev_info(&i2c->dev, "MAX98927 revisionID: 0x%02X\n", reg);
+
+        /* voltage/current slot configuration */
+        max98927_slot_config(i2c, max98927);
+
+        /* codec registeration */
+        ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_max98927,
+                max98927_dai, ARRAY_SIZE(max98927_dai));
+        if (ret < 0)
+                dev_err(&i2c->dev, "Failed to register codec: %d\n", ret);
+
+        return ret;
+}
+
+static int max98927_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct i2c_device_id max98927_i2c_id[] = {
+        { "max98927", 0},
+        { },
+};
+
+MODULE_DEVICE_TABLE(i2c, max98927_i2c_id);
+
+#if defined(CONFIG_OF)
+static const struct of_device_id max98927_of_match[] = {
+        { .compatible = "maxim,max98927", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, max98927_of_match);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id max98927_acpi_match[] = {
+        { "MX98927", 0 },
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, max98927_acpi_match);
+#endif
+
+static struct i2c_driver max98927_i2c_driver = {
+        .driver = {
+                .name = "max98927",
+                .of_match_table = of_match_ptr(max98927_of_match),
+                .acpi_match_table = ACPI_PTR(max98927_acpi_match),
+                .pm = NULL,
+        },
+        .probe  = max98927_i2c_probe,
+        .remove = max98927_i2c_remove,
+        .id_table = max98927_i2c_id,
+};
+
+module_i2c_driver(max98927_i2c_driver)
+
+MODULE_DESCRIPTION("ALSA SoC MAX98927 driver");
+MODULE_AUTHOR("Ryan Lee <ryans.lee@maximintegrated.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/max98927.h b/sound/soc/codecs/max98927.h
new file mode 100644
index 000000000000..ece6a608cbe1
--- /dev/null
+++ b/sound/soc/codecs/max98927.h
@@ -0,0 +1,272 @@
+/*
+ * max98927.h  --  MAX98927 ALSA Soc Audio driver
+ *
+ * Copyright 2013-15 Maxim Integrated Products
+ * Author: Ryan Lee <ryans.lee@maximintegrated.com>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+#ifndef _MAX98927_H
+#define _MAX98927_H
+
+/* Register Values */
+#define MAX98927_R0001_INT_RAW1 0x0001
+#define MAX98927_R0002_INT_RAW2 0x0002
+#define MAX98927_R0003_INT_RAW3 0x0003
+#define MAX98927_R0004_INT_STATE1 0x0004
+#define MAX98927_R0005_INT_STATE2 0x0005
+#define MAX98927_R0006_INT_STATE3 0x0006
+#define MAX98927_R0007_INT_FLAG1 0x0007
+#define MAX98927_R0008_INT_FLAG2 0x0008
+#define MAX98927_R0009_INT_FLAG3 0x0009
+#define MAX98927_R000A_INT_EN1 0x000A
+#define MAX98927_R000B_INT_EN2 0x000B
+#define MAX98927_R000C_INT_EN3 0x000C
+#define MAX98927_R000D_INT_FLAG_CLR1    0x000D
+#define MAX98927_R000E_INT_FLAG_CLR2    0x000E
+#define MAX98927_R000F_INT_FLAG_CLR3    0x000F
+#define MAX98927_R0010_IRQ_CTRL 0x0010
+#define MAX98927_R0011_CLK_MON 0x0011
+#define MAX98927_R0012_WDOG_CTRL 0x0012
+#define MAX98927_R0013_WDOG_RST 0x0013
+#define MAX98927_R0014_MEAS_ADC_THERM_WARN_THRESH 0x0014
+#define MAX98927_R0015_MEAS_ADC_THERM_SHDN_THRESH 0x0015
+#define MAX98927_R0016_MEAS_ADC_THERM_HYSTERESIS 0x0016
+#define MAX98927_R0017_PIN_CFG 0x0017
+#define MAX98927_R0018_PCM_RX_EN_A 0x0018
+#define MAX98927_R0019_PCM_RX_EN_B 0x0019
+#define MAX98927_R001A_PCM_TX_EN_A 0x001A
+#define MAX98927_R001B_PCM_TX_EN_B 0x001B
+#define MAX98927_R001C_PCM_TX_HIZ_CTRL_A 0x001C
+#define MAX98927_R001D_PCM_TX_HIZ_CTRL_B 0x001D
+#define MAX98927_R001E_PCM_TX_CH_SRC_A 0x001E
+#define MAX98927_R001F_PCM_TX_CH_SRC_B 0x001F
+#define MAX98927_R0020_PCM_MODE_CFG 0x0020
+#define MAX98927_R0021_PCM_MASTER_MODE 0x0021
+#define MAX98927_R0022_PCM_CLK_SETUP 0x0022
+#define MAX98927_R0023_PCM_SR_SETUP1 0x0023
+#define MAX98927_R0024_PCM_SR_SETUP2    0x0024
+#define MAX98927_R0025_PCM_TO_SPK_MONOMIX_A 0x0025
+#define MAX98927_R0026_PCM_TO_SPK_MONOMIX_B 0x0026
+#define MAX98927_R0027_ICC_RX_EN_A 0x0027
+#define MAX98927_R0028_ICC_RX_EN_B 0x0028
+#define MAX98927_R002B_ICC_TX_EN_A 0x002B
+#define MAX98927_R002C_ICC_TX_EN_B 0x002C
+#define MAX98927_R002E_ICC_HIZ_MANUAL_MODE 0x002E
+#define MAX98927_R002F_ICC_TX_HIZ_EN_A 0x002F
+#define MAX98927_R0030_ICC_TX_HIZ_EN_B 0x0030
+#define MAX98927_R0031_ICC_LNK_EN 0x0031
+#define MAX98927_R0032_PDM_TX_EN 0x0032
+#define MAX98927_R0033_PDM_TX_HIZ_CTRL 0x0033
+#define MAX98927_R0034_PDM_TX_CTRL 0x0034
+#define MAX98927_R0035_PDM_RX_CTRL 0x0035
+#define MAX98927_R0036_AMP_VOL_CTRL 0x0036
+#define MAX98927_R0037_AMP_DSP_CFG 0x0037
+#define MAX98927_R0038_TONE_GEN_DC_CFG 0x0038
+#define MAX98927_R0039_DRE_CTRL 0x0039
+#define MAX98927_R003A_AMP_EN 0x003A
+#define MAX98927_R003B_SPK_SRC_SEL 0x003B
+#define MAX98927_R003C_SPK_GAIN 0x003C
+#define MAX98927_R003D_SSM_CFG 0x003D
+#define MAX98927_R003E_MEAS_EN 0x003E
+#define MAX98927_R003F_MEAS_DSP_CFG 0x003F
+#define MAX98927_R0040_BOOST_CTRL0 0x0040
+#define MAX98927_R0041_BOOST_CTRL3 0x0041
+#define MAX98927_R0042_BOOST_CTRL1 0x0042
+#define MAX98927_R0043_MEAS_ADC_CFG 0x0043
+#define MAX98927_R0044_MEAS_ADC_BASE_MSB 0x0044
+#define MAX98927_R0045_MEAS_ADC_BASE_LSB 0x0045
+#define MAX98927_R0046_ADC_CH0_DIVIDE 0x0046
+#define MAX98927_R0047_ADC_CH1_DIVIDE 0x0047
+#define MAX98927_R0048_ADC_CH2_DIVIDE 0x0048
+#define MAX98927_R0049_ADC_CH0_FILT_CFG 0x0049
+#define MAX98927_R004A_ADC_CH1_FILT_CFG 0x004A
+#define MAX98927_R004B_ADC_CH2_FILT_CFG 0x004B
+#define MAX98927_R004C_MEAS_ADC_CH0_READ 0x004C
+#define MAX98927_R004D_MEAS_ADC_CH1_READ 0x004D
+#define MAX98927_R004E_MEAS_ADC_CH2_READ 0x004E
+#define MAX98927_R0051_BROWNOUT_STATUS 0x0051
+#define MAX98927_R0052_BROWNOUT_EN 0x0052
+#define MAX98927_R0053_BROWNOUT_INFINITE_HOLD 0x0053
+#define MAX98927_R0054_BROWNOUT_INFINITE_HOLD_CLR 0x0054
+#define MAX98927_R0055_BROWNOUT_LVL_HOLD 0x0055
+#define MAX98927_R005A_BROWNOUT_LVL1_THRESH 0x005A
+#define MAX98927_R005B_BROWNOUT_LVL2_THRESH 0x005B
+#define MAX98927_R005C_BROWNOUT_LVL3_THRESH 0x005C
+#define MAX98927_R005D_BROWNOUT_LVL4_THRESH 0x005D
+#define MAX98927_R005E_BROWNOUT_THRESH_HYSTERYSIS 0x005E
+#define MAX98927_R005F_BROWNOUT_AMP_LIMITER_ATK_REL 0x005F
+#define MAX98927_R0060_BROWNOUT_AMP_GAIN_ATK_REL 0x0060
+#define MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE 0x0061
+#define MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT 0x0072
+#define MAX98927_R0073_BROWNOUT_LVL1_AMP1_CTRL1 0x0073
+#define MAX98927_R0074_BROWNOUT_LVL1_AMP1_CTRL2 0x0074
+#define MAX98927_R0075_BROWNOUT_LVL1_AMP1_CTRL3 0x0075
+#define MAX98927_R0076_BROWNOUT_LVL2_CUR_LIMIT 0x0076
+#define MAX98927_R0077_BROWNOUT_LVL2_AMP1_CTRL1 0x0077
+#define MAX98927_R0078_BROWNOUT_LVL2_AMP1_CTRL2 0x0078
+#define MAX98927_R0079_BROWNOUT_LVL2_AMP1_CTRL3 0x0079
+#define MAX98927_R007A_BROWNOUT_LVL3_CUR_LIMIT 0x007A
+#define MAX98927_R007B_BROWNOUT_LVL3_AMP1_CTRL1 0x007B
+#define MAX98927_R007C_BROWNOUT_LVL3_AMP1_CTRL2 0x007C
+#define MAX98927_R007D_BROWNOUT_LVL3_AMP1_CTRL3 0x007D
+#define MAX98927_R007E_BROWNOUT_LVL4_CUR_LIMIT 0x007E
+#define MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1 0x007F
+#define MAX98927_R0080_BROWNOUT_LVL4_AMP1_CTRL2 0x0080
+#define MAX98927_R0081_BROWNOUT_LVL4_AMP1_CTRL3 0x0081
+#define MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM 0x0082
+#define MAX98927_R0083_ENV_TRACK_BOOST_VOUT_DELAY 0x0083
+#define MAX98927_R0084_ENV_TRACK_REL_RATE 0x0084
+#define MAX98927_R0085_ENV_TRACK_HOLD_RATE 0x0085
+#define MAX98927_R0086_ENV_TRACK_CTRL 0x0086
+#define MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ 0x0087
+#define MAX98927_R00FF_GLOBAL_SHDN 0x00FF
+#define MAX98927_R0100_SOFT_RESET 0x0100
+#define MAX98927_R01FF_REV_ID 0x01FF
+
+/* MAX98927_R0018_PCM_RX_EN_A */
+#define MAX98927_PCM_RX_CH0_EN (0x1 << 0)
+#define MAX98927_PCM_RX_CH1_EN (0x1 << 1)
+#define MAX98927_PCM_RX_CH2_EN (0x1 << 2)
+#define MAX98927_PCM_RX_CH3_EN (0x1 << 3)
+#define MAX98927_PCM_RX_CH4_EN (0x1 << 4)
+#define MAX98927_PCM_RX_CH5_EN (0x1 << 5)
+#define MAX98927_PCM_RX_CH6_EN (0x1 << 6)
+#define MAX98927_PCM_RX_CH7_EN (0x1 << 7)
+
+/* MAX98927_R001A_PCM_TX_EN_A */
+#define MAX98927_PCM_TX_CH0_EN (0x1 << 0)
+#define MAX98927_PCM_TX_CH1_EN (0x1 << 1)
+#define MAX98927_PCM_TX_CH2_EN (0x1 << 2)
+#define MAX98927_PCM_TX_CH3_EN (0x1 << 3)
+#define MAX98927_PCM_TX_CH4_EN (0x1 << 4)
+#define MAX98927_PCM_TX_CH5_EN (0x1 << 5)
+#define MAX98927_PCM_TX_CH6_EN (0x1 << 6)
+#define MAX98927_PCM_TX_CH7_EN (0x1 << 7)
+
+/* MAX98927_R001E_PCM_TX_CH_SRC_A */
+#define MAX98927_PCM_TX_CH_SRC_A_V_SHIFT (0)
+#define MAX98927_PCM_TX_CH_SRC_A_I_SHIFT (4)
+
+/* MAX98927_R001F_PCM_TX_CH_SRC_B */
+#define MAX98927_PCM_TX_CH_INTERLEAVE_MASK (0x1 << 5)
+
+/* MAX98927_R0020_PCM_MODE_CFG */
+#define MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE (0x1 << 2)
+#define MAX98927_PCM_MODE_CFG_FORMAT_MASK (0x7 << 3)
+#define MAX98927_PCM_MODE_CFG_FORMAT_SHIFT (3)
+#define MAX98927_PCM_FORMAT_I2S (0x0 << 0)
+#define MAX98927_PCM_FORMAT_LJ (0x1 << 0)
+
+#define MAX98927_PCM_MODE_CFG_CHANSZ_MASK (0x3 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_16 (0x1 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_24 (0x2 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_32 (0x3 << 6)
+
+/* MAX98927_R0021_PCM_MASTER_MODE */
+#define MAX98927_PCM_MASTER_MODE_MASK (0x3 << 0)
+#define MAX98927_PCM_MASTER_MODE_SLAVE (0x0 << 0)
+#define MAX98927_PCM_MASTER_MODE_MASTER (0x3 << 0)
+
+#define MAX98927_PCM_MASTER_MODE_MCLK_MASK (0xF << 2)
+#define MAX98927_PCM_MASTER_MODE_MCLK_RATE_SHIFT (2)
+
+/* MAX98927_R0022_PCM_CLK_SETUP */
+#define MAX98927_PCM_CLK_SETUP_BSEL_MASK (0xF << 0)
+
+/* MAX98927_R0023_PCM_SR_SETUP1 */
+#define MAX98927_PCM_SR_SET1_SR_MASK (0xF << 0)
+
+#define MAX98927_PCM_SR_SET1_SR_8000 (0x0 << 0)
+#define MAX98927_PCM_SR_SET1_SR_11025 (0x1 << 0)
+#define MAX98927_PCM_SR_SET1_SR_12000 (0x2 << 0)
+#define MAX98927_PCM_SR_SET1_SR_16000 (0x3 << 0)
+#define MAX98927_PCM_SR_SET1_SR_22050 (0x4 << 0)
+#define MAX98927_PCM_SR_SET1_SR_24000 (0x5 << 0)
+#define MAX98927_PCM_SR_SET1_SR_32000 (0x6 << 0)
+#define MAX98927_PCM_SR_SET1_SR_44100 (0x7 << 0)
+#define MAX98927_PCM_SR_SET1_SR_48000 (0x8 << 0)
+
+/* MAX98927_R0024_PCM_SR_SETUP2 */
+#define MAX98927_PCM_SR_SET2_SR_MASK (0xF << 4)
+#define MAX98927_PCM_SR_SET2_SR_SHIFT (4)
+#define MAX98927_PCM_SR_SET2_IVADC_SR_MASK (0xf << 0)
+
+/* MAX98927_R0025_PCM_TO_SPK_MONOMIX_A */
+#define MAX98927_PCM_TO_SPK_MONOMIX_CFG_MASK (0x3 << 6)
+#define MAX98927_PCM_TO_SPK_MONOMIX_CFG_SHIFT (6)
+
+/* MAX98927_R0035_PDM_RX_CTRL */
+#define MAX98927_PDM_RX_EN_MASK (0x1 << 0)
+
+/* MAX98927_R0036_AMP_VOL_CTRL */
+#define MAX98927_AMP_VOL_SEL (0x1 << 7)
+#define MAX98927_AMP_VOL_SEL_WIDTH (1)
+#define MAX98927_AMP_VOL_SEL_SHIFT (7)
+#define MAX98927_AMP_VOL_MASK (0x7f << 0)
+#define MAX98927_AMP_VOL_WIDTH (7)
+#define MAX98927_AMP_VOL_SHIFT (0)
+
+/* MAX98927_R0037_AMP_DSP_CFG */
+#define MAX98927_AMP_DSP_CFG_DCBLK_EN (0x1 << 0)
+#define MAX98927_AMP_DSP_CFG_DITH_EN (0x1 << 1)
+#define MAX98927_AMP_DSP_CFG_RMP_BYPASS (0x1 << 4)
+#define MAX98927_AMP_DSP_CFG_DAC_INV (0x1 << 5)
+#define MAX98927_AMP_DSP_CFG_RMP_SHIFT (4)
+
+/* MAX98927_R0039_DRE_CTRL */
+#define MAX98927_DRE_CTRL_DRE_EN        (0x1 << 0)
+#define MAX98927_DRE_EN_SHIFT 0x1
+
+/* MAX98927_R003A_AMP_EN */
+#define MAX98927_AMP_EN_MASK (0x1 << 0)
+
+/* MAX98927_R003B_SPK_SRC_SEL */
+#define MAX98927_SPK_SRC_MASK (0x3 << 0)
+
+/* MAX98927_R003C_SPK_GAIN */
+#define MAX98927_SPK_PCM_GAIN_MASK (0x7 << 0)
+#define MAX98927_SPK_PDM_GAIN_MASK (0x7 << 4)
+#define MAX98927_SPK_GAIN_WIDTH (3)
+
+/* MAX98927_R003E_MEAS_EN */
+#define MAX98927_MEAS_V_EN (0x1 << 0)
+#define MAX98927_MEAS_I_EN (0x1 << 1)
+
+/* MAX98927_R0040_BOOST_CTRL0 */
+#define MAX98927_BOOST_CTRL0_VOUT_MASK (0x1f << 0)
+#define MAX98927_BOOST_CTRL0_PVDD_MASK (0x1 << 7)
+#define MAX98927_BOOST_CTRL0_PVDD_EN_SHIFT (7)
+
+/* MAX98927_R0052_BROWNOUT_EN */
+#define MAX98927_BROWNOUT_BDE_EN (0x1 << 0)
+#define MAX98927_BROWNOUT_AMP_EN (0x1 << 1)
+#define MAX98927_BROWNOUT_DSP_EN (0x1 << 2)
+#define MAX98927_BROWNOUT_DSP_SHIFT (2)
+
+/* MAX98927_R0100_SOFT_RESET */
+#define MAX98927_SOFT_RESET (0x1 << 0)
+
+/* MAX98927_R00FF_GLOBAL_SHDN */
+#define MAX98927_GLOBAL_EN_MASK (0x1 << 0)
+
+struct max98927_priv {
+        struct regmap *regmap;
+        struct snd_soc_codec *codec;
+        struct max98927_pdata *pdata;
+        unsigned int spk_gain;
+        unsigned int sysclk;
+        unsigned int v_l_slot;
+        unsigned int i_l_slot;
+        bool interleave_mode;
+        unsigned int ch_size;
+        unsigned int rate;
+        unsigned int iface;
+        unsigned int master;
+        unsigned int digital_gain;
+};
+#endif
diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c
index 9e8f0f4aa51a..c8bcb1db966d 100644
--- a/sound/soc/codecs/nau8540.c
+++ b/sound/soc/codecs/nau8540.c
@@ -39,147 +39,147 @@
 
 /* scaling for mclk from sysclk_src output */
 static const struct nau8540_fll_attr mclk_src_scaling[] = {
-       { 1, 0x0 },
-       { 2, 0x2 },
-       { 4, 0x3 },
-       { 8, 0x4 },
-       { 16, 0x5 },
-       { 32, 0x6 },
-       { 3, 0x7 },
-       { 6, 0xa },
-       { 12, 0xb },
-       { 24, 0xc },
+        { 1, 0x0 },
+        { 2, 0x2 },
+        { 4, 0x3 },
+        { 8, 0x4 },
+        { 16, 0x5 },
+        { 32, 0x6 },
+        { 3, 0x7 },
+        { 6, 0xa },
+        { 12, 0xb },
+        { 24, 0xc },
 };
 
 /* ratio for input clk freq */
 static const struct nau8540_fll_attr fll_ratio[] = {
-       { 512000, 0x01 },
-       { 256000, 0x02 },
-       { 128000, 0x04 },
-       { 64000, 0x08 },
-       { 32000, 0x10 },
-       { 8000, 0x20 },
-       { 4000, 0x40 },
+        { 512000, 0x01 },
+        { 256000, 0x02 },
+        { 128000, 0x04 },
+        { 64000, 0x08 },
+        { 32000, 0x10 },
+        { 8000, 0x20 },
+        { 4000, 0x40 },
 };
 
 static const struct nau8540_fll_attr fll_pre_scalar[] = {
-       { 1, 0x0 },
-       { 2, 0x1 },
-       { 4, 0x2 },
-       { 8, 0x3 },
+        { 1, 0x0 },
+        { 2, 0x1 },
+        { 4, 0x2 },
+        { 8, 0x3 },
 };
 
 /* over sampling rate */
 static const struct nau8540_osr_attr osr_adc_sel[] = {
-       { 32, 3 },      /* OSR 32, SRC 1/8 */
-       { 64, 2 },      /* OSR 64, SRC 1/4 */
-       { 128, 1 },     /* OSR 128, SRC 1/2 */
-       { 256, 0 },     /* OSR 256, SRC 1 */
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
 };
 
 static const struct reg_default nau8540_reg_defaults[] = {
-       {NAU8540_REG_POWER_MANAGEMENT, 0x0000},
-       {NAU8540_REG_CLOCK_CTRL, 0x0000},
-       {NAU8540_REG_CLOCK_SRC, 0x0000},
-       {NAU8540_REG_FLL1, 0x0001},
-       {NAU8540_REG_FLL2, 0x3126},
-       {NAU8540_REG_FLL3, 0x0008},
-       {NAU8540_REG_FLL4, 0x0010},
-       {NAU8540_REG_FLL5, 0xC000},
-       {NAU8540_REG_FLL6, 0x6000},
-       {NAU8540_REG_FLL_VCO_RSV, 0xF13C},
-       {NAU8540_REG_PCM_CTRL0, 0x000B},
-       {NAU8540_REG_PCM_CTRL1, 0x3010},
-       {NAU8540_REG_PCM_CTRL2, 0x0800},
-       {NAU8540_REG_PCM_CTRL3, 0x0000},
-       {NAU8540_REG_PCM_CTRL4, 0x000F},
-       {NAU8540_REG_ALC_CONTROL_1, 0x0000},
-       {NAU8540_REG_ALC_CONTROL_2, 0x700B},
-       {NAU8540_REG_ALC_CONTROL_3, 0x0022},
-       {NAU8540_REG_ALC_CONTROL_4, 0x1010},
-       {NAU8540_REG_ALC_CONTROL_5, 0x1010},
-       {NAU8540_REG_NOTCH_FIL1_CH1, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH1, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH2, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH2, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH3, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH3, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH4, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH4, 0x0000},
-       {NAU8540_REG_HPF_FILTER_CH12, 0x0000},
-       {NAU8540_REG_HPF_FILTER_CH34, 0x0000},
-       {NAU8540_REG_ADC_SAMPLE_RATE, 0x0002},
-       {NAU8540_REG_DIGITAL_GAIN_CH1, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH2, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH3, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH4, 0x0400},
-       {NAU8540_REG_DIGITAL_MUX, 0x00E4},
-       {NAU8540_REG_GPIO_CTRL, 0x0000},
-       {NAU8540_REG_MISC_CTRL, 0x0000},
-       {NAU8540_REG_I2C_CTRL, 0xEFFF},
-       {NAU8540_REG_VMID_CTRL, 0x0000},
-       {NAU8540_REG_MUTE, 0x0000},
-       {NAU8540_REG_ANALOG_ADC1, 0x0011},
-       {NAU8540_REG_ANALOG_ADC2, 0x0020},
-       {NAU8540_REG_ANALOG_PWR, 0x0000},
-       {NAU8540_REG_MIC_BIAS, 0x0004},
-       {NAU8540_REG_REFERENCE, 0x0000},
-       {NAU8540_REG_FEPGA1, 0x0000},
-       {NAU8540_REG_FEPGA2, 0x0000},
-       {NAU8540_REG_FEPGA3, 0x0101},
-       {NAU8540_REG_FEPGA4, 0x0101},
-       {NAU8540_REG_PWR, 0x0000},
+        {NAU8540_REG_POWER_MANAGEMENT, 0x0000},
+        {NAU8540_REG_CLOCK_CTRL, 0x0000},
+        {NAU8540_REG_CLOCK_SRC, 0x0000},
+        {NAU8540_REG_FLL1, 0x0001},
+        {NAU8540_REG_FLL2, 0x3126},
+        {NAU8540_REG_FLL3, 0x0008},
+        {NAU8540_REG_FLL4, 0x0010},
+        {NAU8540_REG_FLL5, 0xC000},
+        {NAU8540_REG_FLL6, 0x6000},
+        {NAU8540_REG_FLL_VCO_RSV, 0xF13C},
+        {NAU8540_REG_PCM_CTRL0, 0x000B},
+        {NAU8540_REG_PCM_CTRL1, 0x3010},
+        {NAU8540_REG_PCM_CTRL2, 0x0800},
+        {NAU8540_REG_PCM_CTRL3, 0x0000},
+        {NAU8540_REG_PCM_CTRL4, 0x000F},
+        {NAU8540_REG_ALC_CONTROL_1, 0x0000},
+        {NAU8540_REG_ALC_CONTROL_2, 0x700B},
+        {NAU8540_REG_ALC_CONTROL_3, 0x0022},
+        {NAU8540_REG_ALC_CONTROL_4, 0x1010},
+        {NAU8540_REG_ALC_CONTROL_5, 0x1010},
+        {NAU8540_REG_NOTCH_FIL1_CH1, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH1, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH2, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH2, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH3, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH3, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH4, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH4, 0x0000},
+        {NAU8540_REG_HPF_FILTER_CH12, 0x0000},
+        {NAU8540_REG_HPF_FILTER_CH34, 0x0000},
+        {NAU8540_REG_ADC_SAMPLE_RATE, 0x0002},
+        {NAU8540_REG_DIGITAL_GAIN_CH1, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH2, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH3, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH4, 0x0400},
+        {NAU8540_REG_DIGITAL_MUX, 0x00E4},
+        {NAU8540_REG_GPIO_CTRL, 0x0000},
+        {NAU8540_REG_MISC_CTRL, 0x0000},
+        {NAU8540_REG_I2C_CTRL, 0xEFFF},
+        {NAU8540_REG_VMID_CTRL, 0x0000},
+        {NAU8540_REG_MUTE, 0x0000},
+        {NAU8540_REG_ANALOG_ADC1, 0x0011},
+        {NAU8540_REG_ANALOG_ADC2, 0x0020},
+        {NAU8540_REG_ANALOG_PWR, 0x0000},
+        {NAU8540_REG_MIC_BIAS, 0x0004},
+        {NAU8540_REG_REFERENCE, 0x0000},
+        {NAU8540_REG_FEPGA1, 0x0000},
+        {NAU8540_REG_FEPGA2, 0x0000},
+        {NAU8540_REG_FEPGA3, 0x0101},
+        {NAU8540_REG_FEPGA4, 0x0101},
+        {NAU8540_REG_PWR, 0x0000},
 };
 
 static bool nau8540_readable_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_POWER_MANAGEMENT ... NAU8540_REG_FLL_VCO_RSV:
-       case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
-       case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
-       case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ADC_SAMPLE_RATE:
-       case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
-       case NAU8540_REG_P2P_CH1 ... NAU8540_REG_I2C_CTRL:
-       case NAU8540_REG_I2C_DEVICE_ID:
-       case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
-       case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_POWER_MANAGEMENT ... NAU8540_REG_FLL_VCO_RSV:
+        case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
+        case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
+        case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ADC_SAMPLE_RATE:
+        case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
+        case NAU8540_REG_P2P_CH1 ... NAU8540_REG_I2C_CTRL:
+        case NAU8540_REG_I2C_DEVICE_ID:
+        case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
+        case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
+                return true;
+        default:
+                return false;
+        }
 
 }
 
 static bool nau8540_writeable_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_SW_RESET ... NAU8540_REG_FLL_VCO_RSV:
-       case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
-       case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
-       case NAU8540_REG_NOTCH_FIL1_CH1 ... NAU8540_REG_ADC_SAMPLE_RATE:
-       case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
-       case NAU8540_REG_GPIO_CTRL ... NAU8540_REG_I2C_CTRL:
-       case NAU8540_REG_RST:
-       case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
-       case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_SW_RESET ... NAU8540_REG_FLL_VCO_RSV:
+        case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
+        case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
+        case NAU8540_REG_NOTCH_FIL1_CH1 ... NAU8540_REG_ADC_SAMPLE_RATE:
+        case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
+        case NAU8540_REG_GPIO_CTRL ... NAU8540_REG_I2C_CTRL:
+        case NAU8540_REG_RST:
+        case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
+        case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
+                return true;
+        default:
+                return false;
+        }
 }
 
 static bool nau8540_volatile_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_SW_RESET:
-       case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ALC_STATUS:
-       case NAU8540_REG_P2P_CH1 ... NAU8540_REG_PEAK_CH4:
-       case NAU8540_REG_I2C_DEVICE_ID:
-       case NAU8540_REG_RST:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_SW_RESET:
+        case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ALC_STATUS:
+        case NAU8540_REG_P2P_CH1 ... NAU8540_REG_PEAK_CH4:
+        case NAU8540_REG_I2C_DEVICE_ID:
+        case NAU8540_REG_RST:
+                return true;
+        default:
+                return false;
+        }
 }
 
 
@@ -187,255 +187,255 @@ static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -12800, 3600);
 static const DECLARE_TLV_DB_MINMAX(fepga_gain_tlv, -100, 3600);
 
 static const struct snd_kcontrol_new nau8540_snd_controls[] = {
-       SOC_SINGLE_TLV("Mic1 Volume", NAU8540_REG_DIGITAL_GAIN_CH1,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic2 Volume", NAU8540_REG_DIGITAL_GAIN_CH2,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic3 Volume", NAU8540_REG_DIGITAL_GAIN_CH3,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic4 Volume", NAU8540_REG_DIGITAL_GAIN_CH4,
-               0, 0x520, 0, adc_vol_tlv),
-
-       SOC_SINGLE_TLV("Frontend PGA1 Volume", NAU8540_REG_FEPGA3,
-               0, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA2 Volume", NAU8540_REG_FEPGA3,
-               8, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA3 Volume", NAU8540_REG_FEPGA4,
-               0, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA4 Volume", NAU8540_REG_FEPGA4,
-               8, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Mic1 Volume", NAU8540_REG_DIGITAL_GAIN_CH1,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic2 Volume", NAU8540_REG_DIGITAL_GAIN_CH2,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic3 Volume", NAU8540_REG_DIGITAL_GAIN_CH3,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic4 Volume", NAU8540_REG_DIGITAL_GAIN_CH4,
+                0, 0x520, 0, adc_vol_tlv),
+
+        SOC_SINGLE_TLV("Frontend PGA1 Volume", NAU8540_REG_FEPGA3,
+                0, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA2 Volume", NAU8540_REG_FEPGA3,
+                8, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA3 Volume", NAU8540_REG_FEPGA4,
+                0, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA4 Volume", NAU8540_REG_FEPGA4,
+                8, 0x25, 0, fepga_gain_tlv),
 };
 
 static const char * const adc_channel[] = {
-       "ADC channel 1", "ADC channel 2", "ADC channel 3", "ADC channel 4"
+        "ADC channel 1", "ADC channel 2", "ADC channel 3", "ADC channel 4"
 };
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch4_enum, NAU8540_REG_DIGITAL_MUX, 6, adc_channel);
+        digital_ch4_enum, NAU8540_REG_DIGITAL_MUX, 6, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch4_mux =
-       SOC_DAPM_ENUM("Digital CH4 Select", digital_ch4_enum);
+        SOC_DAPM_ENUM("Digital CH4 Select", digital_ch4_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch3_enum, NAU8540_REG_DIGITAL_MUX, 4, adc_channel);
+        digital_ch3_enum, NAU8540_REG_DIGITAL_MUX, 4, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch3_mux =
-       SOC_DAPM_ENUM("Digital CH3 Select", digital_ch3_enum);
+        SOC_DAPM_ENUM("Digital CH3 Select", digital_ch3_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch2_enum, NAU8540_REG_DIGITAL_MUX, 2, adc_channel);
+        digital_ch2_enum, NAU8540_REG_DIGITAL_MUX, 2, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch2_mux =
-       SOC_DAPM_ENUM("Digital CH2 Select", digital_ch2_enum);
+        SOC_DAPM_ENUM("Digital CH2 Select", digital_ch2_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch1_enum, NAU8540_REG_DIGITAL_MUX, 0, adc_channel);
+        digital_ch1_enum, NAU8540_REG_DIGITAL_MUX, 0, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch1_mux =
-       SOC_DAPM_ENUM("Digital CH1 Select", digital_ch1_enum);
+        SOC_DAPM_ENUM("Digital CH1 Select", digital_ch1_enum);
 
 static const struct snd_soc_dapm_widget nau8540_dapm_widgets[] = {
-       SND_SOC_DAPM_SUPPLY("MICBIAS2", NAU8540_REG_MIC_BIAS, 11, 0, NULL, 0),
-       SND_SOC_DAPM_SUPPLY("MICBIAS1", NAU8540_REG_MIC_BIAS, 10, 0, NULL, 0),
-
-       SND_SOC_DAPM_INPUT("MIC1"),
-       SND_SOC_DAPM_INPUT("MIC2"),
-       SND_SOC_DAPM_INPUT("MIC3"),
-       SND_SOC_DAPM_INPUT("MIC4"),
-
-       SND_SOC_DAPM_PGA("Frontend PGA1", NAU8540_REG_PWR, 12, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA2", NAU8540_REG_PWR, 13, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA3", NAU8540_REG_PWR, 14, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA4", NAU8540_REG_PWR, 15, 0, NULL, 0),
-
-       SND_SOC_DAPM_ADC("ADC1", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 0, 0),
-       SND_SOC_DAPM_ADC("ADC2", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 1, 0),
-       SND_SOC_DAPM_ADC("ADC3", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 2, 0),
-       SND_SOC_DAPM_ADC("ADC4", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 3, 0),
-
-       SND_SOC_DAPM_PGA("ADC CH1", NAU8540_REG_ANALOG_PWR, 0, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH2", NAU8540_REG_ANALOG_PWR, 1, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH3", NAU8540_REG_ANALOG_PWR, 2, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH4", NAU8540_REG_ANALOG_PWR, 3, 0, NULL, 0),
-
-       SND_SOC_DAPM_MUX("Digital CH4 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch4_mux),
-       SND_SOC_DAPM_MUX("Digital CH3 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch3_mux),
-       SND_SOC_DAPM_MUX("Digital CH2 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch2_mux),
-       SND_SOC_DAPM_MUX("Digital CH1 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch1_mux),
-
-       SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS2", NAU8540_REG_MIC_BIAS, 11, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS1", NAU8540_REG_MIC_BIAS, 10, 0, NULL, 0),
+
+        SND_SOC_DAPM_INPUT("MIC1"),
+        SND_SOC_DAPM_INPUT("MIC2"),
+        SND_SOC_DAPM_INPUT("MIC3"),
+        SND_SOC_DAPM_INPUT("MIC4"),
+
+        SND_SOC_DAPM_PGA("Frontend PGA1", NAU8540_REG_PWR, 12, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA2", NAU8540_REG_PWR, 13, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA3", NAU8540_REG_PWR, 14, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA4", NAU8540_REG_PWR, 15, 0, NULL, 0),
+
+        SND_SOC_DAPM_ADC("ADC1", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 0, 0),
+        SND_SOC_DAPM_ADC("ADC2", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 1, 0),
+        SND_SOC_DAPM_ADC("ADC3", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 2, 0),
+        SND_SOC_DAPM_ADC("ADC4", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 3, 0),
+
+        SND_SOC_DAPM_PGA("ADC CH1", NAU8540_REG_ANALOG_PWR, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH2", NAU8540_REG_ANALOG_PWR, 1, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH3", NAU8540_REG_ANALOG_PWR, 2, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH4", NAU8540_REG_ANALOG_PWR, 3, 0, NULL, 0),
+
+        SND_SOC_DAPM_MUX("Digital CH4 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch4_mux),
+        SND_SOC_DAPM_MUX("Digital CH3 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch3_mux),
+        SND_SOC_DAPM_MUX("Digital CH2 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch2_mux),
+        SND_SOC_DAPM_MUX("Digital CH1 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch1_mux),
+
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
 };
 
 static const struct snd_soc_dapm_route nau8540_dapm_routes[] = {
-       {"Frontend PGA1", NULL, "MIC1"},
-       {"Frontend PGA2", NULL, "MIC2"},
-       {"Frontend PGA3", NULL, "MIC3"},
-       {"Frontend PGA4", NULL, "MIC4"},
-
-       {"ADC1", NULL, "Frontend PGA1"},
-       {"ADC2", NULL, "Frontend PGA2"},
-       {"ADC3", NULL, "Frontend PGA3"},
-       {"ADC4", NULL, "Frontend PGA4"},
-
-       {"ADC CH1", NULL, "ADC1"},
-       {"ADC CH2", NULL, "ADC2"},
-       {"ADC CH3", NULL, "ADC3"},
-       {"ADC CH4", NULL, "ADC4"},
-
-       {"ADC1", NULL, "MICBIAS1"},
-       {"ADC2", NULL, "MICBIAS1"},
-       {"ADC3", NULL, "MICBIAS2"},
-       {"ADC4", NULL, "MICBIAS2"},
-
-       {"Digital CH1 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH1 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH1 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH1 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH2 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH2 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH2 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH2 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH3 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH3 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH3 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH3 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH4 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH4 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH4 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH4 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"AIFTX", NULL, "Digital CH1 Mux"},
-       {"AIFTX", NULL, "Digital CH2 Mux"},
-       {"AIFTX", NULL, "Digital CH3 Mux"},
-       {"AIFTX", NULL, "Digital CH4 Mux"},
+        {"Frontend PGA1", NULL, "MIC1"},
+        {"Frontend PGA2", NULL, "MIC2"},
+        {"Frontend PGA3", NULL, "MIC3"},
+        {"Frontend PGA4", NULL, "MIC4"},
+
+        {"ADC1", NULL, "Frontend PGA1"},
+        {"ADC2", NULL, "Frontend PGA2"},
+        {"ADC3", NULL, "Frontend PGA3"},
+        {"ADC4", NULL, "Frontend PGA4"},
+
+        {"ADC CH1", NULL, "ADC1"},
+        {"ADC CH2", NULL, "ADC2"},
+        {"ADC CH3", NULL, "ADC3"},
+        {"ADC CH4", NULL, "ADC4"},
+
+        {"ADC1", NULL, "MICBIAS1"},
+        {"ADC2", NULL, "MICBIAS1"},
+        {"ADC3", NULL, "MICBIAS2"},
+        {"ADC4", NULL, "MICBIAS2"},
+
+        {"Digital CH1 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH1 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH1 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH1 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH2 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH2 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH2 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH2 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH3 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH3 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH3 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH3 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH4 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH4 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH4 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH4 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"AIFTX", NULL, "Digital CH1 Mux"},
+        {"AIFTX", NULL, "Digital CH2 Mux"},
+        {"AIFTX", NULL, "Digital CH3 Mux"},
+        {"AIFTX", NULL, "Digital CH4 Mux"},
 };
 
 static int nau8540_clock_check(struct nau8540 *nau8540, int rate, int osr)
 {
-       int osrate;
+        int osrate;
 
-       if (osr >= ARRAY_SIZE(osr_adc_sel))
-               return -EINVAL;
-       osrate = osr_adc_sel[osr].osr;
+        if (osr >= ARRAY_SIZE(osr_adc_sel))
+                return -EINVAL;
+        osrate = osr_adc_sel[osr].osr;
 
-       if (rate * osr > CLK_ADC_MAX) {
-               dev_err(nau8540->dev, "exceed the maximum frequency of CLK_ADC\n");
-               return -EINVAL;
-       }
+        if (rate * osr > CLK_ADC_MAX) {
+                dev_err(nau8540->dev, "exceed the maximum frequency of CLK_ADC\n");
+                return -EINVAL;
+        }
 
-       return 0;
+        return 0;
 }
 
 static int nau8540_hw_params(struct snd_pcm_substream *substream,
-       struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int val_len = 0, osr;
-
-       /* CLK_ADC = OSR * FS
-        * ADC clock frequency is defined as Over Sampling Rate (OSR)
-        * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
-        * values must be selected such that the maximum frequency is less
-        * than 6.144 MHz.
-        */
-       regmap_read(nau8540->regmap, NAU8540_REG_ADC_SAMPLE_RATE, &osr);
-       osr &= NAU8540_ADC_OSR_MASK;
-       if (nau8540_clock_check(nau8540, params_rate(params), osr))
-               return -EINVAL;
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_ADC_SRC_MASK,
-               osr_adc_sel[osr].clk_src << NAU8540_CLK_ADC_SRC_SFT);
-
-       switch (params_width(params)) {
-       case 16:
-               val_len |= NAU8540_I2S_DL_16;
-               break;
-       case 20:
-               val_len |= NAU8540_I2S_DL_20;
-               break;
-       case 24:
-               val_len |= NAU8540_I2S_DL_24;
-               break;
-       case 32:
-               val_len |= NAU8540_I2S_DL_32;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
-               NAU8540_I2S_DL_MASK, val_len);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0, osr;
+
+        /* CLK_ADC = OSR * FS
+         * ADC clock frequency is defined as Over Sampling Rate (OSR)
+         * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
+         * values must be selected such that the maximum frequency is less
+         * than 6.144 MHz.
+         */
+        regmap_read(nau8540->regmap, NAU8540_REG_ADC_SAMPLE_RATE, &osr);
+        osr &= NAU8540_ADC_OSR_MASK;
+        if (nau8540_clock_check(nau8540, params_rate(params), osr))
+                return -EINVAL;
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_ADC_SRC_MASK,
+                osr_adc_sel[osr].clk_src << NAU8540_CLK_ADC_SRC_SFT);
+
+        switch (params_width(params)) {
+        case 16:
+                val_len |= NAU8540_I2S_DL_16;
+                break;
+        case 20:
+                val_len |= NAU8540_I2S_DL_20;
+                break;
+        case 24:
+                val_len |= NAU8540_I2S_DL_24;
+                break;
+        case 32:
+                val_len |= NAU8540_I2S_DL_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
+                NAU8540_I2S_DL_MASK, val_len);
+
+        return 0;
 }
 
 static int nau8540_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int ctrl1_val = 0, ctrl2_val = 0;
-
-       switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-       case SND_SOC_DAIFMT_CBM_CFM:
-               ctrl2_val |= NAU8540_I2S_MS_MASTER;
-               break;
-       case SND_SOC_DAIFMT_CBS_CFS:
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-       case SND_SOC_DAIFMT_NB_NF:
-               break;
-       case SND_SOC_DAIFMT_IB_NF:
-               ctrl1_val |= NAU8540_I2S_BP_INV;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
-       case SND_SOC_DAIFMT_I2S:
-               ctrl1_val |= NAU8540_I2S_DF_I2S;
-               break;
-       case SND_SOC_DAIFMT_LEFT_J:
-               ctrl1_val |= NAU8540_I2S_DF_LEFT;
-               break;
-       case SND_SOC_DAIFMT_RIGHT_J:
-               ctrl1_val |= NAU8540_I2S_DF_RIGTH;
-               break;
-       case SND_SOC_DAIFMT_DSP_A:
-               ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
-               break;
-       case SND_SOC_DAIFMT_DSP_B:
-               ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
-               ctrl1_val |= NAU8540_I2S_PCMB_EN;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
-               NAU8540_I2S_DL_MASK | NAU8540_I2S_DF_MASK |
-               NAU8540_I2S_BP_INV | NAU8540_I2S_PCMB_EN, ctrl1_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
-               NAU8540_I2S_MS_MASK | NAU8540_I2S_DO12_OE, ctrl2_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
-               NAU8540_I2S_DO34_OE, 0);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl1_val = 0, ctrl2_val = 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                ctrl2_val |= NAU8540_I2S_MS_MASTER;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                ctrl1_val |= NAU8540_I2S_BP_INV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                ctrl1_val |= NAU8540_I2S_DF_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                ctrl1_val |= NAU8540_I2S_DF_LEFT;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                ctrl1_val |= NAU8540_I2S_DF_RIGTH;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
+                ctrl1_val |= NAU8540_I2S_PCMB_EN;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
+                NAU8540_I2S_DL_MASK | NAU8540_I2S_DF_MASK |
+                NAU8540_I2S_BP_INV | NAU8540_I2S_PCMB_EN, ctrl1_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
+                NAU8540_I2S_MS_MASK | NAU8540_I2S_DO12_OE, ctrl2_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
+                NAU8540_I2S_DO34_OE, 0);
+
+        return 0;
 }
 
 /**
@@ -451,55 +451,55 @@ static int nau8540_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
  * Configures a DAI for TDM operation. Only support 4 slots TDM.
  */
 static int nau8540_set_tdm_slot(struct snd_soc_dai *dai,
-       unsigned int tx_mask, unsigned int rx_mask, int slots, int slot_width)
+        unsigned int tx_mask, unsigned int rx_mask, int slots, int slot_width)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int ctrl2_val = 0, ctrl4_val = 0;
-
-       if (slots > 4 || ((tx_mask & 0xf0) && (tx_mask & 0xf)))
-               return -EINVAL;
-
-       ctrl4_val |= (NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN);
-       if (tx_mask & 0xf0) {
-               ctrl2_val = 4 * slot_width;
-               ctrl4_val |= (tx_mask >> 4);
-       } else {
-               ctrl4_val |= tx_mask;
-       }
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL4,
-               NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN |
-               NAU8540_TDM_TX_MASK, ctrl4_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
-               NAU8540_I2S_DO12_OE, NAU8540_I2S_DO12_OE);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
-               NAU8540_I2S_DO34_OE | NAU8540_I2S_TSLOT_L_MASK,
-               NAU8540_I2S_DO34_OE | ctrl2_val);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl2_val = 0, ctrl4_val = 0;
+
+        if (slots > 4 || ((tx_mask & 0xf0) && (tx_mask & 0xf)))
+                return -EINVAL;
+
+        ctrl4_val |= (NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN);
+        if (tx_mask & 0xf0) {
+                ctrl2_val = 4 * slot_width;
+                ctrl4_val |= (tx_mask >> 4);
+        } else {
+                ctrl4_val |= tx_mask;
+        }
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL4,
+                NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN |
+                NAU8540_TDM_TX_MASK, ctrl4_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
+                NAU8540_I2S_DO12_OE, NAU8540_I2S_DO12_OE);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
+                NAU8540_I2S_DO34_OE | NAU8540_I2S_TSLOT_L_MASK,
+                NAU8540_I2S_DO34_OE | ctrl2_val);
+
+        return 0;
 }
 
 
 static const struct snd_soc_dai_ops nau8540_dai_ops = {
-       .hw_params = nau8540_hw_params,
-       .set_fmt = nau8540_set_fmt,
-       .set_tdm_slot = nau8540_set_tdm_slot,
+        .hw_params = nau8540_hw_params,
+        .set_fmt = nau8540_set_fmt,
+        .set_tdm_slot = nau8540_set_tdm_slot,
 };
 
 #define NAU8540_RATES SNDRV_PCM_RATE_8000_48000
 #define NAU8540_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
-        | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
+         | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
 
 static struct snd_soc_dai_driver nau8540_dai = {
-       .name = "nau8540-hifi",
-       .capture = {
-               .stream_name = "Capture",
-               .channels_min = 1,
-               .channels_max = 4,
-               .rates = NAU8540_RATES,
-               .formats = NAU8540_FORMATS,
-       },
-       .ops = &nau8540_dai_ops,
+        .name = "nau8540-hifi",
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 1,
+                .channels_max = 4,
+                .rates = NAU8540_RATES,
+                .formats = NAU8540_FORMATS,
+        },
+        .ops = &nau8540_dai_ops,
 };
 
 /**
@@ -513,320 +513,320 @@ static struct snd_soc_dai_driver nau8540_dai = {
  * Returns 0 for success or negative error code.
  */
 static int nau8540_calc_fll_param(unsigned int fll_in,
-       unsigned int fs, struct nau8540_fll *fll_param)
+        unsigned int fs, struct nau8540_fll *fll_param)
 {
-       u64 fvco, fvco_max;
-       unsigned int fref, i, fvco_sel;
-
-       /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
-        * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
-        * FREF = freq_in / NAU8540_FLL_REF_DIV_MASK
-        */
-       for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
-               fref = fll_in / fll_pre_scalar[i].param;
-               if (fref <= NAU_FREF_MAX)
-                       break;
-       }
-       if (i == ARRAY_SIZE(fll_pre_scalar))
-               return -EINVAL;
-       fll_param->clk_ref_div = fll_pre_scalar[i].val;
-
-       /* Choose the FLL ratio based on FREF */
-       for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
-               if (fref >= fll_ratio[i].param)
-                       break;
-       }
-       if (i == ARRAY_SIZE(fll_ratio))
-               return -EINVAL;
-       fll_param->ratio = fll_ratio[i].val;
-
-       /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
-        * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
-        * guaranteed across the full range of operation.
-        * FDCO = freq_out * 2 * mclk_src_scaling
-        */
-       fvco_max = 0;
-       fvco_sel = ARRAY_SIZE(mclk_src_scaling);
-       for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
-               fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
-               if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
-                       fvco_max < fvco) {
-                       fvco_max = fvco;
-                       fvco_sel = i;
-               }
-       }
-       if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
-               return -EINVAL;
-       fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
-
-       /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
-        * input based on FDCO, FREF and FLL ratio.
-        */
-       fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
-       fll_param->fll_int = (fvco >> 16) & 0x3FF;
-       fll_param->fll_frac = fvco & 0xFFFF;
-       return 0;
+        u64 fvco, fvco_max;
+        unsigned int fref, i, fvco_sel;
+
+        /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
+         * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
+         * FREF = freq_in / NAU8540_FLL_REF_DIV_MASK
+         */
+        for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
+                fref = fll_in / fll_pre_scalar[i].param;
+                if (fref <= NAU_FREF_MAX)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_pre_scalar))
+                return -EINVAL;
+        fll_param->clk_ref_div = fll_pre_scalar[i].val;
+
+        /* Choose the FLL ratio based on FREF */
+        for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
+                if (fref >= fll_ratio[i].param)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_ratio))
+                return -EINVAL;
+        fll_param->ratio = fll_ratio[i].val;
+
+        /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
+         * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
+         * guaranteed across the full range of operation.
+         * FDCO = freq_out * 2 * mclk_src_scaling
+         */
+        fvco_max = 0;
+        fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+        for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+                fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
+                if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+                        fvco_max < fvco) {
+                        fvco_max = fvco;
+                        fvco_sel = i;
+                }
+        }
+        if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
+                return -EINVAL;
+        fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
+
+        /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
+         * input based on FDCO, FREF and FLL ratio.
+         */
+        fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
+        fll_param->fll_int = (fvco >> 16) & 0x3FF;
+        fll_param->fll_frac = fvco & 0xFFFF;
+        return 0;
 }
 
 static void nau8540_fll_apply(struct regmap *regmap,
-       struct nau8540_fll *fll_param)
+        struct nau8540_fll *fll_param)
 {
-       regmap_update_bits(regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_SRC_MASK | NAU8540_CLK_MCLK_SRC_MASK,
-               NAU8540_CLK_SRC_MCLK | fll_param->mclk_src);
-       regmap_update_bits(regmap, NAU8540_REG_FLL1,
-               NAU8540_FLL_RATIO_MASK, fll_param->ratio);
-       /* FLL 16-bit fractional input */
-       regmap_write(regmap, NAU8540_REG_FLL2, fll_param->fll_frac);
-       /* FLL 10-bit integer input */
-       regmap_update_bits(regmap, NAU8540_REG_FLL3,
-               NAU8540_FLL_INTEGER_MASK, fll_param->fll_int);
-       /* FLL pre-scaler */
-       regmap_update_bits(regmap, NAU8540_REG_FLL4,
-               NAU8540_FLL_REF_DIV_MASK,
-               fll_param->clk_ref_div << NAU8540_FLL_REF_DIV_SFT);
-       regmap_update_bits(regmap, NAU8540_REG_FLL5,
-               NAU8540_FLL_CLK_SW_MASK, NAU8540_FLL_CLK_SW_REF);
-       regmap_update_bits(regmap,
-               NAU8540_REG_FLL6, NAU8540_DCO_EN, 0);
-       if (fll_param->fll_frac) {
-               regmap_update_bits(regmap, NAU8540_REG_FLL5,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_MASK,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_FILTER);
-               regmap_update_bits(regmap, NAU8540_REG_FLL6,
-                       NAU8540_SDM_EN, NAU8540_SDM_EN);
-       } else {
-               regmap_update_bits(regmap, NAU8540_REG_FLL5,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_MASK, NAU8540_FLL_FTR_SW_ACCU);
-               regmap_update_bits(regmap,
-                       NAU8540_REG_FLL6, NAU8540_SDM_EN, 0);
-       }
+        regmap_update_bits(regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_SRC_MASK | NAU8540_CLK_MCLK_SRC_MASK,
+                NAU8540_CLK_SRC_MCLK | fll_param->mclk_src);
+        regmap_update_bits(regmap, NAU8540_REG_FLL1,
+                NAU8540_FLL_RATIO_MASK, fll_param->ratio);
+        /* FLL 16-bit fractional input */
+        regmap_write(regmap, NAU8540_REG_FLL2, fll_param->fll_frac);
+        /* FLL 10-bit integer input */
+        regmap_update_bits(regmap, NAU8540_REG_FLL3,
+                NAU8540_FLL_INTEGER_MASK, fll_param->fll_int);
+        /* FLL pre-scaler */
+        regmap_update_bits(regmap, NAU8540_REG_FLL4,
+                NAU8540_FLL_REF_DIV_MASK,
+                fll_param->clk_ref_div << NAU8540_FLL_REF_DIV_SFT);
+        regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                NAU8540_FLL_CLK_SW_MASK, NAU8540_FLL_CLK_SW_REF);
+        regmap_update_bits(regmap,
+                NAU8540_REG_FLL6, NAU8540_DCO_EN, 0);
+        if (fll_param->fll_frac) {
+                regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_MASK,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_FILTER);
+                regmap_update_bits(regmap, NAU8540_REG_FLL6,
+                        NAU8540_SDM_EN, NAU8540_SDM_EN);
+        } else {
+                regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_MASK, NAU8540_FLL_FTR_SW_ACCU);
+                regmap_update_bits(regmap,
+                        NAU8540_REG_FLL6, NAU8540_SDM_EN, 0);
+        }
 }
 
 /* freq_out must be 256*Fs in order to achieve the best performance */
 static int nau8540_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
-               unsigned int freq_in, unsigned int freq_out)
+                unsigned int freq_in, unsigned int freq_out)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       struct nau8540_fll fll_param;
-       int ret, fs;
-
-       switch (pll_id) {
-       case NAU8540_CLK_FLL_MCLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_MCLK);
-               break;
-
-       case NAU8540_CLK_FLL_BLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_BLK);
-               break;
-
-       case NAU8540_CLK_FLL_FS:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_FS);
-               break;
-
-       default:
-               dev_err(nau8540->dev, "Invalid clock id (%d)\n", pll_id);
-               return -EINVAL;
-       }
-       dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
-               freq_out, pll_id);
-
-       fs = freq_out / 256;
-       ret = nau8540_calc_fll_param(freq_in, fs, &fll_param);
-       if (ret < 0) {
-               dev_err(nau8540->dev, "Unsupported input clock %d\n", freq_in);
-               return ret;
-       }
-       dev_dbg(nau8540->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
-               fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
-               fll_param.fll_int, fll_param.clk_ref_div);
-
-       nau8540_fll_apply(nau8540->regmap, &fll_param);
-       mdelay(2);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
-
-       return 0;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540_fll fll_param;
+        int ret, fs;
+
+        switch (pll_id) {
+        case NAU8540_CLK_FLL_MCLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_MCLK);
+                break;
+
+        case NAU8540_CLK_FLL_BLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_BLK);
+                break;
+
+        case NAU8540_CLK_FLL_FS:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_FS);
+                break;
+
+        default:
+                dev_err(nau8540->dev, "Invalid clock id (%d)\n", pll_id);
+                return -EINVAL;
+        }
+        dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
+                freq_out, pll_id);
+
+        fs = freq_out / 256;
+        ret = nau8540_calc_fll_param(freq_in, fs, &fll_param);
+        if (ret < 0) {
+                dev_err(nau8540->dev, "Unsupported input clock %d\n", freq_in);
+                return ret;
+        }
+        dev_dbg(nau8540->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
+                fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
+                fll_param.fll_int, fll_param.clk_ref_div);
+
+        nau8540_fll_apply(nau8540->regmap, &fll_param);
+        mdelay(2);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
+
+        return 0;
 }
 
 static int nau8540_set_sysclk(struct snd_soc_codec *codec,
-       int clk_id, int source, unsigned int freq, int dir)
+        int clk_id, int source, unsigned int freq, int dir)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-
-       switch (clk_id) {
-       case NAU8540_CLK_DIS:
-       case NAU8540_CLK_MCLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-                       NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_MCLK);
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
-                       NAU8540_DCO_EN, 0);
-               break;
-
-       case NAU8540_CLK_INTERNAL:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
-                       NAU8540_DCO_EN, NAU8540_DCO_EN);
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-                       NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
-               break;
-
-       default:
-               dev_err(nau8540->dev, "Invalid clock id (%d)\n", clk_id);
-               return -EINVAL;
-       }
-
-       dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
-               freq, clk_id);
-
-       return 0;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+
+        switch (clk_id) {
+        case NAU8540_CLK_DIS:
+        case NAU8540_CLK_MCLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                        NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_MCLK);
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
+                        NAU8540_DCO_EN, 0);
+                break;
+
+        case NAU8540_CLK_INTERNAL:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
+                        NAU8540_DCO_EN, NAU8540_DCO_EN);
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                        NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
+                break;
+
+        default:
+                dev_err(nau8540->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+
+        dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
+                freq, clk_id);
+
+        return 0;
 }
 
 static void nau8540_reset_chip(struct regmap *regmap)
 {
-       regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
-       regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
+        regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
+        regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
 }
 
 static void nau8540_init_regs(struct nau8540 *nau8540)
 {
-       struct regmap *regmap = nau8540->regmap;
-
-       /* Enable Bias/VMID/VMID Tieoff */
-       regmap_update_bits(regmap, NAU8540_REG_VMID_CTRL,
-               NAU8540_VMID_EN | NAU8540_VMID_SEL_MASK,
-               NAU8540_VMID_EN | (0x2 << NAU8540_VMID_SEL_SFT));
-       regmap_update_bits(regmap, NAU8540_REG_REFERENCE,
-               NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN,
-               NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN);
-       mdelay(2);
-       regmap_update_bits(regmap, NAU8540_REG_MIC_BIAS,
-               NAU8540_PU_PRE, NAU8540_PU_PRE);
-       regmap_update_bits(regmap, NAU8540_REG_CLOCK_CTRL,
-               NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN,
-               NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN);
-       /* ADC OSR selection, CLK_ADC = Fs * OSR */
-       regmap_update_bits(regmap, NAU8540_REG_ADC_SAMPLE_RATE,
-               NAU8540_ADC_OSR_MASK, NAU8540_ADC_OSR_64);
+        struct regmap *regmap = nau8540->regmap;
+
+        /* Enable Bias/VMID/VMID Tieoff */
+        regmap_update_bits(regmap, NAU8540_REG_VMID_CTRL,
+                NAU8540_VMID_EN | NAU8540_VMID_SEL_MASK,
+                NAU8540_VMID_EN | (0x2 << NAU8540_VMID_SEL_SFT));
+        regmap_update_bits(regmap, NAU8540_REG_REFERENCE,
+                NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN,
+                NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN);
+        mdelay(2);
+        regmap_update_bits(regmap, NAU8540_REG_MIC_BIAS,
+                NAU8540_PU_PRE, NAU8540_PU_PRE);
+        regmap_update_bits(regmap, NAU8540_REG_CLOCK_CTRL,
+                NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN,
+                NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN);
+        /* ADC OSR selection, CLK_ADC = Fs * OSR */
+        regmap_update_bits(regmap, NAU8540_REG_ADC_SAMPLE_RATE,
+                NAU8540_ADC_OSR_MASK, NAU8540_ADC_OSR_64);
 }
 
 static int __maybe_unused nau8540_suspend(struct snd_soc_codec *codec)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
 
-       regcache_cache_only(nau8540->regmap, true);
-       regcache_mark_dirty(nau8540->regmap);
+        regcache_cache_only(nau8540->regmap, true);
+        regcache_mark_dirty(nau8540->regmap);
 
-       return 0;
+        return 0;
 }
 
 static int __maybe_unused nau8540_resume(struct snd_soc_codec *codec)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
 
-       regcache_cache_only(nau8540->regmap, false);
-       regcache_sync(nau8540->regmap);
+        regcache_cache_only(nau8540->regmap, false);
+        regcache_sync(nau8540->regmap);
 
-       return 0;
+        return 0;
 }
 
 static struct snd_soc_codec_driver nau8540_codec_driver = {
-       .set_sysclk = nau8540_set_sysclk,
-       .set_pll = nau8540_set_pll,
-       .suspend = nau8540_suspend,
-       .resume = nau8540_resume,
-       .suspend_bias_off = true,
-
-       .component_driver = {
-               .controls = nau8540_snd_controls,
-               .num_controls = ARRAY_SIZE(nau8540_snd_controls),
-               .dapm_widgets = nau8540_dapm_widgets,
-               .num_dapm_widgets = ARRAY_SIZE(nau8540_dapm_widgets),
-               .dapm_routes = nau8540_dapm_routes,
-               .num_dapm_routes = ARRAY_SIZE(nau8540_dapm_routes),
-       },
+        .set_sysclk = nau8540_set_sysclk,
+        .set_pll = nau8540_set_pll,
+        .suspend = nau8540_suspend,
+        .resume = nau8540_resume,
+        .suspend_bias_off = true,
+
+        .component_driver = {
+                .controls = nau8540_snd_controls,
+                .num_controls = ARRAY_SIZE(nau8540_snd_controls),
+                .dapm_widgets = nau8540_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(nau8540_dapm_widgets),
+                .dapm_routes = nau8540_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(nau8540_dapm_routes),
+        },
 };
 
 static const struct regmap_config nau8540_regmap_config = {
-       .val_bits = 16,
-       .reg_bits = 16,
+        .val_bits = 16,
+        .reg_bits = 16,
 
-       .max_register = NAU8540_REG_MAX,
-       .readable_reg = nau8540_readable_reg,
-       .writeable_reg = nau8540_writeable_reg,
-       .volatile_reg = nau8540_volatile_reg,
+        .max_register = NAU8540_REG_MAX,
+        .readable_reg = nau8540_readable_reg,
+        .writeable_reg = nau8540_writeable_reg,
+        .volatile_reg = nau8540_volatile_reg,
 
-       .cache_type = REGCACHE_RBTREE,
-       .reg_defaults = nau8540_reg_defaults,
-       .num_reg_defaults = ARRAY_SIZE(nau8540_reg_defaults),
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = nau8540_reg_defaults,
+        .num_reg_defaults = ARRAY_SIZE(nau8540_reg_defaults),
 };
 
 static int nau8540_i2c_probe(struct i2c_client *i2c,
-       const struct i2c_device_id *id)
+        const struct i2c_device_id *id)
 {
-       struct device *dev = &i2c->dev;
-       struct nau8540 *nau8540 = dev_get_platdata(dev);
-       int ret, value;
-
-       if (!nau8540) {
-               nau8540 = devm_kzalloc(dev, sizeof(*nau8540), GFP_KERNEL);
-               if (!nau8540)
-                       return -ENOMEM;
-       }
-       i2c_set_clientdata(i2c, nau8540);
-
-       nau8540->regmap = devm_regmap_init_i2c(i2c, &nau8540_regmap_config);
-       if (IS_ERR(nau8540->regmap))
-               return PTR_ERR(nau8540->regmap);
-       ret = regmap_read(nau8540->regmap, NAU8540_REG_I2C_DEVICE_ID, &value);
-       if (ret < 0) {
-               dev_err(dev, "Failed to read device id from the NAU85L40: %d\n",
-                       ret);
-               return ret;
-       }
-
-       nau8540->dev = dev;
-       nau8540_reset_chip(nau8540->regmap);
-       nau8540_init_regs(nau8540);
-
-       return snd_soc_register_codec(dev,
-               &nau8540_codec_driver, &nau8540_dai, 1);
+        struct device *dev = &i2c->dev;
+        struct nau8540 *nau8540 = dev_get_platdata(dev);
+        int ret, value;
+
+        if (!nau8540) {
+                nau8540 = devm_kzalloc(dev, sizeof(*nau8540), GFP_KERNEL);
+                if (!nau8540)
+                        return -ENOMEM;
+        }
+        i2c_set_clientdata(i2c, nau8540);
+
+        nau8540->regmap = devm_regmap_init_i2c(i2c, &nau8540_regmap_config);
+        if (IS_ERR(nau8540->regmap))
+                return PTR_ERR(nau8540->regmap);
+        ret = regmap_read(nau8540->regmap, NAU8540_REG_I2C_DEVICE_ID, &value);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read device id from the NAU85L40: %d\n",
+                        ret);
+                return ret;
+        }
+
+        nau8540->dev = dev;
+        nau8540_reset_chip(nau8540->regmap);
+        nau8540_init_regs(nau8540);
+
+        return snd_soc_register_codec(dev,
+                &nau8540_codec_driver, &nau8540_dai, 1);
 }
 
 static int nau8540_i2c_remove(struct i2c_client *client)
 {
-       snd_soc_unregister_codec(&client->dev);
-       return 0;
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
 }
 
 
 static const struct i2c_device_id nau8540_i2c_ids[] = {
-       { "nau8540", 0 },
-       { }
+        { "nau8540", 0 },
+        { }
 };
 MODULE_DEVICE_TABLE(i2c, nau8540_i2c_ids);
 
 #ifdef CONFIG_OF
 static const struct of_device_id nau8540_of_ids[] = {
-       { .compatible = "nuvoton,nau8540", },
-       {}
+        { .compatible = "nuvoton,nau8540", },
+        {}
 };
 MODULE_DEVICE_TABLE(of, nau8540_of_ids);
 #endif
 
 static struct i2c_driver nau8540_i2c_driver = {
-       .driver = {
-               .name = "nau8540",
-               .of_match_table = of_match_ptr(nau8540_of_ids),
-       },
-       .probe = nau8540_i2c_probe,
-       .remove = nau8540_i2c_remove,
-       .id_table = nau8540_i2c_ids,
+        .driver = {
+                .name = "nau8540",
+                .of_match_table = of_match_ptr(nau8540_of_ids),
+        },
+        .probe = nau8540_i2c_probe,
+        .remove = nau8540_i2c_remove,
+        .id_table = nau8540_i2c_ids,
 };
 module_i2c_driver(nau8540_i2c_driver);
 
diff --git a/sound/soc/codecs/nau8540.h b/sound/soc/codecs/nau8540.h
index d06e65188cd5..5db5b224944d 100644
--- a/sound/soc/codecs/nau8540.h
+++ b/sound/soc/codecs/nau8540.h
@@ -12,211 +12,211 @@
 #ifndef __NAU8540_H__
 #define __NAU8540_H__
 
-#define NAU8540_REG_SW_RESET                   0x00
-#define NAU8540_REG_POWER_MANAGEMENT   0x01
-#define NAU8540_REG_CLOCK_CTRL         0x02
-#define NAU8540_REG_CLOCK_SRC                  0x03
-#define NAU8540_REG_FLL1                       0x04
-#define NAU8540_REG_FLL2                       0x05
-#define NAU8540_REG_FLL3                       0x06
-#define NAU8540_REG_FLL4                       0x07
-#define NAU8540_REG_FLL5                       0x08
-#define NAU8540_REG_FLL6                       0x09
-#define NAU8540_REG_FLL_VCO_RSV                0x0A
-#define NAU8540_REG_PCM_CTRL0                  0x10
-#define NAU8540_REG_PCM_CTRL1                  0x11
-#define NAU8540_REG_PCM_CTRL2                  0x12
-#define NAU8540_REG_PCM_CTRL3                  0x13
-#define NAU8540_REG_PCM_CTRL4                  0x14
-#define NAU8540_REG_ALC_CONTROL_1              0x20
-#define NAU8540_REG_ALC_CONTROL_2              0x21
-#define NAU8540_REG_ALC_CONTROL_3              0x22
-#define NAU8540_REG_ALC_CONTROL_4              0x23
-#define NAU8540_REG_ALC_CONTROL_5              0x24
-#define NAU8540_REG_ALC_GAIN_CH12              0x2D
-#define NAU8540_REG_ALC_GAIN_CH34              0x2E
-#define NAU8540_REG_ALC_STATUS         0x2F
-#define NAU8540_REG_NOTCH_FIL1_CH1             0x30
-#define NAU8540_REG_NOTCH_FIL2_CH1             0x31
-#define NAU8540_REG_NOTCH_FIL1_CH2             0x32
-#define NAU8540_REG_NOTCH_FIL2_CH2             0x33
-#define NAU8540_REG_NOTCH_FIL1_CH3             0x34
-#define NAU8540_REG_NOTCH_FIL2_CH3             0x35
-#define NAU8540_REG_NOTCH_FIL1_CH4             0x36
-#define NAU8540_REG_NOTCH_FIL2_CH4             0x37
-#define NAU8540_REG_HPF_FILTER_CH12            0x38
-#define NAU8540_REG_HPF_FILTER_CH34            0x39
-#define NAU8540_REG_ADC_SAMPLE_RATE            0x3A
-#define NAU8540_REG_DIGITAL_GAIN_CH1           0x40
-#define NAU8540_REG_DIGITAL_GAIN_CH2           0x41
-#define NAU8540_REG_DIGITAL_GAIN_CH3           0x42
-#define NAU8540_REG_DIGITAL_GAIN_CH4           0x43
-#define NAU8540_REG_DIGITAL_MUX                0x44
-#define NAU8540_REG_P2P_CH1                    0x48
-#define NAU8540_REG_P2P_CH2                    0x49
-#define NAU8540_REG_P2P_CH3                    0x4A
-#define NAU8540_REG_P2P_CH4                    0x4B
-#define NAU8540_REG_PEAK_CH1                   0x4C
-#define NAU8540_REG_PEAK_CH2                   0x4D
-#define NAU8540_REG_PEAK_CH3                   0x4E
-#define NAU8540_REG_PEAK_CH4                   0x4F
-#define NAU8540_REG_GPIO_CTRL                  0x50
-#define NAU8540_REG_MISC_CTRL                  0x51
-#define NAU8540_REG_I2C_CTRL                   0x52
-#define NAU8540_REG_I2C_DEVICE_ID              0x58
-#define NAU8540_REG_RST                        0x5A
-#define NAU8540_REG_VMID_CTRL                  0x60
-#define NAU8540_REG_MUTE                       0x61
-#define NAU8540_REG_ANALOG_ADC1                0x64
-#define NAU8540_REG_ANALOG_ADC2                0x65
-#define NAU8540_REG_ANALOG_PWR         0x66
-#define NAU8540_REG_MIC_BIAS                   0x67
-#define NAU8540_REG_REFERENCE                  0x68
-#define NAU8540_REG_FEPGA1                     0x69
-#define NAU8540_REG_FEPGA2                     0x6A
-#define NAU8540_REG_FEPGA3                     0x6B
-#define NAU8540_REG_FEPGA4                     0x6C
-#define NAU8540_REG_PWR                        0x6D
-#define NAU8540_REG_MAX                        NAU8540_REG_PWR
+#define NAU8540_REG_SW_RESET                    0x00
+#define NAU8540_REG_POWER_MANAGEMENT    0x01
+#define NAU8540_REG_CLOCK_CTRL          0x02
+#define NAU8540_REG_CLOCK_SRC                   0x03
+#define NAU8540_REG_FLL1                        0x04
+#define NAU8540_REG_FLL2                        0x05
+#define NAU8540_REG_FLL3                        0x06
+#define NAU8540_REG_FLL4                        0x07
+#define NAU8540_REG_FLL5                        0x08
+#define NAU8540_REG_FLL6                        0x09
+#define NAU8540_REG_FLL_VCO_RSV         0x0A
+#define NAU8540_REG_PCM_CTRL0                   0x10
+#define NAU8540_REG_PCM_CTRL1                   0x11
+#define NAU8540_REG_PCM_CTRL2                   0x12
+#define NAU8540_REG_PCM_CTRL3                   0x13
+#define NAU8540_REG_PCM_CTRL4                   0x14
+#define NAU8540_REG_ALC_CONTROL_1               0x20
+#define NAU8540_REG_ALC_CONTROL_2               0x21
+#define NAU8540_REG_ALC_CONTROL_3               0x22
+#define NAU8540_REG_ALC_CONTROL_4               0x23
+#define NAU8540_REG_ALC_CONTROL_5               0x24
+#define NAU8540_REG_ALC_GAIN_CH12               0x2D
+#define NAU8540_REG_ALC_GAIN_CH34               0x2E
+#define NAU8540_REG_ALC_STATUS          0x2F
+#define NAU8540_REG_NOTCH_FIL1_CH1              0x30
+#define NAU8540_REG_NOTCH_FIL2_CH1              0x31
+#define NAU8540_REG_NOTCH_FIL1_CH2              0x32
+#define NAU8540_REG_NOTCH_FIL2_CH2              0x33
+#define NAU8540_REG_NOTCH_FIL1_CH3              0x34
+#define NAU8540_REG_NOTCH_FIL2_CH3              0x35
+#define NAU8540_REG_NOTCH_FIL1_CH4              0x36
+#define NAU8540_REG_NOTCH_FIL2_CH4              0x37
+#define NAU8540_REG_HPF_FILTER_CH12             0x38
+#define NAU8540_REG_HPF_FILTER_CH34             0x39
+#define NAU8540_REG_ADC_SAMPLE_RATE             0x3A
+#define NAU8540_REG_DIGITAL_GAIN_CH1            0x40
+#define NAU8540_REG_DIGITAL_GAIN_CH2            0x41
+#define NAU8540_REG_DIGITAL_GAIN_CH3            0x42
+#define NAU8540_REG_DIGITAL_GAIN_CH4            0x43
+#define NAU8540_REG_DIGITAL_MUX         0x44
+#define NAU8540_REG_P2P_CH1                     0x48
+#define NAU8540_REG_P2P_CH2                     0x49
+#define NAU8540_REG_P2P_CH3                     0x4A
+#define NAU8540_REG_P2P_CH4                     0x4B
+#define NAU8540_REG_PEAK_CH1                    0x4C
+#define NAU8540_REG_PEAK_CH2                    0x4D
+#define NAU8540_REG_PEAK_CH3                    0x4E
+#define NAU8540_REG_PEAK_CH4                    0x4F
+#define NAU8540_REG_GPIO_CTRL                   0x50
+#define NAU8540_REG_MISC_CTRL                   0x51
+#define NAU8540_REG_I2C_CTRL                    0x52
+#define NAU8540_REG_I2C_DEVICE_ID               0x58
+#define NAU8540_REG_RST                 0x5A
+#define NAU8540_REG_VMID_CTRL                   0x60
+#define NAU8540_REG_MUTE                        0x61
+#define NAU8540_REG_ANALOG_ADC1         0x64
+#define NAU8540_REG_ANALOG_ADC2         0x65
+#define NAU8540_REG_ANALOG_PWR          0x66
+#define NAU8540_REG_MIC_BIAS                    0x67
+#define NAU8540_REG_REFERENCE                   0x68
+#define NAU8540_REG_FEPGA1                      0x69
+#define NAU8540_REG_FEPGA2                      0x6A
+#define NAU8540_REG_FEPGA3                      0x6B
+#define NAU8540_REG_FEPGA4                      0x6C
+#define NAU8540_REG_PWR                 0x6D
+#define NAU8540_REG_MAX                 NAU8540_REG_PWR
 
 
 /* POWER_MANAGEMENT (0x01) */
-#define NAU8540_ADC4_EN                (0x1 << 3)
-#define NAU8540_ADC3_EN                (0x1 << 2)
-#define NAU8540_ADC2_EN                (0x1 << 1)
-#define NAU8540_ADC1_EN                0x1
+#define NAU8540_ADC4_EN         (0x1 << 3)
+#define NAU8540_ADC3_EN         (0x1 << 2)
+#define NAU8540_ADC2_EN         (0x1 << 1)
+#define NAU8540_ADC1_EN         0x1
 
 /* CLOCK_CTRL (0x02) */
-#define NAU8540_CLK_ADC_EN             (0x1 << 15)
-#define NAU8540_CLK_I2S_EN             (0x1 << 1)
+#define NAU8540_CLK_ADC_EN              (0x1 << 15)
+#define NAU8540_CLK_I2S_EN              (0x1 << 1)
 
 /* CLOCK_SRC (0x03) */
-#define NAU8540_CLK_SRC_SFT            15
-#define NAU8540_CLK_SRC_MASK           (1 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_SRC_VCO            (1 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_SRC_MCLK           (0 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_ADC_SRC_SFT        6
-#define NAU8540_CLK_ADC_SRC_MASK       (0x3 << NAU8540_CLK_ADC_SRC_SFT)
-#define NAU8540_CLK_MCLK_SRC_MASK      0xf
+#define NAU8540_CLK_SRC_SFT             15
+#define NAU8540_CLK_SRC_MASK            (1 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_SRC_VCO             (1 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_SRC_MCLK            (0 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_ADC_SRC_SFT 6
+#define NAU8540_CLK_ADC_SRC_MASK        (0x3 << NAU8540_CLK_ADC_SRC_SFT)
+#define NAU8540_CLK_MCLK_SRC_MASK       0xf
 
 /* FLL1 (0x04) */
-#define NAU8540_FLL_RATIO_MASK 0x7f
+#define NAU8540_FLL_RATIO_MASK  0x7f
 
 /* FLL3 (0x06) */
-#define NAU8540_FLL_CLK_SRC_SFT        10
-#define NAU8540_FLL_CLK_SRC_MASK       (0x3 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_MCLK       (0 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_BLK        (0x2 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_FS         (0x3 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_INTEGER_MASK       0x3ff
+#define NAU8540_FLL_CLK_SRC_SFT 10
+#define NAU8540_FLL_CLK_SRC_MASK        (0x3 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_MCLK        (0 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_BLK (0x2 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_FS          (0x3 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_INTEGER_MASK        0x3ff
 
 /* FLL4 (0x07) */
-#define NAU8540_FLL_REF_DIV_SFT        10
-#define NAU8540_FLL_REF_DIV_MASK       (0x3 << NAU8540_FLL_REF_DIV_SFT)
+#define NAU8540_FLL_REF_DIV_SFT 10
+#define NAU8540_FLL_REF_DIV_MASK        (0x3 << NAU8540_FLL_REF_DIV_SFT)
 
 /* FLL5 (0x08) */
-#define NAU8540_FLL_PDB_DAC_EN (0x1 << 15)
-#define NAU8540_FLL_LOOP_FTR_EN        (0x1 << 14)
-#define NAU8540_FLL_CLK_SW_MASK        (0x1 << 13)
-#define NAU8540_FLL_CLK_SW_N2          (0x1 << 13)
-#define NAU8540_FLL_CLK_SW_REF (0x0 << 13)
-#define NAU8540_FLL_FTR_SW_MASK        (0x1 << 12)
-#define NAU8540_FLL_FTR_SW_ACCU        (0x1 << 12)
-#define NAU8540_FLL_FTR_SW_FILTER      (0x0 << 12)
+#define NAU8540_FLL_PDB_DAC_EN  (0x1 << 15)
+#define NAU8540_FLL_LOOP_FTR_EN (0x1 << 14)
+#define NAU8540_FLL_CLK_SW_MASK (0x1 << 13)
+#define NAU8540_FLL_CLK_SW_N2           (0x1 << 13)
+#define NAU8540_FLL_CLK_SW_REF  (0x0 << 13)
+#define NAU8540_FLL_FTR_SW_MASK (0x1 << 12)
+#define NAU8540_FLL_FTR_SW_ACCU (0x1 << 12)
+#define NAU8540_FLL_FTR_SW_FILTER       (0x0 << 12)
 
 /* FLL6 (0x9) */
-#define NAU8540_DCO_EN                 (0x1 << 15)
-#define NAU8540_SDM_EN                 (0x1 << 14)
+#define NAU8540_DCO_EN                  (0x1 << 15)
+#define NAU8540_SDM_EN                  (0x1 << 14)
 
 /* PCM_CTRL0 (0x10) */
-#define NAU8540_I2S_BP_SFT             7
-#define NAU8540_I2S_BP_INV             (0x1 << NAU8540_I2S_BP_SFT)
-#define NAU8540_I2S_PCMB_SFT           6
-#define NAU8540_I2S_PCMB_EN            (0x1 << NAU8540_I2S_PCMB_SFT)
-#define NAU8540_I2S_DL_SFT             2
-#define NAU8540_I2S_DL_MASK            (0x3 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_16              (0 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_20              (0x1 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_24              (0x2 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_32              (0x3 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DF_MASK            0x3
-#define NAU8540_I2S_DF_RIGTH           0
-#define NAU8540_I2S_DF_LEFT            0x1
-#define NAU8540_I2S_DF_I2S             0x2
-#define NAU8540_I2S_DF_PCM_AB          0x3
+#define NAU8540_I2S_BP_SFT              7
+#define NAU8540_I2S_BP_INV              (0x1 << NAU8540_I2S_BP_SFT)
+#define NAU8540_I2S_PCMB_SFT            6
+#define NAU8540_I2S_PCMB_EN             (0x1 << NAU8540_I2S_PCMB_SFT)
+#define NAU8540_I2S_DL_SFT              2
+#define NAU8540_I2S_DL_MASK             (0x3 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_16               (0 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_20               (0x1 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_24               (0x2 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_32               (0x3 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DF_MASK             0x3
+#define NAU8540_I2S_DF_RIGTH            0
+#define NAU8540_I2S_DF_LEFT             0x1
+#define NAU8540_I2S_DF_I2S              0x2
+#define NAU8540_I2S_DF_PCM_AB           0x3
 
 /* PCM_CTRL1 (0x11) */
-#define NAU8540_I2S_LRC_DIV_SFT        12
-#define NAU8540_I2S_LRC_DIV_MASK       (0x3 << NAU8540_I2S_LRC_DIV_SFT)
-#define NAU8540_I2S_DO12_OE            (0x1 << 4)
-#define NAU8540_I2S_MS_SFT             3
-#define NAU8540_I2S_MS_MASK            (0x1 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_MS_MASTER          (0x1 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_MS_SLAVE           (0x0 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_BLK_DIV_MASK       0x7
+#define NAU8540_I2S_LRC_DIV_SFT 12
+#define NAU8540_I2S_LRC_DIV_MASK        (0x3 << NAU8540_I2S_LRC_DIV_SFT)
+#define NAU8540_I2S_DO12_OE             (0x1 << 4)
+#define NAU8540_I2S_MS_SFT              3
+#define NAU8540_I2S_MS_MASK             (0x1 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_MS_MASTER           (0x1 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_MS_SLAVE            (0x0 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_BLK_DIV_MASK        0x7
 
 /* PCM_CTRL1 (0x12) */
-#define NAU8540_I2S_DO34_OE            (0x1 << 11)
-#define NAU8540_I2S_TSLOT_L_MASK       0x3ff
+#define NAU8540_I2S_DO34_OE             (0x1 << 11)
+#define NAU8540_I2S_TSLOT_L_MASK        0x3ff
 
 /* PCM_CTRL4 (0x14) */
-#define NAU8540_TDM_MODE               (0x1 << 15)
-#define NAU8540_TDM_OFFSET_EN          (0x1 << 14)
-#define NAU8540_TDM_TX_MASK            0xf
+#define NAU8540_TDM_MODE                (0x1 << 15)
+#define NAU8540_TDM_OFFSET_EN           (0x1 << 14)
+#define NAU8540_TDM_TX_MASK             0xf
 
 /* ADC_SAMPLE_RATE (0x3A) */
-#define NAU8540_ADC_OSR_MASK           0x3
-#define NAU8540_ADC_OSR_256            0x3
-#define NAU8540_ADC_OSR_128            0x2
-#define NAU8540_ADC_OSR_64             0x1
-#define NAU8540_ADC_OSR_32             0x0
+#define NAU8540_ADC_OSR_MASK            0x3
+#define NAU8540_ADC_OSR_256             0x3
+#define NAU8540_ADC_OSR_128             0x2
+#define NAU8540_ADC_OSR_64              0x1
+#define NAU8540_ADC_OSR_32              0x0
 
 /* VMID_CTRL (0x60) */
-#define NAU8540_VMID_EN                (1 << 6)
-#define NAU8540_VMID_SEL_SFT           4
-#define NAU8540_VMID_SEL_MASK          (0x3 << NAU8540_VMID_SEL_SFT)
+#define NAU8540_VMID_EN         (1 << 6)
+#define NAU8540_VMID_SEL_SFT            4
+#define NAU8540_VMID_SEL_MASK           (0x3 << NAU8540_VMID_SEL_SFT)
 
 /* MIC_BIAS (0x67) */
-#define NAU8540_PU_PRE                 (0x1 << 8)
+#define NAU8540_PU_PRE                  (0x1 << 8)
 
 /* REFERENCE (0x68) */
-#define NAU8540_PRECHARGE_DIS          (0x1 << 13)
-#define NAU8540_GLOBAL_BIAS_EN (0x1 << 12)
+#define NAU8540_PRECHARGE_DIS           (0x1 << 13)
+#define NAU8540_GLOBAL_BIAS_EN  (0x1 << 12)
 
 
 /* System Clock Source */
 enum {
-       NAU8540_CLK_DIS,
-       NAU8540_CLK_MCLK,
-       NAU8540_CLK_INTERNAL,
-       NAU8540_CLK_FLL_MCLK,
-       NAU8540_CLK_FLL_BLK,
-       NAU8540_CLK_FLL_FS,
+        NAU8540_CLK_DIS,
+        NAU8540_CLK_MCLK,
+        NAU8540_CLK_INTERNAL,
+        NAU8540_CLK_FLL_MCLK,
+        NAU8540_CLK_FLL_BLK,
+        NAU8540_CLK_FLL_FS,
 };
 
 struct nau8540 {
-       struct device *dev;
-       struct regmap *regmap;
+        struct device *dev;
+        struct regmap *regmap;
 };
 
 struct nau8540_fll {
-       int mclk_src;
-       int ratio;
-       int fll_frac;
-       int fll_int;
-       int clk_ref_div;
+        int mclk_src;
+        int ratio;
+        int fll_frac;
+        int fll_int;
+        int clk_ref_div;
 };
 
 struct nau8540_fll_attr {
-       unsigned int param;
-       unsigned int val;
+        unsigned int param;
+        unsigned int val;
 };
 
 /* over sampling rate */
 struct nau8540_osr_attr {
-       unsigned int osr;
-       unsigned int clk_src;
+        unsigned int osr;
+        unsigned int clk_src;
 };
 
 
-#endif /* __NAU8540_H__ */
+#endif  /* __NAU8540_H__ */
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
new file mode 100644
index 000000000000..cca974d26136
--- /dev/null
+++ b/sound/soc/codecs/nau8824.c
@@ -0,0 +1,1831 @@
+/*
+ * NAU88L24 ALSA SoC audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ * Author: John Hsu <KCHSU0@nuvoton.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/acpi.h>
+#include <linux/math64.h>
+#include <linux/semaphore.h>
+
+#include <sound/initval.h>
+#include <sound/tlv.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "nau8824.h"
+
+
+static int nau8824_config_sysclk(struct nau8824 *nau8824,
+        int clk_id, unsigned int freq);
+static bool nau8824_is_jack_inserted(struct nau8824 *nau8824);
+
+/* the ADC threshold of headset */
+#define DMIC_CLK 3072000
+
+/* the ADC threshold of headset */
+#define HEADSET_SARADC_THD 0x80
+
+/* the parameter threshold of FLL */
+#define NAU_FREF_MAX 13500000
+#define NAU_FVCO_MAX 124000000
+#define NAU_FVCO_MIN 90000000
+
+/* scaling for mclk from sysclk_src output */
+static const struct nau8824_fll_attr mclk_src_scaling[] = {
+        { 1, 0x0 },
+        { 2, 0x2 },
+        { 4, 0x3 },
+        { 8, 0x4 },
+        { 16, 0x5 },
+        { 32, 0x6 },
+        { 3, 0x7 },
+        { 6, 0xa },
+        { 12, 0xb },
+        { 24, 0xc },
+};
+
+/* ratio for input clk freq */
+static const struct nau8824_fll_attr fll_ratio[] = {
+        { 512000, 0x01 },
+        { 256000, 0x02 },
+        { 128000, 0x04 },
+        { 64000, 0x08 },
+        { 32000, 0x10 },
+        { 8000, 0x20 },
+        { 4000, 0x40 },
+};
+
+static const struct nau8824_fll_attr fll_pre_scalar[] = {
+        { 1, 0x0 },
+        { 2, 0x1 },
+        { 4, 0x2 },
+        { 8, 0x3 },
+};
+
+/* the maximum frequency of CLK_ADC and CLK_DAC */
+#define CLK_DA_AD_MAX 6144000
+
+/* over sampling rate */
+static const struct nau8824_osr_attr osr_dac_sel[] = {
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 0, 0 },
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+};
+
+static const struct nau8824_osr_attr osr_adc_sel[] = {
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
+};
+
+static const struct reg_default nau8824_reg_defaults[] = {
+        { NAU8824_REG_ENA_CTRL, 0x0000 },
+        { NAU8824_REG_CLK_GATING_ENA, 0x0000 },
+        { NAU8824_REG_CLK_DIVIDER, 0x0000 },
+        { NAU8824_REG_FLL1, 0x0000 },
+        { NAU8824_REG_FLL2, 0x3126 },
+        { NAU8824_REG_FLL3, 0x0008 },
+        { NAU8824_REG_FLL4, 0x0010 },
+        { NAU8824_REG_FLL5, 0xC000 },
+        { NAU8824_REG_FLL6, 0x6000 },
+        { NAU8824_REG_FLL_VCO_RSV, 0xF13C },
+        { NAU8824_REG_JACK_DET_CTRL, 0x0000 },
+        { NAU8824_REG_INTERRUPT_SETTING_1, 0x0000 },
+        { NAU8824_REG_IRQ, 0x0000 },
+        { NAU8824_REG_CLEAR_INT_REG, 0x0000 },
+        { NAU8824_REG_INTERRUPT_SETTING, 0x1000 },
+        { NAU8824_REG_SAR_ADC, 0x0015 },
+        { NAU8824_REG_VDET_COEFFICIENT, 0x0110 },
+        { NAU8824_REG_VDET_THRESHOLD_1, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_2, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_3, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_4, 0x0000 },
+        { NAU8824_REG_GPIO_SEL, 0x0000 },
+        { NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 0x000B },
+        { NAU8824_REG_PORT0_I2S_PCM_CTRL_2, 0x0010 },
+        { NAU8824_REG_PORT0_LEFT_TIME_SLOT, 0x0000 },
+        { NAU8824_REG_PORT0_RIGHT_TIME_SLOT, 0x0000 },
+        { NAU8824_REG_TDM_CTRL, 0x0000 },
+        { NAU8824_REG_ADC_HPF_FILTER, 0x0000 },
+        { NAU8824_REG_ADC_FILTER_CTRL, 0x0002 },
+        { NAU8824_REG_DAC_FILTER_CTRL_1, 0x0000 },
+        { NAU8824_REG_DAC_FILTER_CTRL_2, 0x0000 },
+        { NAU8824_REG_NOTCH_FILTER_1, 0x0000 },
+        { NAU8824_REG_NOTCH_FILTER_2, 0x0000 },
+        { NAU8824_REG_EQ1_LOW, 0x112C },
+        { NAU8824_REG_EQ2_EQ3, 0x2C2C },
+        { NAU8824_REG_EQ4_EQ5, 0x2C2C },
+        { NAU8824_REG_ADC_CH0_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH1_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH2_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH3_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_DAC_MUTE_CTRL, 0x0000 },
+        { NAU8824_REG_DAC_CH0_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_DAC_CH1_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_TO_DAC_ST, 0x0000 },
+        { NAU8824_REG_DRC_KNEE_IP12_ADC_CH01, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_ADC_CH01, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_ADC_CH01, 0x25FF },
+        { NAU8824_REG_DRC_ATKDCY_ADC_CH01, 0x3457 },
+        { NAU8824_REG_DRC_KNEE_IP12_ADC_CH23, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_ADC_CH23, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_ADC_CH23, 0x25FF },
+        { NAU8824_REG_DRC_ATKDCY_ADC_CH23, 0x3457 },
+        { NAU8824_REG_DRC_GAINL_ADC0, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC1, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC2, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC3, 0x0200 },
+        { NAU8824_REG_DRC_KNEE_IP12_DAC, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_DAC, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_DAC, 0x25F9 },
+        { NAU8824_REG_DRC_ATKDCY_DAC, 0x3457 },
+        { NAU8824_REG_DRC_GAIN_DAC_CH0, 0x0200 },
+        { NAU8824_REG_DRC_GAIN_DAC_CH1, 0x0200 },
+        { NAU8824_REG_MODE, 0x0000 },
+        { NAU8824_REG_MODE1, 0x0000 },
+        { NAU8824_REG_MODE2, 0x0000 },
+        { NAU8824_REG_CLASSG, 0x0000 },
+        { NAU8824_REG_OTP_EFUSE, 0x0000 },
+        { NAU8824_REG_OTPDOUT_1, 0x0000 },
+        { NAU8824_REG_OTPDOUT_2, 0x0000 },
+        { NAU8824_REG_MISC_CTRL, 0x0000 },
+        { NAU8824_REG_I2C_TIMEOUT, 0xEFFF },
+        { NAU8824_REG_TEST_MODE, 0x0000 },
+        { NAU8824_REG_I2C_DEVICE_ID, 0x1AF1 },
+        { NAU8824_REG_SAR_ADC_DATA_OUT, 0x00FF },
+        { NAU8824_REG_BIAS_ADJ, 0x0000 },
+        { NAU8824_REG_PGA_GAIN, 0x0000 },
+        { NAU8824_REG_TRIM_SETTINGS, 0x0000 },
+        { NAU8824_REG_ANALOG_CONTROL_1, 0x0000 },
+        { NAU8824_REG_ANALOG_CONTROL_2, 0x0000 },
+        { NAU8824_REG_ENABLE_LO, 0x0000 },
+        { NAU8824_REG_GAIN_LO, 0x0000 },
+        { NAU8824_REG_CLASSD_GAIN_1, 0x0000 },
+        { NAU8824_REG_CLASSD_GAIN_2, 0x0000 },
+        { NAU8824_REG_ANALOG_ADC_1, 0x0011 },
+        { NAU8824_REG_ANALOG_ADC_2, 0x0020 },
+        { NAU8824_REG_RDAC, 0x0008 },
+        { NAU8824_REG_MIC_BIAS, 0x0006 },
+        { NAU8824_REG_HS_VOLUME_CONTROL, 0x0000 },
+        { NAU8824_REG_BOOST, 0x0000 },
+        { NAU8824_REG_FEPGA, 0x0000 },
+        { NAU8824_REG_FEPGA_II, 0x0000 },
+        { NAU8824_REG_FEPGA_SE, 0x0000 },
+        { NAU8824_REG_FEPGA_ATTENUATION, 0x0000 },
+        { NAU8824_REG_ATT_PORT0, 0x0000 },
+        { NAU8824_REG_ATT_PORT1, 0x0000 },
+        { NAU8824_REG_POWER_UP_CONTROL, 0x0000 },
+        { NAU8824_REG_CHARGE_PUMP_CONTROL, 0x0300 },
+        { NAU8824_REG_CHARGE_PUMP_INPUT, 0x0013 },
+};
+
+static int nau8824_sema_acquire(struct nau8824 *nau8824, long timeout)
+{
+        int ret;
+
+        if (timeout) {
+                ret = down_timeout(&nau8824->jd_sem, timeout);
+                if (ret < 0)
+                        dev_warn(nau8824->dev, "Acquire semaphone timeout\n");
+        } else {
+                ret = down_interruptible(&nau8824->jd_sem);
+                if (ret < 0)
+                        dev_warn(nau8824->dev, "Acquire semaphone fail\n");
+        }
+
+        return ret;
+}
+
+static inline void nau8824_sema_release(struct nau8824 *nau8824)
+{
+        up(&nau8824->jd_sem);
+}
+
+static bool nau8824_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_ENA_CTRL ... NAU8824_REG_FLL_VCO_RSV:
+        case NAU8824_REG_JACK_DET_CTRL:
+        case NAU8824_REG_INTERRUPT_SETTING_1:
+        case NAU8824_REG_IRQ:
+        case NAU8824_REG_CLEAR_INT_REG ... NAU8824_REG_VDET_THRESHOLD_4:
+        case NAU8824_REG_GPIO_SEL:
+        case NAU8824_REG_PORT0_I2S_PCM_CTRL_1 ... NAU8824_REG_TDM_CTRL:
+        case NAU8824_REG_ADC_HPF_FILTER ... NAU8824_REG_EQ4_EQ5:
+        case NAU8824_REG_ADC_CH0_DGAIN_CTRL ... NAU8824_REG_ADC_TO_DAC_ST:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH01 ... NAU8824_REG_DRC_GAINL_ADC3:
+        case NAU8824_REG_DRC_KNEE_IP12_DAC ... NAU8824_REG_DRC_GAIN_DAC_CH1:
+        case NAU8824_REG_CLASSG ... NAU8824_REG_OTP_EFUSE:
+        case NAU8824_REG_OTPDOUT_1 ... NAU8824_REG_OTPDOUT_2:
+        case NAU8824_REG_I2C_TIMEOUT:
+        case NAU8824_REG_I2C_DEVICE_ID ... NAU8824_REG_SAR_ADC_DATA_OUT:
+        case NAU8824_REG_BIAS_ADJ ... NAU8824_REG_CLASSD_GAIN_2:
+        case NAU8824_REG_ANALOG_ADC_1 ... NAU8824_REG_ATT_PORT1:
+        case NAU8824_REG_POWER_UP_CONTROL ... NAU8824_REG_CHARGE_PUMP_INPUT:
+                return true;
+        default:
+                return false;
+        }
+
+}
+
+static bool nau8824_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_RESET ... NAU8824_REG_FLL_VCO_RSV:
+        case NAU8824_REG_JACK_DET_CTRL:
+        case NAU8824_REG_INTERRUPT_SETTING_1:
+        case NAU8824_REG_CLEAR_INT_REG ... NAU8824_REG_VDET_THRESHOLD_4:
+        case NAU8824_REG_GPIO_SEL:
+        case NAU8824_REG_PORT0_I2S_PCM_CTRL_1 ... NAU8824_REG_TDM_CTRL:
+        case NAU8824_REG_ADC_HPF_FILTER ... NAU8824_REG_EQ4_EQ5:
+        case NAU8824_REG_ADC_CH0_DGAIN_CTRL ... NAU8824_REG_ADC_TO_DAC_ST:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH01:
+        case NAU8824_REG_DRC_KNEE_IP34_ADC_CH01:
+        case NAU8824_REG_DRC_SLOPE_ADC_CH01:
+        case NAU8824_REG_DRC_ATKDCY_ADC_CH01:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH23:
+        case NAU8824_REG_DRC_KNEE_IP34_ADC_CH23:
+        case NAU8824_REG_DRC_SLOPE_ADC_CH23:
+        case NAU8824_REG_DRC_ATKDCY_ADC_CH23:
+        case NAU8824_REG_DRC_KNEE_IP12_DAC ... NAU8824_REG_DRC_ATKDCY_DAC:
+        case NAU8824_REG_CLASSG ... NAU8824_REG_OTP_EFUSE:
+        case NAU8824_REG_I2C_TIMEOUT:
+        case NAU8824_REG_BIAS_ADJ ... NAU8824_REG_CLASSD_GAIN_2:
+        case NAU8824_REG_ANALOG_ADC_1 ... NAU8824_REG_ATT_PORT1:
+        case NAU8824_REG_POWER_UP_CONTROL ... NAU8824_REG_CHARGE_PUMP_CONTROL:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool nau8824_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_RESET:
+        case NAU8824_REG_IRQ ... NAU8824_REG_CLEAR_INT_REG:
+        case NAU8824_REG_DRC_GAINL_ADC0 ... NAU8824_REG_DRC_GAINL_ADC3:
+        case NAU8824_REG_DRC_GAIN_DAC_CH0 ... NAU8824_REG_DRC_GAIN_DAC_CH1:
+        case NAU8824_REG_OTPDOUT_1 ... NAU8824_REG_OTPDOUT_2:
+        case NAU8824_REG_I2C_DEVICE_ID ... NAU8824_REG_SAR_ADC_DATA_OUT:
+        case NAU8824_REG_CHARGE_PUMP_INPUT:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const char * const nau8824_companding[] = {
+        "Off", "NC", "u-law", "A-law" };
+
+static const struct soc_enum nau8824_companding_adc_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 12,
+                ARRAY_SIZE(nau8824_companding), nau8824_companding);
+
+static const struct soc_enum nau8824_companding_dac_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 14,
+                ARRAY_SIZE(nau8824_companding), nau8824_companding);
+
+static const char * const nau8824_adc_decimation[] = {
+        "32", "64", "128", "256" };
+
+static const struct soc_enum nau8824_adc_decimation_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_FILTER_CTRL, 0,
+                ARRAY_SIZE(nau8824_adc_decimation), nau8824_adc_decimation);
+
+static const char * const nau8824_dac_oversampl[] = {
+        "64", "256", "128", "", "32" };
+
+static const struct soc_enum nau8824_dac_oversampl_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_DAC_FILTER_CTRL_1, 0,
+                ARRAY_SIZE(nau8824_dac_oversampl), nau8824_dac_oversampl);
+
+static const char * const nau8824_input_channel[] = {
+        "Input CH0", "Input CH1", "Input CH2", "Input CH3" };
+
+static const struct soc_enum nau8824_adc_ch0_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH0_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch1_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH1_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch2_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH2_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch3_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH3_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const char * const nau8824_tdm_slot[] = {
+        "Slot 0", "Slot 1", "Slot 2", "Slot 3" };
+
+static const struct soc_enum nau8824_dac_left_sel_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_TDM_CTRL, 6,
+                ARRAY_SIZE(nau8824_tdm_slot), nau8824_tdm_slot);
+
+static const struct soc_enum nau8824_dac_right_sel_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_TDM_CTRL, 4,
+                ARRAY_SIZE(nau8824_tdm_slot), nau8824_tdm_slot);
+
+static const DECLARE_TLV_DB_MINMAX_MUTE(spk_vol_tlv, 0, 2400);
+static const DECLARE_TLV_DB_MINMAX(hp_vol_tlv, -3000, 0);
+static const DECLARE_TLV_DB_SCALE(mic_vol_tlv, 0, 200, 0);
+static const DECLARE_TLV_DB_SCALE(dmic_vol_tlv, -12800, 50, 0);
+
+static const struct snd_kcontrol_new nau8824_snd_controls[] = {
+        SOC_ENUM("ADC Companding", nau8824_companding_adc_enum),
+        SOC_ENUM("DAC Companding", nau8824_companding_dac_enum),
+
+        SOC_ENUM("ADC Decimation Rate", nau8824_adc_decimation_enum),
+        SOC_ENUM("DAC Oversampling Rate", nau8824_dac_oversampl_enum),
+
+        SOC_SINGLE_TLV("Speaker Right DACR Volume",
+                NAU8824_REG_CLASSD_GAIN_1, 8, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Left DACL Volume",
+                NAU8824_REG_CLASSD_GAIN_2, 0, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Left DACR Volume",
+                NAU8824_REG_CLASSD_GAIN_1, 0, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Right DACL Volume",
+                NAU8824_REG_CLASSD_GAIN_2, 8, 0x1f, 0, spk_vol_tlv),
+
+        SOC_SINGLE_TLV("Headphone Right DACR Volume",
+                NAU8824_REG_ATT_PORT0, 8, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Left DACL Volume",
+                NAU8824_REG_ATT_PORT0, 0, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Right DACL Volume",
+                NAU8824_REG_ATT_PORT1, 8, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Left DACR Volume",
+                NAU8824_REG_ATT_PORT1, 0, 0x1f, 0, hp_vol_tlv),
+
+        SOC_SINGLE_TLV("MIC1 Volume", NAU8824_REG_FEPGA_II,
+                NAU8824_FEPGA_GAINL_SFT, 0x12, 0, mic_vol_tlv),
+        SOC_SINGLE_TLV("MIC2 Volume", NAU8824_REG_FEPGA_II,
+                NAU8824_FEPGA_GAINR_SFT, 0x12, 0, mic_vol_tlv),
+
+        SOC_SINGLE_TLV("DMIC1 Volume", NAU8824_REG_ADC_CH0_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC2 Volume", NAU8824_REG_ADC_CH1_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC3 Volume", NAU8824_REG_ADC_CH2_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC4 Volume", NAU8824_REG_ADC_CH3_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+
+        SOC_ENUM("ADC CH0 Select", nau8824_adc_ch0_enum),
+        SOC_ENUM("ADC CH1 Select", nau8824_adc_ch1_enum),
+        SOC_ENUM("ADC CH2 Select", nau8824_adc_ch2_enum),
+        SOC_ENUM("ADC CH3 Select", nau8824_adc_ch3_enum),
+
+        SOC_SINGLE("ADC CH0 TX Switch", NAU8824_REG_TDM_CTRL, 0, 1, 0),
+        SOC_SINGLE("ADC CH1 TX Switch", NAU8824_REG_TDM_CTRL, 1, 1, 0),
+        SOC_SINGLE("ADC CH2 TX Switch", NAU8824_REG_TDM_CTRL, 2, 1, 0),
+        SOC_SINGLE("ADC CH3 TX Switch", NAU8824_REG_TDM_CTRL, 3, 1, 0),
+
+        SOC_ENUM("DACL Channel Source", nau8824_dac_left_sel_enum),
+        SOC_ENUM("DACR Channel Source", nau8824_dac_right_sel_enum),
+
+        SOC_SINGLE("DACL LR Mix", NAU8824_REG_DAC_MUTE_CTRL, 0, 1, 0),
+        SOC_SINGLE("DACR LR Mix", NAU8824_REG_DAC_MUTE_CTRL, 1, 1, 0),
+};
+
+static int nau8824_output_dac_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                /* Disables the TESTDAC to let DAC signal pass through. */
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENABLE_LO,
+                        NAU8824_TEST_DAC_EN, 0);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENABLE_LO,
+                        NAU8824_TEST_DAC_EN, NAU8824_TEST_DAC_EN);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_spk_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_ANALOG_CONTROL_2,
+                        NAU8824_CLASSD_CLAMP_DIS, NAU8824_CLASSD_CLAMP_DIS);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_ANALOG_CONTROL_2,
+                        NAU8824_CLASSD_CLAMP_DIS, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_pump_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                /* Prevent startup click by letting charge pump to ramp up */
+                msleep(10);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_CHARGE_PUMP_CONTROL,
+                        NAU8824_JAMNODCLOW, NAU8824_JAMNODCLOW);
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_CHARGE_PUMP_CONTROL,
+                        NAU8824_JAMNODCLOW, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int system_clock_control(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *k, int  event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        if (SND_SOC_DAPM_EVENT_OFF(event)) {
+                /* Set clock source to disable or internal clock before the
+                 * playback or capture end. Codec needs clock for Jack
+                 * detection and button press if jack inserted; otherwise,
+                 * the clock should be closed.
+                 */
+                if (nau8824_is_jack_inserted(nau8824)) {
+                        nau8824_config_sysclk(nau8824,
+                                NAU8824_CLK_INTERNAL, 0);
+                } else {
+                        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+                }
+        }
+        return 0;
+}
+
+static int dmic_clock_control(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *k, int  event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        int src;
+
+        /* The DMIC clock is gotten from system clock (256fs) divided by
+         * DMIC_SRC (1, 2, 4, 8, 16, 32). The clock has to be equal or
+         * less than 3.072 MHz.
+         */
+        for (src = 0; src < 5; src++) {
+                if ((0x1 << (8 - src)) * nau8824->fs <= DMIC_CLK)
+                        break;
+        }
+        dev_dbg(nau8824->dev, "dmic src %d for mclk %d\n", src, nau8824->fs * 256);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_DMIC_SRC_MASK, (src << NAU8824_CLK_DMIC_SRC_SFT));
+
+        return 0;
+}
+
+static const struct snd_kcontrol_new nau8824_adc_ch0_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH0_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch1_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH1_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch2_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH2_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch3_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH3_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_left_mixer[] = {
+        SOC_DAPM_SINGLE("MIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_MIC1_SFT, 1, 0),
+        SOC_DAPM_SINGLE("HSMIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_HSMIC_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_adc_right_mixer[] = {
+        SOC_DAPM_SINGLE("MIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODER_MIC2_SFT, 1, 0),
+        SOC_DAPM_SINGLE("HSMIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODER_HSMIC_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_hp_left_mixer[] = {
+        SOC_DAPM_SINGLE("DAC Right Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPL_EN_SFT, 1, 0),
+        SOC_DAPM_SINGLE("DAC Left Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACL_HPL_EN_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_hp_right_mixer[] = {
+        SOC_DAPM_SINGLE("DAC Left Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACL_HPR_EN_SFT, 1, 0),
+        SOC_DAPM_SINGLE("DAC Right Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPR_EN_SFT, 1, 0),
+};
+
+static const char * const nau8824_dac_src[] = { "DACL", "DACR" };
+
+static SOC_ENUM_SINGLE_DECL(
+        nau8824_dacl_enum, NAU8824_REG_DAC_CH0_DGAIN_CTRL,
+        NAU8824_DAC_CH0_SEL_SFT, nau8824_dac_src);
+
+static SOC_ENUM_SINGLE_DECL(
+        nau8824_dacr_enum, NAU8824_REG_DAC_CH1_DGAIN_CTRL,
+        NAU8824_DAC_CH1_SEL_SFT, nau8824_dac_src);
+
+static const struct snd_kcontrol_new nau8824_dacl_mux =
+        SOC_DAPM_ENUM("DACL Source", nau8824_dacl_enum);
+
+static const struct snd_kcontrol_new nau8824_dacr_mux =
+        SOC_DAPM_ENUM("DACR Source", nau8824_dacr_enum);
+
+
+static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("System Clock", SND_SOC_NOPM, 0, 0,
+                        system_clock_control, SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_INPUT("HSMIC1"),
+        SND_SOC_DAPM_INPUT("HSMIC2"),
+        SND_SOC_DAPM_INPUT("MIC1"),
+        SND_SOC_DAPM_INPUT("MIC2"),
+        SND_SOC_DAPM_INPUT("DMIC1"),
+        SND_SOC_DAPM_INPUT("DMIC2"),
+        SND_SOC_DAPM_INPUT("DMIC3"),
+        SND_SOC_DAPM_INPUT("DMIC4"),
+
+        SND_SOC_DAPM_SUPPLY("SAR", NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_ADC_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS", NAU8824_REG_MIC_BIAS,
+                NAU8824_MICBIAS_POWERUP_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC12 Power", NAU8824_REG_BIAS_ADJ,
+                NAU8824_DMIC1_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC34 Power", NAU8824_REG_BIAS_ADJ,
+                NAU8824_DMIC2_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC Clock", SND_SOC_NOPM, 0, 0,
+                dmic_clock_control, SND_SOC_DAPM_POST_PMU),
+
+        SND_SOC_DAPM_SWITCH("DMIC1 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch0_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC2 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch1_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC3 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch2_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC4 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch3_dmic),
+
+        SND_SOC_DAPM_MIXER("Left ADC", NAU8824_REG_POWER_UP_CONTROL,
+                12, 0, nau8824_adc_left_mixer,
+                ARRAY_SIZE(nau8824_adc_left_mixer)),
+        SND_SOC_DAPM_MIXER("Right ADC", NAU8824_REG_POWER_UP_CONTROL,
+                13, 0, nau8824_adc_right_mixer,
+                ARRAY_SIZE(nau8824_adc_right_mixer)),
+
+        SND_SOC_DAPM_ADC("ADCL", NULL, NAU8824_REG_ANALOG_ADC_2,
+                NAU8824_ADCL_EN_SFT, 0),
+        SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+                NAU8824_ADCR_EN_SFT, 0),
+
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+
+        SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+                NAU8824_DACL_EN_SFT, 0),
+        SND_SOC_DAPM_SUPPLY("DACL Clock", NAU8824_REG_RDAC,
+                NAU8824_DACL_CLK_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_DAC("DACR", NULL, NAU8824_REG_RDAC,
+                NAU8824_DACR_EN_SFT, 0),
+        SND_SOC_DAPM_SUPPLY("DACR Clock", NAU8824_REG_RDAC,
+                NAU8824_DACR_CLK_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_MUX("DACL Mux", SND_SOC_NOPM, 0, 0, &nau8824_dacl_mux),
+        SND_SOC_DAPM_MUX("DACR Mux", SND_SOC_NOPM, 0, 0, &nau8824_dacr_mux),
+
+        SND_SOC_DAPM_PGA_S("Output DACL", 0, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                8, 1, nau8824_output_dac_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_PGA_S("Output DACR", 0, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                9, 1, nau8824_output_dac_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_PGA_S("ClassD", 0, NAU8824_REG_CLASSD_GAIN_1,
+                NAU8824_CLASSD_EN_SFT, 0, nau8824_spk_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_MIXER("Left Headphone", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_LDAC_EN_SFT, 0, nau8824_hp_left_mixer,
+                ARRAY_SIZE(nau8824_hp_left_mixer)),
+        SND_SOC_DAPM_MIXER("Right Headphone", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_RDAC_EN_SFT, 0, nau8824_hp_right_mixer,
+                ARRAY_SIZE(nau8824_hp_right_mixer)),
+        SND_SOC_DAPM_PGA_S("Charge Pump", 1, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                NAU8824_CHARGE_PUMP_EN_SFT, 0, nau8824_pump_event,
+                SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+        SND_SOC_DAPM_PGA("Output Driver L",
+                NAU8824_REG_POWER_UP_CONTROL, 3, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Output Driver R",
+                NAU8824_REG_POWER_UP_CONTROL, 2, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Main Driver L",
+                NAU8824_REG_POWER_UP_CONTROL, 1, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Main Driver R",
+                NAU8824_REG_POWER_UP_CONTROL, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("HP Boost Driver", NAU8824_REG_BOOST,
+                NAU8824_HP_BOOST_DIS_SFT, 1, NULL, 0),
+        SND_SOC_DAPM_PGA("Class G", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_EN_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_OUTPUT("SPKOUTL"),
+        SND_SOC_DAPM_OUTPUT("SPKOUTR"),
+        SND_SOC_DAPM_OUTPUT("HPOL"),
+        SND_SOC_DAPM_OUTPUT("HPOR"),
+};
+
+static const struct snd_soc_dapm_route nau8824_dapm_routes[] = {
+        {"DMIC1 Enable", "Switch", "DMIC1"},
+        {"DMIC2 Enable", "Switch", "DMIC2"},
+        {"DMIC3 Enable", "Switch", "DMIC3"},
+        {"DMIC4 Enable", "Switch", "DMIC4"},
+
+        {"DMIC1", NULL, "DMIC12 Power"},
+        {"DMIC2", NULL, "DMIC12 Power"},
+        {"DMIC3", NULL, "DMIC34 Power"},
+        {"DMIC4", NULL, "DMIC34 Power"},
+        {"DMIC12 Power", NULL, "DMIC Clock"},
+        {"DMIC34 Power", NULL, "DMIC Clock"},
+
+        {"Left ADC", "MIC Switch", "MIC1"},
+        {"Left ADC", "HSMIC Switch", "HSMIC1"},
+        {"Right ADC", "MIC Switch", "MIC2"},
+        {"Right ADC", "HSMIC Switch", "HSMIC2"},
+
+        {"ADCL", NULL, "Left ADC"},
+        {"ADCR", NULL, "Right ADC"},
+
+        {"AIFTX", NULL, "MICBIAS"},
+        {"AIFTX", NULL, "ADCL"},
+        {"AIFTX", NULL, "ADCR"},
+        {"AIFTX", NULL, "DMIC1 Enable"},
+        {"AIFTX", NULL, "DMIC2 Enable"},
+        {"AIFTX", NULL, "DMIC3 Enable"},
+        {"AIFTX", NULL, "DMIC4 Enable"},
+
+        {"AIFTX", NULL, "System Clock"},
+        {"AIFRX", NULL, "System Clock"},
+
+        {"DACL", NULL, "AIFRX"},
+        {"DACL", NULL, "DACL Clock"},
+        {"DACR", NULL, "AIFRX"},
+        {"DACR", NULL, "DACR Clock"},
+
+        {"DACL Mux", "DACL", "DACL"},
+        {"DACL Mux", "DACR", "DACR"},
+        {"DACR Mux", "DACL", "DACL"},
+        {"DACR Mux", "DACR", "DACR"},
+
+        {"Output DACL", NULL, "DACL Mux"},
+        {"Output DACR", NULL, "DACR Mux"},
+
+        {"ClassD", NULL, "Output DACL"},
+        {"ClassD", NULL, "Output DACR"},
+
+        {"Left Headphone", "DAC Left Switch", "Output DACL"},
+        {"Left Headphone", "DAC Right Switch", "Output DACR"},
+        {"Right Headphone", "DAC Left Switch", "Output DACL"},
+        {"Right Headphone", "DAC Right Switch", "Output DACR"},
+
+        {"Charge Pump", NULL, "Left Headphone"},
+        {"Charge Pump", NULL, "Right Headphone"},
+        {"Output Driver L", NULL, "Charge Pump"},
+        {"Output Driver R", NULL, "Charge Pump"},
+        {"Main Driver L", NULL, "Output Driver L"},
+        {"Main Driver R", NULL, "Output Driver R"},
+        {"Class G", NULL, "Main Driver L"},
+        {"Class G", NULL, "Main Driver R"},
+        {"HP Boost Driver", NULL, "Class G"},
+
+        {"SPKOUTL", NULL, "ClassD"},
+        {"SPKOUTR", NULL, "ClassD"},
+        {"HPOL", NULL, "HP Boost Driver"},
+        {"HPOR", NULL, "HP Boost Driver"},
+};
+
+static bool nau8824_is_jack_inserted(struct nau8824 *nau8824)
+{
+        struct snd_soc_jack *jack = nau8824->jack;
+        bool insert = FALSE;
+
+        if (nau8824->irq && jack)
+                insert = jack->status & SND_JACK_HEADPHONE;
+
+        return insert;
+}
+
+static void nau8824_int_status_clear_all(struct regmap *regmap)
+{
+        int active_irq, clear_irq, i;
+
+        /* Reset the intrruption status from rightmost bit if the corres-
+         * ponding irq event occurs.
+         */
+        regmap_read(regmap, NAU8824_REG_IRQ, &active_irq);
+        for (i = 0; i < NAU8824_REG_DATA_LEN; i++) {
+                clear_irq = (0x1 << i);
+                if (active_irq & clear_irq)
+                        regmap_write(regmap,
+                                NAU8824_REG_CLEAR_INT_REG, clear_irq);
+        }
+}
+
+static void nau8824_eject_jack(struct nau8824 *nau8824)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Clear all interruption status */
+        nau8824_int_status_clear_all(regmap);
+
+        snd_soc_dapm_disable_pin(dapm, "SAR");
+        snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+        snd_soc_dapm_sync(dapm);
+
+        /* Enable the insertion interruption, disable the ejection
+         * interruption, and then bypass de-bounce circuit.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING,
+                NAU8824_IRQ_KEY_RELEASE_DIS | NAU8824_IRQ_KEY_SHORT_PRESS_DIS |
+                NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_INSERT_DIS,
+                NAU8824_IRQ_KEY_RELEASE_DIS | NAU8824_IRQ_KEY_SHORT_PRESS_DIS |
+                NAU8824_IRQ_EJECT_DIS);
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_INSERT_EN | NAU8824_IRQ_EJECT_EN,
+                NAU8824_IRQ_INSERT_EN);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+
+        /* Close clock for jack type detection at manual mode */
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+}
+
+static void nau8824_jdet_work(struct work_struct *work)
+{
+        struct nau8824 *nau8824 = container_of(
+                work, struct nau8824, jdet_work);
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        struct regmap *regmap = nau8824->regmap;
+        int adc_value, event = 0, event_mask = 0;
+
+        snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+        snd_soc_dapm_force_enable_pin(dapm, "SAR");
+        snd_soc_dapm_sync(dapm);
+
+        msleep(100);
+
+        regmap_read(regmap, NAU8824_REG_SAR_ADC_DATA_OUT, &adc_value);
+        adc_value = adc_value & NAU8824_SAR_ADC_DATA_MASK;
+        dev_dbg(nau8824->dev, "SAR ADC data 0x%02x\n", adc_value);
+        if (adc_value < HEADSET_SARADC_THD) {
+                event |= SND_JACK_HEADPHONE;
+
+                snd_soc_dapm_disable_pin(dapm, "SAR");
+                snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+                snd_soc_dapm_sync(dapm);
+        } else {
+                event |= SND_JACK_HEADSET;
+        }
+        event_mask |= SND_JACK_HEADSET;
+        snd_soc_jack_report(nau8824->jack, event, event_mask);
+
+        nau8824_sema_release(nau8824);
+}
+
+static void nau8824_setup_auto_irq(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Enable jack ejection, short key press and release interruption. */
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_INSERT_EN | NAU8824_IRQ_EJECT_EN,
+                NAU8824_IRQ_EJECT_EN);
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING,
+                NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_KEY_RELEASE_DIS |
+                NAU8824_IRQ_KEY_SHORT_PRESS_DIS, 0);
+        /* Enable internal VCO needed for interruptions */
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_INTERNAL, 0);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, 0);
+}
+
+static int nau8824_button_decode(int value)
+{
+        int buttons = 0;
+
+        /* The chip supports up to 8 buttons, but ALSA defines
+         * only 6 buttons.
+         */
+        if (value & BIT(0))
+                buttons |= SND_JACK_BTN_0;
+        if (value & BIT(1))
+                buttons |= SND_JACK_BTN_1;
+        if (value & BIT(2))
+                buttons |= SND_JACK_BTN_2;
+        if (value & BIT(3))
+                buttons |= SND_JACK_BTN_3;
+        if (value & BIT(4))
+                buttons |= SND_JACK_BTN_4;
+        if (value & BIT(5))
+                buttons |= SND_JACK_BTN_5;
+
+        return buttons;
+}
+
+#define NAU8824_BUTTONS (SND_JACK_BTN_0 | SND_JACK_BTN_1 | \
+                SND_JACK_BTN_2 | SND_JACK_BTN_3)
+
+static irqreturn_t nau8824_interrupt(int irq, void *data)
+{
+        struct nau8824 *nau8824 = (struct nau8824 *)data;
+        struct regmap *regmap = nau8824->regmap;
+        int active_irq, clear_irq = 0, event = 0, event_mask = 0;
+
+        if (regmap_read(regmap, NAU8824_REG_IRQ, &active_irq)) {
+                dev_err(nau8824->dev, "failed to read irq status\n");
+                return IRQ_NONE;
+        }
+        dev_dbg(nau8824->dev, "IRQ %x\n", active_irq);
+
+        if (active_irq & NAU8824_JACK_EJECTION_DETECTED) {
+                nau8824_eject_jack(nau8824);
+                event_mask |= SND_JACK_HEADSET;
+                clear_irq = NAU8824_JACK_EJECTION_DETECTED;
+                /* release semaphore held after resume,
+                 * and cancel jack detection
+                 */
+                nau8824_sema_release(nau8824);
+                cancel_work_sync(&nau8824->jdet_work);
+        } else if (active_irq & NAU8824_KEY_SHORT_PRESS_IRQ) {
+                int key_status, button_pressed;
+
+                regmap_read(regmap, NAU8824_REG_CLEAR_INT_REG,
+                        &key_status);
+
+                /* lower 8 bits of the register are for pressed keys */
+                button_pressed = nau8824_button_decode(key_status);
+
+                event |= button_pressed;
+                dev_dbg(nau8824->dev, "button %x pressed\n", event);
+                event_mask |= NAU8824_BUTTONS;
+                clear_irq = NAU8824_KEY_SHORT_PRESS_IRQ;
+        } else if (active_irq & NAU8824_KEY_RELEASE_IRQ) {
+                event_mask = NAU8824_BUTTONS;
+                clear_irq = NAU8824_KEY_RELEASE_IRQ;
+        } else if (active_irq & NAU8824_JACK_INSERTION_DETECTED) {
+                /* Turn off insertion interruption at manual mode */
+                regmap_update_bits(regmap,
+                        NAU8824_REG_INTERRUPT_SETTING,
+                        NAU8824_IRQ_INSERT_DIS,
+                        NAU8824_IRQ_INSERT_DIS);
+                regmap_update_bits(regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_INSERT_EN, 0);
+                /* detect microphone and jack type */
+                cancel_work_sync(&nau8824->jdet_work);
+                schedule_work(&nau8824->jdet_work);
+
+                /* Enable interruption for jack type detection at audo
+                 * mode which can detect microphone and jack type.
+                 */
+                nau8824_setup_auto_irq(nau8824);
+        }
+
+        if (!clear_irq)
+                clear_irq = active_irq;
+        /* clears the rightmost interruption */
+        regmap_write(regmap, NAU8824_REG_CLEAR_INT_REG, clear_irq);
+
+        if (event_mask)
+                snd_soc_jack_report(nau8824->jack, event, event_mask);
+
+        return IRQ_HANDLED;
+}
+
+static int nau8824_clock_check(struct nau8824 *nau8824,
+        int stream, int rate, int osr)
+{
+        int osrate;
+
+        if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                if (osr >= ARRAY_SIZE(osr_dac_sel))
+                        return -EINVAL;
+                osrate = osr_dac_sel[osr].osr;
+        } else {
+                if (osr >= ARRAY_SIZE(osr_adc_sel))
+                        return -EINVAL;
+                osrate = osr_adc_sel[osr].osr;
+        }
+
+        if (!osrate || rate * osr > CLK_DA_AD_MAX) {
+                dev_err(nau8824->dev, "exceed the maximum frequency of CLK_ADC or CLK_DAC\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div;
+
+        nau8824_sema_acquire(nau8824, HZ);
+
+        /* CLK_DAC or CLK_ADC = OSR * FS
+         * DAC or ADC clock frequency is defined as Over Sampling Rate (OSR)
+         * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
+         * values must be selected such that the maximum frequency is less
+         * than 6.144 MHz.
+         */
+        nau8824->fs = params_rate(params);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                regmap_read(nau8824->regmap,
+                        NAU8824_REG_DAC_FILTER_CTRL_1, &osr);
+                osr &= NAU8824_DAC_OVERSAMPLE_MASK;
+                if (nau8824_clock_check(nau8824, substream->stream,
+                        nau8824->fs, osr))
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_DAC_SRC_MASK,
+                        osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT);
+        } else {
+                regmap_read(nau8824->regmap,
+                        NAU8824_REG_ADC_FILTER_CTRL, &osr);
+                osr &= NAU8824_ADC_SYNC_DOWN_MASK;
+                if (nau8824_clock_check(nau8824, substream->stream,
+                        nau8824->fs, osr))
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_ADC_SRC_MASK,
+                        osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT);
+        }
+
+        /* make BCLK and LRC divde configuration if the codec as master. */
+        regmap_read(nau8824->regmap,
+                NAU8824_REG_PORT0_I2S_PCM_CTRL_2, &ctrl_val);
+        if (ctrl_val & NAU8824_I2S_MS_MASTER) {
+                /* get the bclk and fs ratio */
+                bclk_fs = snd_soc_params_to_bclk(params) / nau8824->fs;
+                if (bclk_fs <= 32)
+                        bclk_div = 0x3;
+                else if (bclk_fs <= 64)
+                        bclk_div = 0x2;
+                else if (bclk_fs <= 128)
+                        bclk_div = 0x1;
+                else if (bclk_fs <= 256)
+                        bclk_div = 0;
+                else
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+                        NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK,
+                        (bclk_div << NAU8824_I2S_LRC_DIV_SFT) | bclk_div);
+        }
+
+        switch (params_width(params)) {
+        case 16:
+                val_len |= NAU8824_I2S_DL_16;
+                break;
+        case 20:
+                val_len |= NAU8824_I2S_DL_20;
+                break;
+        case 24:
+                val_len |= NAU8824_I2S_DL_24;
+                break;
+        case 32:
+                val_len |= NAU8824_I2S_DL_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+                NAU8824_I2S_DL_MASK, val_len);
+
+        nau8824_sema_release(nau8824);
+
+        return 0;
+}
+
+static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl1_val = 0, ctrl2_val = 0;
+
+        nau8824_sema_acquire(nau8824, HZ);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                ctrl2_val |= NAU8824_I2S_MS_MASTER;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                ctrl1_val |= NAU8824_I2S_BP_INV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                ctrl1_val |= NAU8824_I2S_DF_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                ctrl1_val |= NAU8824_I2S_DF_LEFT;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                ctrl1_val |= NAU8824_I2S_DF_RIGTH;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                ctrl1_val |= NAU8824_I2S_DF_PCM_AB;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                ctrl1_val |= NAU8824_I2S_DF_PCM_AB;
+                ctrl1_val |= NAU8824_I2S_PCMB_EN;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+                NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK |
+                NAU8824_I2S_PCMB_EN, ctrl1_val);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+                NAU8824_I2S_MS_MASK, ctrl2_val);
+
+        nau8824_sema_release(nau8824);
+
+        return 0;
+}
+
+/**
+ * nau8824_calc_fll_param - Calculate FLL parameters.
+ * @fll_in: external clock provided to codec.
+ * @fs: sampling rate.
+ * @fll_param: Pointer to structure of FLL parameters.
+ *
+ * Calculate FLL parameters to configure codec.
+ *
+ * Returns 0 for success or negative error code.
+ */
+static int nau8824_calc_fll_param(unsigned int fll_in,
+        unsigned int fs, struct nau8824_fll *fll_param)
+{
+        u64 fvco, fvco_max;
+        unsigned int fref, i, fvco_sel;
+
+        /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
+         * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
+         * FREF = freq_in / NAU8824_FLL_REF_DIV_MASK
+         */
+        for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
+                fref = fll_in / fll_pre_scalar[i].param;
+                if (fref <= NAU_FREF_MAX)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_pre_scalar))
+                return -EINVAL;
+        fll_param->clk_ref_div = fll_pre_scalar[i].val;
+
+        /* Choose the FLL ratio based on FREF */
+        for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
+                if (fref >= fll_ratio[i].param)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_ratio))
+                return -EINVAL;
+        fll_param->ratio = fll_ratio[i].val;
+
+        /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
+         * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
+         * guaranteed across the full range of operation.
+         * FDCO = freq_out * 2 * mclk_src_scaling
+         */
+        fvco_max = 0;
+        fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+        for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+                fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
+                if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+                        fvco_max < fvco) {
+                        fvco_max = fvco;
+                        fvco_sel = i;
+                }
+        }
+        if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
+                return -EINVAL;
+        fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
+
+        /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
+         * input based on FDCO, FREF and FLL ratio.
+         */
+        fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
+        fll_param->fll_int = (fvco >> 16) & 0x3FF;
+        fll_param->fll_frac = fvco & 0xFFFF;
+        return 0;
+}
+
+static void nau8824_fll_apply(struct regmap *regmap,
+        struct nau8824_fll *fll_param)
+{
+        regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_SRC_MASK | NAU8824_CLK_MCLK_SRC_MASK,
+                NAU8824_CLK_SRC_MCLK | fll_param->mclk_src);
+        regmap_update_bits(regmap, NAU8824_REG_FLL1,
+                NAU8824_FLL_RATIO_MASK, fll_param->ratio);
+        /* FLL 16-bit fractional input */
+        regmap_write(regmap, NAU8824_REG_FLL2, fll_param->fll_frac);
+        /* FLL 10-bit integer input */
+        regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                NAU8824_FLL_INTEGER_MASK, fll_param->fll_int);
+        /* FLL pre-scaler */
+        regmap_update_bits(regmap, NAU8824_REG_FLL4,
+                NAU8824_FLL_REF_DIV_MASK,
+                fll_param->clk_ref_div << NAU8824_FLL_REF_DIV_SFT);
+        /* select divided VCO input */
+        regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                NAU8824_FLL_CLK_SW_MASK, NAU8824_FLL_CLK_SW_REF);
+        /* Disable free-running mode */
+        regmap_update_bits(regmap,
+                NAU8824_REG_FLL6, NAU8824_DCO_EN, 0);
+        if (fll_param->fll_frac) {
+                regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_MASK,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_FILTER);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_SDM_EN, NAU8824_SDM_EN);
+        } else {
+                regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_MASK, NAU8824_FLL_FTR_SW_ACCU);
+                regmap_update_bits(regmap,
+                        NAU8824_REG_FLL6, NAU8824_SDM_EN, 0);
+        }
+}
+
+/* freq_out must be 256*Fs in order to achieve the best performance */
+static int nau8824_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
+                unsigned int freq_in, unsigned int freq_out)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        struct nau8824_fll fll_param;
+        int ret, fs;
+
+        fs = freq_out / 256;
+        ret = nau8824_calc_fll_param(freq_in, fs, &fll_param);
+        if (ret < 0) {
+                dev_err(nau8824->dev, "Unsupported input clock %d\n", freq_in);
+                return ret;
+        }
+        dev_dbg(nau8824->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
+                fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
+                fll_param.fll_int, fll_param.clk_ref_div);
+
+        nau8824_fll_apply(nau8824->regmap, &fll_param);
+        mdelay(2);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_VCO);
+
+        return 0;
+}
+
+static int nau8824_config_sysclk(struct nau8824 *nau8824,
+        int clk_id, unsigned int freq)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        switch (clk_id) {
+        case NAU8824_CLK_DIS:
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_MCLK);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, 0);
+                break;
+
+        case NAU8824_CLK_MCLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_MCLK);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, 0);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_INTERNAL:
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, NAU8824_DCO_EN);
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_VCO);
+                break;
+
+        case NAU8824_CLK_FLL_MCLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_MCLK);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_FLL_BLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_BLK);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_FLL_FS:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_FS);
+                nau8824_sema_release(nau8824);
+                break;
+
+        default:
+                dev_err(nau8824->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+
+        dev_dbg(nau8824->dev, "Sysclk is %dHz and clock id is %d\n", freq,
+                clk_id);
+
+        return 0;
+}
+
+static int nau8824_set_sysclk(struct snd_soc_codec *codec,
+        int clk_id, int source, unsigned int freq, int dir)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        return nau8824_config_sysclk(nau8824, clk_id, freq);
+}
+
+static void nau8824_resume_setup(struct nau8824 *nau8824)
+{
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+        if (nau8824->irq) {
+                /* Clear all interruption status */
+                nau8824_int_status_clear_all(nau8824->regmap);
+                /* Enable jack detection at sleep mode, insertion detection,
+                 * and ejection detection.
+                 */
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENA_CTRL,
+                        NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING,
+                        NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_INSERT_DIS, 0);
+        }
+}
+
+static int nau8824_set_bias_level(struct snd_soc_codec *codec,
+        enum snd_soc_bias_level level)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (level) {
+        case SND_SOC_BIAS_ON:
+                break;
+
+        case SND_SOC_BIAS_PREPARE:
+                break;
+
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
+                        /* Setup codec configuration after resume */
+                        nau8824_resume_setup(nau8824);
+                }
+                break;
+
+        case SND_SOC_BIAS_OFF:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING, 0x3ff, 0x3ff);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN, 0);
+                break;
+        }
+
+        return 0;
+}
+
+static int nau8824_codec_probe(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+
+        nau8824->dapm = dapm;
+
+        return 0;
+}
+
+static int __maybe_unused nau8824_suspend(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        if (nau8824->irq) {
+                disable_irq(nau8824->irq);
+                snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_OFF);
+        }
+        regcache_cache_only(nau8824->regmap, true);
+        regcache_mark_dirty(nau8824->regmap);
+
+        return 0;
+}
+
+static int __maybe_unused nau8824_resume(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        regcache_cache_only(nau8824->regmap, false);
+        regcache_sync(nau8824->regmap);
+        if (nau8824->irq) {
+                /* Hold semaphore to postpone playback happening
+                 * until jack detection done.
+                 */
+                nau8824_sema_acquire(nau8824, 0);
+                enable_irq(nau8824->irq);
+        }
+
+        return 0;
+}
+
+static struct snd_soc_codec_driver nau8824_codec_driver = {
+        .probe = nau8824_codec_probe,
+        .set_sysclk = nau8824_set_sysclk,
+        .set_pll = nau8824_set_pll,
+        .set_bias_level = nau8824_set_bias_level,
+        .suspend = nau8824_suspend,
+        .resume = nau8824_resume,
+        .suspend_bias_off = true,
+
+        .component_driver = {
+                .controls = nau8824_snd_controls,
+                .num_controls = ARRAY_SIZE(nau8824_snd_controls),
+                .dapm_widgets = nau8824_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(nau8824_dapm_widgets),
+                .dapm_routes = nau8824_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(nau8824_dapm_routes),
+        },
+};
+
+static const struct snd_soc_dai_ops nau8824_dai_ops = {
+        .hw_params = nau8824_hw_params,
+        .set_fmt = nau8824_set_fmt,
+};
+
+#define NAU8824_RATES SNDRV_PCM_RATE_8000_192000
+#define NAU8824_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
+         | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+static struct snd_soc_dai_driver nau8824_dai = {
+        .name = NAU8824_CODEC_DAI,
+        .playback = {
+                .stream_name     = "Playback",
+                .channels_min    = 1,
+                .channels_max    = 2,
+                .rates           = NAU8824_RATES,
+                .formats         = NAU8824_FORMATS,
+        },
+        .capture = {
+                .stream_name     = "Capture",
+                .channels_min    = 1,
+                .channels_max    = 2,
+                .rates           = NAU8824_RATES,
+                .formats         = NAU8824_FORMATS,
+        },
+        .ops = &nau8824_dai_ops,
+};
+
+static const struct regmap_config nau8824_regmap_config = {
+        .val_bits = NAU8824_REG_ADDR_LEN,
+        .reg_bits = NAU8824_REG_DATA_LEN,
+
+        .max_register = NAU8824_REG_MAX,
+        .readable_reg = nau8824_readable_reg,
+        .writeable_reg = nau8824_writeable_reg,
+        .volatile_reg = nau8824_volatile_reg,
+
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = nau8824_reg_defaults,
+        .num_reg_defaults = ARRAY_SIZE(nau8824_reg_defaults),
+};
+
+/**
+ * nau8824_enable_jack_detect - Specify a jack for event reporting
+ *
+ * @component:  component to register the jack with
+ * @jack: jack to use to report headset and button events on
+ *
+ * After this function has been called the headset insert/remove and button
+ * events will be routed to the given jack.  Jack can be null to stop
+ * reporting.
+ */
+int nau8824_enable_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        int ret;
+
+        nau8824->jack = jack;
+        /* Initiate jack detection work queue */
+        INIT_WORK(&nau8824->jdet_work, nau8824_jdet_work);
+        ret = devm_request_threaded_irq(nau8824->dev, nau8824->irq, NULL,
+                nau8824_interrupt, IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+                "nau8824", nau8824);
+        if (ret) {
+                dev_err(nau8824->dev, "Cannot request irq %d (%d)\n",
+                        nau8824->irq, ret);
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nau8824_enable_jack_detect);
+
+static void nau8824_reset_chip(struct regmap *regmap)
+{
+        regmap_write(regmap, NAU8824_REG_RESET, 0x00);
+        regmap_write(regmap, NAU8824_REG_RESET, 0x00);
+}
+
+static void nau8824_setup_buttons(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_TRACKING_GAIN_MASK,
+                nau8824->sar_voltage << NAU8824_SAR_TRACKING_GAIN_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_COMPARE_TIME_MASK,
+                nau8824->sar_compare_time << NAU8824_SAR_COMPARE_TIME_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_SAMPLING_TIME_MASK,
+                nau8824->sar_sampling_time << NAU8824_SAR_SAMPLING_TIME_SFT);
+
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_LEVELS_NR_MASK,
+                (nau8824->sar_threshold_num - 1) << NAU8824_LEVELS_NR_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_HYSTERESIS_MASK,
+                nau8824->sar_hysteresis << NAU8824_HYSTERESIS_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_SHORTKEY_DEBOUNCE_MASK,
+                nau8824->key_debounce << NAU8824_SHORTKEY_DEBOUNCE_SFT);
+
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_1,
+                (nau8824->sar_threshold[0] << 8) | nau8824->sar_threshold[1]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_2,
+                (nau8824->sar_threshold[2] << 8) | nau8824->sar_threshold[3]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_3,
+                (nau8824->sar_threshold[4] << 8) | nau8824->sar_threshold[5]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_4,
+                (nau8824->sar_threshold[6] << 8) | nau8824->sar_threshold[7]);
+}
+
+static void nau8824_init_regs(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Enable Bias/VMID/VMID Tieoff */
+        regmap_update_bits(regmap, NAU8824_REG_BIAS_ADJ,
+                NAU8824_VMID | NAU8824_VMID_SEL_MASK, NAU8824_VMID |
+                (nau8824->vref_impedance << NAU8824_VMID_SEL_SFT));
+        regmap_update_bits(regmap, NAU8824_REG_BOOST,
+                NAU8824_GLOBAL_BIAS_EN, NAU8824_GLOBAL_BIAS_EN);
+        mdelay(2);
+        regmap_update_bits(regmap, NAU8824_REG_MIC_BIAS,
+                NAU8824_MICBIAS_VOLTAGE_MASK, nau8824->micbias_voltage);
+        /* Disable Boost Driver, Automatic Short circuit protection enable */
+        regmap_update_bits(regmap, NAU8824_REG_BOOST,
+                NAU8824_PRECHARGE_DIS | NAU8824_HP_BOOST_DIS |
+                NAU8824_HP_BOOST_G_DIS | NAU8824_SHORT_SHUTDOWN_EN,
+                NAU8824_PRECHARGE_DIS | NAU8824_HP_BOOST_DIS |
+                NAU8824_HP_BOOST_G_DIS | NAU8824_SHORT_SHUTDOWN_EN);
+        /* Scaling for ADC and DAC clock */
+        regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_ADC_SRC_MASK | NAU8824_CLK_DAC_SRC_MASK,
+                (0x1 << NAU8824_CLK_ADC_SRC_SFT) |
+                (0x1 << NAU8824_CLK_DAC_SRC_SFT));
+        regmap_update_bits(regmap, NAU8824_REG_DAC_MUTE_CTRL,
+                NAU8824_DAC_ZC_EN, NAU8824_DAC_ZC_EN);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_DAC_CH1_EN | NAU8824_DAC_CH0_EN |
+                NAU8824_ADC_CH0_EN | NAU8824_ADC_CH1_EN |
+                NAU8824_ADC_CH2_EN | NAU8824_ADC_CH3_EN,
+                NAU8824_DAC_CH1_EN | NAU8824_DAC_CH0_EN |
+                NAU8824_ADC_CH0_EN | NAU8824_ADC_CH1_EN |
+                NAU8824_ADC_CH2_EN | NAU8824_ADC_CH3_EN);
+        regmap_update_bits(regmap, NAU8824_REG_CLK_GATING_ENA,
+                NAU8824_CLK_ADC_CH23_EN | NAU8824_CLK_ADC_CH01_EN |
+                NAU8824_CLK_DAC_CH1_EN | NAU8824_CLK_DAC_CH0_EN |
+                NAU8824_CLK_I2S_EN | NAU8824_CLK_GAIN_EN |
+                NAU8824_CLK_SAR_EN | NAU8824_CLK_DMIC_CH23_EN,
+                NAU8824_CLK_ADC_CH23_EN | NAU8824_CLK_ADC_CH01_EN |
+                NAU8824_CLK_DAC_CH1_EN | NAU8824_CLK_DAC_CH0_EN |
+                NAU8824_CLK_I2S_EN | NAU8824_CLK_GAIN_EN |
+                NAU8824_CLK_SAR_EN | NAU8824_CLK_DMIC_CH23_EN);
+        /* Class G timer 64ms */
+        regmap_update_bits(regmap, NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_TIMER_MASK,
+                0x20 << NAU8824_CLASSG_TIMER_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_TRIM_SETTINGS,
+                NAU8824_DRV_CURR_INC, NAU8824_DRV_CURR_INC);
+        /* Disable DACR/L power */
+        regmap_update_bits(regmap, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                NAU8824_SPKR_PULL_DOWN | NAU8824_SPKL_PULL_DOWN |
+                NAU8824_POWER_DOWN_DACR | NAU8824_POWER_DOWN_DACL,
+                NAU8824_SPKR_PULL_DOWN | NAU8824_SPKL_PULL_DOWN |
+                NAU8824_POWER_DOWN_DACR | NAU8824_POWER_DOWN_DACL);
+        /* Enable TESTDAC. This sets the analog DAC inputs to a '0' input
+         * signal to avoid any glitches due to power up transients in both
+         * the analog and digital DAC circuit.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_ENABLE_LO,
+                NAU8824_TEST_DAC_EN, NAU8824_TEST_DAC_EN);
+        /* Config L/R channel */
+        regmap_update_bits(regmap, NAU8824_REG_DAC_CH0_DGAIN_CTRL,
+                NAU8824_DAC_CH0_SEL_MASK, NAU8824_DAC_CH0_SEL_I2S0);
+        regmap_update_bits(regmap, NAU8824_REG_DAC_CH1_DGAIN_CTRL,
+                NAU8824_DAC_CH1_SEL_MASK, NAU8824_DAC_CH1_SEL_I2S1);
+        regmap_update_bits(regmap, NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPR_EN | NAU8824_DACL_HPL_EN,
+                NAU8824_DACR_HPR_EN | NAU8824_DACL_HPL_EN);
+        /* Default oversampling/decimations settings are unusable
+         * (audible hiss). Set it to something better.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_ADC_FILTER_CTRL,
+                NAU8824_ADC_SYNC_DOWN_MASK, NAU8824_ADC_SYNC_DOWN_64);
+        regmap_update_bits(regmap, NAU8824_REG_DAC_FILTER_CTRL_1,
+                NAU8824_DAC_CICCLP_OFF | NAU8824_DAC_OVERSAMPLE_MASK,
+                NAU8824_DAC_CICCLP_OFF | NAU8824_DAC_OVERSAMPLE_64);
+        /* DAC clock delay 2ns, VREF */
+        regmap_update_bits(regmap, NAU8824_REG_RDAC,
+                NAU8824_RDAC_CLK_DELAY_MASK | NAU8824_RDAC_VREF_MASK,
+                (0x2 << NAU8824_RDAC_CLK_DELAY_SFT) |
+                (0x3 << NAU8824_RDAC_VREF_SFT));
+        /* PGA input mode selection */
+        regmap_update_bits(regmap, NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_SHORT_EN | NAU8824_FEPGA_MODER_SHORT_EN,
+                NAU8824_FEPGA_MODEL_SHORT_EN | NAU8824_FEPGA_MODER_SHORT_EN);
+        /* Digital microphone control */
+        regmap_update_bits(regmap, NAU8824_REG_ANALOG_CONTROL_1,
+                NAU8824_DMIC_CLK_DRV_STRG | NAU8824_DMIC_CLK_SLEW_FAST,
+                NAU8824_DMIC_CLK_DRV_STRG | NAU8824_DMIC_CLK_SLEW_FAST);
+        regmap_update_bits(regmap, NAU8824_REG_JACK_DET_CTRL,
+                NAU8824_JACK_LOGIC,
+                /* jkdet_polarity - 1  is for active-low */
+                nau8824->jkdet_polarity ? 0 : NAU8824_JACK_LOGIC);
+        regmap_update_bits(regmap,
+                NAU8824_REG_JACK_DET_CTRL, NAU8824_JACK_EJECT_DT_MASK,
+                (nau8824->jack_eject_debounce << NAU8824_JACK_EJECT_DT_SFT));
+        if (nau8824->sar_threshold_num)
+                nau8824_setup_buttons(nau8824);
+}
+
+static int nau8824_setup_irq(struct nau8824 *nau8824)
+{
+        /* Disable interruption before codec initiation done */
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+        regmap_update_bits(nau8824->regmap,
+                NAU8824_REG_INTERRUPT_SETTING, 0x3ff, 0x3ff);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN, 0);
+
+        return 0;
+}
+
+static void nau8824_print_device_properties(struct nau8824 *nau8824)
+{
+        struct device *dev = nau8824->dev;
+        int i;
+
+        dev_dbg(dev, "jkdet-polarity:       %d\n", nau8824->jkdet_polarity);
+        dev_dbg(dev, "micbias-voltage:      %d\n", nau8824->micbias_voltage);
+        dev_dbg(dev, "vref-impedance:       %d\n", nau8824->vref_impedance);
+
+        dev_dbg(dev, "sar-threshold-num:    %d\n", nau8824->sar_threshold_num);
+        for (i = 0; i < nau8824->sar_threshold_num; i++)
+                dev_dbg(dev, "sar-threshold[%d]=%x\n", i,
+                                nau8824->sar_threshold[i]);
+
+        dev_dbg(dev, "sar-hysteresis:       %d\n", nau8824->sar_hysteresis);
+        dev_dbg(dev, "sar-voltage:          %d\n", nau8824->sar_voltage);
+        dev_dbg(dev, "sar-compare-time:     %d\n", nau8824->sar_compare_time);
+        dev_dbg(dev, "sar-sampling-time:    %d\n", nau8824->sar_sampling_time);
+        dev_dbg(dev, "short-key-debounce:   %d\n", nau8824->key_debounce);
+        dev_dbg(dev, "jack-eject-debounce:  %d\n",
+                        nau8824->jack_eject_debounce);
+}
+
+static int nau8824_read_device_properties(struct device *dev,
+        struct nau8824 *nau8824) {
+        int ret;
+
+        ret = device_property_read_u32(dev, "nuvoton,jkdet-polarity",
+                &nau8824->jkdet_polarity);
+        if (ret)
+                nau8824->jkdet_polarity = 1;
+        ret = device_property_read_u32(dev, "nuvoton,micbias-voltage",
+                &nau8824->micbias_voltage);
+        if (ret)
+                nau8824->micbias_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,vref-impedance",
+                &nau8824->vref_impedance);
+        if (ret)
+                nau8824->vref_impedance = 2;
+        ret = device_property_read_u32(dev, "nuvoton,sar-threshold-num",
+                &nau8824->sar_threshold_num);
+        if (ret)
+                nau8824->sar_threshold_num = 4;
+        ret = device_property_read_u32_array(dev, "nuvoton,sar-threshold",
+                nau8824->sar_threshold, nau8824->sar_threshold_num);
+        if (ret) {
+                nau8824->sar_threshold[0] = 0x0a;
+                nau8824->sar_threshold[1] = 0x14;
+                nau8824->sar_threshold[2] = 0x26;
+                nau8824->sar_threshold[3] = 0x73;
+        }
+        ret = device_property_read_u32(dev, "nuvoton,sar-hysteresis",
+                &nau8824->sar_hysteresis);
+        if (ret)
+                nau8824->sar_hysteresis = 0;
+        ret = device_property_read_u32(dev, "nuvoton,sar-voltage",
+                &nau8824->sar_voltage);
+        if (ret)
+                nau8824->sar_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,sar-compare-time",
+                &nau8824->sar_compare_time);
+        if (ret)
+                nau8824->sar_compare_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,sar-sampling-time",
+                &nau8824->sar_sampling_time);
+        if (ret)
+                nau8824->sar_sampling_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,short-key-debounce",
+                &nau8824->key_debounce);
+        if (ret)
+                nau8824->key_debounce = 0;
+        ret = device_property_read_u32(dev, "nuvoton,jack-eject-debounce",
+                &nau8824->jack_eject_debounce);
+        if (ret)
+                nau8824->jack_eject_debounce = 1;
+
+        return 0;
+}
+
+static int nau8824_i2c_probe(struct i2c_client *i2c,
+        const struct i2c_device_id *id)
+{
+        struct device *dev = &i2c->dev;
+        struct nau8824 *nau8824 = dev_get_platdata(dev);
+        int ret, value;
+
+        if (!nau8824) {
+                nau8824 = devm_kzalloc(dev, sizeof(*nau8824), GFP_KERNEL);
+                if (!nau8824)
+                        return -ENOMEM;
+                ret = nau8824_read_device_properties(dev, nau8824);
+                if (ret)
+                        return ret;
+        }
+        i2c_set_clientdata(i2c, nau8824);
+
+        nau8824->regmap = devm_regmap_init_i2c(i2c, &nau8824_regmap_config);
+        if (IS_ERR(nau8824->regmap))
+                return PTR_ERR(nau8824->regmap);
+        nau8824->dev = dev;
+        nau8824->irq = i2c->irq;
+        sema_init(&nau8824->jd_sem, 1);
+
+        nau8824_print_device_properties(nau8824);
+
+        ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read device id from the NAU8824: %d\n",
+                        ret);
+                return ret;
+        }
+        nau8824_reset_chip(nau8824->regmap);
+        nau8824_init_regs(nau8824);
+
+        if (i2c->irq)
+                nau8824_setup_irq(nau8824);
+
+        return snd_soc_register_codec(dev,
+                &nau8824_codec_driver, &nau8824_dai, 1);
+}
+
+
+static int nau8824_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct i2c_device_id nau8824_i2c_ids[] = {
+        { "nau8824", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, nau8824_i2c_ids);
+
+#ifdef CONFIG_OF
+static const struct of_device_id nau8824_of_ids[] = {
+        { .compatible = "nuvoton,nau8824", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, nau8824_of_ids);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id nau8824_acpi_match[] = {
+        { "10508824", 0 },
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, nau8824_acpi_match);
+#endif
+
+static struct i2c_driver nau8824_i2c_driver = {
+        .driver = {
+                .name = "nau8824",
+                .of_match_table = of_match_ptr(nau8824_of_ids),
+                .acpi_match_table = ACPI_PTR(nau8824_acpi_match),
+        },
+        .probe = nau8824_i2c_probe,
+        .remove = nau8824_i2c_remove,
+        .id_table = nau8824_i2c_ids,
+};
+module_i2c_driver(nau8824_i2c_driver);
+
+
+MODULE_DESCRIPTION("ASoC NAU88L24 driver");
+MODULE_AUTHOR("John Hsu <KCHSU0@nuvoton.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/nau8824.h b/sound/soc/codecs/nau8824.h
new file mode 100644
index 000000000000..87ac9a382aed
--- /dev/null
+++ b/sound/soc/codecs/nau8824.h
@@ -0,0 +1,466 @@
+/*
+ * NAU88L24 ALSA SoC audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ * Author: John Hsu <KCHSU0@nuvoton.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __NAU8824_H__
+#define __NAU8824_H__
+
+#define NAU8824_REG_RESET                       0x00
+#define NAU8824_REG_ENA_CTRL                    0x01
+#define NAU8824_REG_CLK_GATING_ENA              0x02
+#define NAU8824_REG_CLK_DIVIDER         0x03
+#define NAU8824_REG_FLL1                        0x04
+#define NAU8824_REG_FLL2                        0x05
+#define NAU8824_REG_FLL3                        0x06
+#define NAU8824_REG_FLL4                        0x07
+#define NAU8824_REG_FLL5                        0x08
+#define NAU8824_REG_FLL6                        0x09
+#define NAU8824_REG_FLL_VCO_RSV         0x0A
+#define NAU8824_REG_JACK_DET_CTRL               0x0D
+#define NAU8824_REG_INTERRUPT_SETTING_1 0x0F
+#define NAU8824_REG_IRQ                 0x10
+#define NAU8824_REG_CLEAR_INT_REG               0x11
+#define NAU8824_REG_INTERRUPT_SETTING   0x12
+#define NAU8824_REG_SAR_ADC                     0x13
+#define NAU8824_REG_VDET_COEFFICIENT            0x14
+#define NAU8824_REG_VDET_THRESHOLD_1    0x15
+#define NAU8824_REG_VDET_THRESHOLD_2    0x16
+#define NAU8824_REG_VDET_THRESHOLD_3    0x17
+#define NAU8824_REG_VDET_THRESHOLD_4    0x18
+#define NAU8824_REG_GPIO_SEL                    0x1A
+#define NAU8824_REG_PORT0_I2S_PCM_CTRL_1        0x1C
+#define NAU8824_REG_PORT0_I2S_PCM_CTRL_2        0x1D
+#define NAU8824_REG_PORT0_LEFT_TIME_SLOT        0x1E
+#define NAU8824_REG_PORT0_RIGHT_TIME_SLOT       0x1F
+#define NAU8824_REG_TDM_CTRL                    0x20
+#define NAU8824_REG_ADC_HPF_FILTER              0x23
+#define NAU8824_REG_ADC_FILTER_CTRL             0x24
+#define NAU8824_REG_DAC_FILTER_CTRL_1   0x25
+#define NAU8824_REG_DAC_FILTER_CTRL_2   0x26
+#define NAU8824_REG_NOTCH_FILTER_1              0x27
+#define NAU8824_REG_NOTCH_FILTER_2              0x28
+#define NAU8824_REG_EQ1_LOW                     0x29
+#define NAU8824_REG_EQ2_EQ3                     0x2A
+#define NAU8824_REG_EQ4_EQ5                     0x2B
+#define NAU8824_REG_ADC_CH0_DGAIN_CTRL  0x2D
+#define NAU8824_REG_ADC_CH1_DGAIN_CTRL  0x2E
+#define NAU8824_REG_ADC_CH2_DGAIN_CTRL  0x2F
+#define NAU8824_REG_ADC_CH3_DGAIN_CTRL  0x30
+#define NAU8824_REG_DAC_MUTE_CTRL               0x31
+#define NAU8824_REG_DAC_CH0_DGAIN_CTRL  0x32
+#define NAU8824_REG_DAC_CH1_DGAIN_CTRL  0x33
+#define NAU8824_REG_ADC_TO_DAC_ST               0x34
+#define NAU8824_REG_DRC_KNEE_IP12_ADC_CH01      0x38
+#define NAU8824_REG_DRC_KNEE_IP34_ADC_CH01      0x39
+#define NAU8824_REG_DRC_SLOPE_ADC_CH01  0x3A
+#define NAU8824_REG_DRC_ATKDCY_ADC_CH01 0x3B
+#define NAU8824_REG_DRC_KNEE_IP12_ADC_CH23      0x3C
+#define NAU8824_REG_DRC_KNEE_IP34_ADC_CH23      0x3D
+#define NAU8824_REG_DRC_SLOPE_ADC_CH23  0x3E
+#define NAU8824_REG_DRC_ATKDCY_ADC_CH23 0x3F
+#define NAU8824_REG_DRC_GAINL_ADC0              0x40
+#define NAU8824_REG_DRC_GAINL_ADC1              0x41
+#define NAU8824_REG_DRC_GAINL_ADC2              0x42
+#define NAU8824_REG_DRC_GAINL_ADC3              0x43
+#define NAU8824_REG_DRC_KNEE_IP12_DAC   0x45
+#define NAU8824_REG_DRC_KNEE_IP34_DAC   0x46
+#define NAU8824_REG_DRC_SLOPE_DAC               0x47
+#define NAU8824_REG_DRC_ATKDCY_DAC              0x48
+#define NAU8824_REG_DRC_GAIN_DAC_CH0    0x49
+#define NAU8824_REG_DRC_GAIN_DAC_CH1    0x4A
+#define NAU8824_REG_MODE                        0x4C
+#define NAU8824_REG_MODE1                       0x4D
+#define NAU8824_REG_MODE2                       0x4E
+#define NAU8824_REG_CLASSG                      0x50
+#define NAU8824_REG_OTP_EFUSE                   0x51
+#define NAU8824_REG_OTPDOUT_1           0x53
+#define NAU8824_REG_OTPDOUT_2           0x54
+#define NAU8824_REG_MISC_CTRL                   0x55
+#define NAU8824_REG_I2C_TIMEOUT         0x56
+#define NAU8824_REG_TEST_MODE           0x57
+#define NAU8824_REG_I2C_DEVICE_ID               0x58
+#define NAU8824_REG_SAR_ADC_DATA_OUT    0x59
+#define NAU8824_REG_BIAS_ADJ                    0x66
+#define NAU8824_REG_PGA_GAIN                    0x67
+#define NAU8824_REG_TRIM_SETTINGS               0x68
+#define NAU8824_REG_ANALOG_CONTROL_1    0x69
+#define NAU8824_REG_ANALOG_CONTROL_2    0x6A
+#define NAU8824_REG_ENABLE_LO                   0x6B
+#define NAU8824_REG_GAIN_LO                     0x6C
+#define NAU8824_REG_CLASSD_GAIN_1               0x6D
+#define NAU8824_REG_CLASSD_GAIN_2               0x6E
+#define NAU8824_REG_ANALOG_ADC_1                0x71
+#define NAU8824_REG_ANALOG_ADC_2                0x72
+#define NAU8824_REG_RDAC                        0x73
+#define NAU8824_REG_MIC_BIAS                    0x74
+#define NAU8824_REG_HS_VOLUME_CONTROL   0x75
+#define NAU8824_REG_BOOST                       0x76
+#define NAU8824_REG_FEPGA                       0x77
+#define NAU8824_REG_FEPGA_II                    0x78
+#define NAU8824_REG_FEPGA_SE                    0x79
+#define NAU8824_REG_FEPGA_ATTENUATION   0x7A
+#define NAU8824_REG_ATT_PORT0           0x7B
+#define NAU8824_REG_ATT_PORT1           0x7C
+#define NAU8824_REG_POWER_UP_CONTROL    0x7F
+#define NAU8824_REG_CHARGE_PUMP_CONTROL 0x80
+#define NAU8824_REG_CHARGE_PUMP_INPUT   0x81
+#define NAU8824_REG_MAX                 NAU8824_REG_CHARGE_PUMP_INPUT
+/* 16-bit control register address, and 16-bits control register data */
+#define NAU8824_REG_ADDR_LEN            16
+#define NAU8824_REG_DATA_LEN            16
+
+
+/* ENA_CTRL (0x1) */
+#define NAU8824_DMIC_LCH_EDGE_CH23      (0x1 << 12)
+#define NAU8824_DMIC_LCH_EDGE_CH01      (0x1 << 11)
+#define NAU8824_JD_SLEEP_MODE           (0x1 << 10)
+#define NAU8824_ADC_CH3_DMIC_SFT        9
+#define NAU8824_ADC_CH3_DMIC_EN (0x1 << NAU8824_ADC_CH3_DMIC_SFT)
+#define NAU8824_ADC_CH2_DMIC_SFT        8
+#define NAU8824_ADC_CH2_DMIC_EN (0x1 << NAU8824_ADC_CH2_DMIC_SFT)
+#define NAU8824_ADC_CH1_DMIC_SFT        7
+#define NAU8824_ADC_CH1_DMIC_EN (0x1 << NAU8824_ADC_CH1_DMIC_SFT)
+#define NAU8824_ADC_CH0_DMIC_SFT        6
+#define NAU8824_ADC_CH0_DMIC_EN (0x1 << NAU8824_ADC_CH0_DMIC_SFT)
+#define NAU8824_DAC_CH1_EN              (0x1 << 5)
+#define NAU8824_DAC_CH0_EN              (0x1 << 4)
+#define NAU8824_ADC_CH3_EN              (0x1 << 3)
+#define NAU8824_ADC_CH2_EN              (0x1 << 2)
+#define NAU8824_ADC_CH1_EN              (0x1 << 1)
+#define NAU8824_ADC_CH0_EN              0x1
+
+/* CLK_GATING_ENA (0x02) */
+#define NAU8824_CLK_ADC_CH23_EN (0x1 << 15)
+#define NAU8824_CLK_ADC_CH01_EN (0x1 << 14)
+#define NAU8824_CLK_DAC_CH1_EN  (0x1 << 13)
+#define NAU8824_CLK_DAC_CH0_EN  (0x1 << 12)
+#define NAU8824_CLK_I2S_EN              (0x1 << 7)
+#define NAU8824_CLK_GAIN_EN             (0x1 << 5)
+#define NAU8824_CLK_SAR_EN              (0x1 << 3)
+#define NAU8824_CLK_DMIC_CH23_EN        (0x1 << 1)
+
+/* CLK_DIVIDER (0x3) */
+#define NAU8824_CLK_SRC_SFT             15
+#define NAU8824_CLK_SRC_MASK            (1 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_SRC_VCO             (1 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_SRC_MCLK            (0 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_MCLK_SRC_MASK       (0xf << 0)
+#define NAU8824_CLK_DMIC_SRC_SFT        10
+#define NAU8824_CLK_DMIC_SRC_MASK       (0x7 << NAU8824_CLK_DMIC_SRC_SFT)
+#define NAU8824_CLK_ADC_SRC_SFT 6
+#define NAU8824_CLK_ADC_SRC_MASK        (0x3 << NAU8824_CLK_ADC_SRC_SFT)
+#define NAU8824_CLK_DAC_SRC_SFT 4
+#define NAU8824_CLK_DAC_SRC_MASK        (0x3 << NAU8824_CLK_DAC_SRC_SFT)
+
+/* FLL1 (0x04) */
+#define NAU8824_FLL_RATIO_MASK  (0x7f << 0)
+
+/* FLL3 (0x06) */
+#define NAU8824_FLL_INTEGER_MASK        (0x3ff << 0)
+#define NAU8824_FLL_CLK_SRC_SFT 10
+#define NAU8824_FLL_CLK_SRC_MASK        (0x3 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_MCLK        (0 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_BLK (0x2 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_FS          (0x3 << NAU8824_FLL_CLK_SRC_SFT)
+
+/* FLL4 (0x07) */
+#define NAU8824_FLL_REF_DIV_SFT 10
+#define NAU8824_FLL_REF_DIV_MASK        (0x3 << NAU8824_FLL_REF_DIV_SFT)
+
+/* FLL5 (0x08) */
+#define NAU8824_FLL_PDB_DAC_EN  (0x1 << 15)
+#define NAU8824_FLL_LOOP_FTR_EN (0x1 << 14)
+#define NAU8824_FLL_CLK_SW_MASK (0x1 << 13)
+#define NAU8824_FLL_CLK_SW_N2           (0x1 << 13)
+#define NAU8824_FLL_CLK_SW_REF  (0x0 << 13)
+#define NAU8824_FLL_FTR_SW_MASK (0x1 << 12)
+#define NAU8824_FLL_FTR_SW_ACCU (0x1 << 12)
+#define NAU8824_FLL_FTR_SW_FILTER       (0x0 << 12)
+
+/* FLL6 (0x9) */
+#define NAU8824_DCO_EN                  (0x1 << 15)
+#define NAU8824_SDM_EN                  (0x1 << 14)
+
+/* IRQ (0x10) */
+#define NAU8824_SHORT_CIRCUIT_IRQ               (0x1 << 7)
+#define NAU8824_IMPEDANCE_MEAS_IRQ              (0x1 << 6)
+#define NAU8824_KEY_RELEASE_IRQ         (0x1 << 5)
+#define NAU8824_KEY_LONG_PRESS_IRQ              (0x1 << 4)
+#define NAU8824_KEY_SHORT_PRESS_IRQ             (0x1 << 3)
+#define NAU8824_JACK_EJECTION_DETECTED  (0x1 << 1)
+#define NAU8824_JACK_INSERTION_DETECTED 0x1
+
+/* JACK_DET_CTRL (0x0D) */
+#define NAU8824_JACK_EJECT_DT_SFT       2
+#define NAU8824_JACK_EJECT_DT_MASK (0x3 << NAU8824_JACK_EJECT_DT_SFT)
+#define NAU8824_JACK_LOGIC              0x1
+
+
+/* INTERRUPT_SETTING_1 (0x0F) */
+#define NAU8824_IRQ_EJECT_EN            (0x1 << 9)
+#define NAU8824_IRQ_INSERT_EN           (0x1 << 8)
+
+/* INTERRUPT_SETTING (0x12) */
+#define NAU8824_IRQ_KEY_RELEASE_DIS             (0x1 << 5)
+#define NAU8824_IRQ_KEY_SHORT_PRESS_DIS (0x1 << 3)
+#define NAU8824_IRQ_EJECT_DIS                   (0x1 << 1)
+#define NAU8824_IRQ_INSERT_DIS          0x1
+
+/* SAR_ADC (0x13) */
+#define NAU8824_SAR_ADC_EN_SFT          12
+#define NAU8824_SAR_TRACKING_GAIN_SFT   8
+#define NAU8824_SAR_TRACKING_GAIN_MASK  (0x7 << NAU8824_SAR_TRACKING_GAIN_SFT)
+#define NAU8824_SAR_COMPARE_TIME_SFT    2
+#define NAU8824_SAR_COMPARE_TIME_MASK   (3 << 2)
+#define NAU8824_SAR_SAMPLING_TIME_SFT   0
+#define NAU8824_SAR_SAMPLING_TIME_MASK  (3 << 0)
+
+/* VDET_COEFFICIENT (0x14) */
+#define NAU8824_SHORTKEY_DEBOUNCE_SFT   12
+#define NAU8824_SHORTKEY_DEBOUNCE_MASK  (0x3 << NAU8824_SHORTKEY_DEBOUNCE_SFT)
+#define NAU8824_LEVELS_NR_SFT                   8
+#define NAU8824_LEVELS_NR_MASK          (0x7 << 8)
+#define NAU8824_HYSTERESIS_SFT          0
+#define NAU8824_HYSTERESIS_MASK         0xf
+
+/* PORT0_I2S_PCM_CTRL_1 (0x1C) */
+#define NAU8824_I2S_BP_SFT              7
+#define NAU8824_I2S_BP_MASK             (1 << NAU8824_I2S_BP_SFT)
+#define NAU8824_I2S_BP_INV              (1 << NAU8824_I2S_BP_SFT)
+#define NAU8824_I2S_PCMB_SFT            6
+#define NAU8824_I2S_PCMB_EN             (1 << NAU8824_I2S_PCMB_SFT)
+#define NAU8824_I2S_DL_SFT              2
+#define NAU8824_I2S_DL_MASK             (0x3 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_16               (0 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_20               (1 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_24               (2 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_32               (3 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DF_MASK             0x3
+#define NAU8824_I2S_DF_RIGTH            0
+#define NAU8824_I2S_DF_LEFT             1
+#define NAU8824_I2S_DF_I2S              2
+#define NAU8824_I2S_DF_PCM_AB           3
+
+
+/* PORT0_I2S_PCM_CTRL_2 (0x1D) */
+#define NAU8824_I2S_LRC_DIV_SFT 12
+#define NAU8824_I2S_LRC_DIV_MASK        (0x3 << NAU8824_I2S_LRC_DIV_SFT)
+#define NAU8824_I2S_MS_SFT              3
+#define NAU8824_I2S_MS_MASK             (1 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_MS_MASTER           (1 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_MS_SLAVE            (0 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_BLK_DIV_MASK        0x7
+
+/* ADC_FILTER_CTRL (0x24) */
+#define NAU8824_ADC_SYNC_DOWN_MASK      0x3
+#define NAU8824_ADC_SYNC_DOWN_32        0
+#define NAU8824_ADC_SYNC_DOWN_64        1
+#define NAU8824_ADC_SYNC_DOWN_128       2
+#define NAU8824_ADC_SYNC_DOWN_256       3
+
+/* DAC_FILTER_CTRL_1 (0x25) */
+#define NAU8824_DAC_CICCLP_OFF  (0x1 << 7)
+#define NAU8824_DAC_OVERSAMPLE_MASK     0x7
+#define NAU8824_DAC_OVERSAMPLE_64       0
+#define NAU8824_DAC_OVERSAMPLE_256      1
+#define NAU8824_DAC_OVERSAMPLE_128      2
+#define NAU8824_DAC_OVERSAMPLE_32       4
+
+/* DAC_MUTE_CTRL (0x31) */
+#define NAU8824_DAC_CH01_MIX            0x3
+#define NAU8824_DAC_ZC_EN               (0x1 << 11)
+
+/* DAC_CH0_DGAIN_CTRL (0x32) */
+#define NAU8824_DAC_CH0_SEL_SFT 9
+#define NAU8824_DAC_CH0_SEL_MASK        (0x1 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_SEL_I2S0        (0x0 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_SEL_I2S1        (0x1 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_VOL_MASK        0x1ff
+
+/* DAC_CH1_DGAIN_CTRL (0x33) */
+#define NAU8824_DAC_CH1_SEL_SFT 9
+#define NAU8824_DAC_CH1_SEL_MASK        (0x1 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_SEL_I2S0        (0x0 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_SEL_I2S1        (0x1 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_VOL_MASK        0x1ff
+
+/* CLASSG (0x50) */
+#define NAU8824_CLASSG_TIMER_SFT        8
+#define NAU8824_CLASSG_TIMER_MASK       (0x3f << NAU8824_CLASSG_TIMER_SFT)
+#define NAU8824_CLASSG_LDAC_EN_SFT      2
+#define NAU8824_CLASSG_RDAC_EN_SFT      1
+#define NAU8824_CLASSG_EN_SFT           0
+
+/* SAR_ADC_DATA_OUT (0x59) */
+#define NAU8824_SAR_ADC_DATA_MASK       0xff
+
+/* BIAS_ADJ (0x66) */
+#define NAU8824_VMID                    (1 << 6)
+#define NAU8824_VMID_SEL_SFT            4
+#define NAU8824_VMID_SEL_MASK           (3 << NAU8824_VMID_SEL_SFT)
+#define NAU8824_DMIC2_EN_SFT            3
+#define NAU8824_DMIC1_EN_SFT            2
+
+/* TRIM_SETTINGS (0x68) */
+#define NAU8824_DRV_CURR_INC            (1 << 15)
+
+/* ANALOG_CONTROL_1 (0x69) */
+#define NAU8824_DMIC_CLK_DRV_STRG       (1 << 3)
+#define NAU8824_DMIC_CLK_SLEW_FAST      (0x7)
+
+/* ANALOG_CONTROL_2 (0x6A) */
+#define NAU8824_CLASSD_CLAMP_DIS_SFT    3
+#define NAU8824_CLASSD_CLAMP_DIS        (0x1 << NAU8824_CLASSD_CLAMP_DIS_SFT)
+
+/* ENABLE_LO (0x6B) */
+#define NAU8824_TEST_DAC_SFT            14
+#define NAU8824_TEST_DAC_EN             (0x3 << NAU8824_TEST_DAC_SFT)
+#define NAU8824_DACL_HPR_EN_SFT 3
+#define NAU8824_DACL_HPR_EN             (0x1 << NAU8824_DACL_HPR_EN_SFT)
+#define NAU8824_DACR_HPR_EN_SFT 2
+#define NAU8824_DACR_HPR_EN             (0x1 << NAU8824_DACR_HPR_EN_SFT)
+#define NAU8824_DACR_HPL_EN_SFT 1
+#define NAU8824_DACR_HPL_EN             (0x1 << NAU8824_DACR_HPL_EN_SFT)
+#define NAU8824_DACL_HPL_EN_SFT 0
+#define NAU8824_DACL_HPL_EN             0x1
+
+/* CLASSD_GAIN_1 (0x6D) */
+#define NAU8824_CLASSD_GAIN_1R_SFT      8
+#define NAU8824_CLASSD_GAIN_1R_MASK     (0x1f << NAU8824_CLASSD_GAIN_1R_SFT)
+#define NAU8824_CLASSD_EN_SFT           7
+#define NAU8824_CLASSD_EN               (0x1 << NAU8824_CLASSD_EN_SFT)
+#define NAU8824_CLASSD_GAIN_1L_MASK     0x1f
+
+/* CLASSD_GAIN_2 (0x6E) */
+#define NAU8824_CLASSD_GAIN_2R_SFT      8
+#define NAU8824_CLASSD_GAIN_2R_MASK     (0x1f << NAU8824_CLASSD_GAIN_1R_SFT)
+#define NAU8824_CLASSD_EN_SFT           7
+#define NAU8824_CLASSD_EN               (0x1 << NAU8824_CLASSD_EN_SFT)
+#define NAU8824_CLASSD_GAIN_2L_MASK     0x1f
+
+/* ANALOG_ADC_2 (0x72) */
+#define NAU8824_ADCR_EN_SFT             7
+#define NAU8824_ADCL_EN_SFT             6
+
+/* RDAC (0x73) */
+#define NAU8824_DACR_EN_SFT             13
+#define NAU8824_DACL_EN_SFT             12
+#define NAU8824_DACR_CLK_SFT            9
+#define NAU8824_DACL_CLK_SFT            8
+#define NAU8824_RDAC_CLK_DELAY_SFT      4
+#define NAU8824_RDAC_CLK_DELAY_MASK     (0x7 << NAU8824_RDAC_CLK_DELAY_SFT)
+#define NAU8824_RDAC_VREF_SFT           2
+#define NAU8824_RDAC_VREF_MASK  (0x3 << NAU8824_RDAC_VREF_SFT)
+
+/* MIC_BIAS (0x74) */
+#define NAU8824_MICBIAS_JKSLV           (1 << 14)
+#define NAU8824_MICBIAS_JKR2            (1 << 12)
+#define NAU8824_MICBIAS_POWERUP_SFT     8
+#define NAU8824_MICBIAS_VOLTAGE_SFT     0
+#define NAU8824_MICBIAS_VOLTAGE_MASK    0x7
+
+/* BOOST (0x76) */
+#define NAU8824_PRECHARGE_DIS                   (0x1 << 13)
+#define NAU8824_GLOBAL_BIAS_EN          (0x1 << 12)
+#define NAU8824_HP_BOOST_DIS_SFT                9
+#define NAU8824_HP_BOOST_DIS            (0x1 << NAU8824_HP_BOOST_DIS_SFT)
+#define NAU8824_HP_BOOST_G_DIS_SFT              8
+#define NAU8824_HP_BOOST_G_DIS          (0x1 << NAU8824_HP_BOOST_G_DIS_SFT)
+#define NAU8824_SHORT_SHUTDOWN_DIG_EN   (1 << 7)
+#define NAU8824_SHORT_SHUTDOWN_EN               (1 << 6)
+
+/* FEPGA (0x77) */
+#define NAU8824_FEPGA_MODER_SHORT_SFT   7
+#define NAU8824_FEPGA_MODER_SHORT_EN    (0x1 << NAU8824_FEPGA_MODER_SHORT_SFT)
+#define NAU8824_FEPGA_MODER_MIC2_SFT            5
+#define NAU8824_FEPGA_MODER_MIC2_EN     (0x1 << NAU8824_FEPGA_MODER_MIC2_SFT)
+#define NAU8824_FEPGA_MODER_HSMIC_SFT   4
+#define NAU8824_FEPGA_MODER_HSMIC_EN    (0x1 << NAU8824_FEPGA_MODER_HSMIC_SFT)
+#define NAU8824_FEPGA_MODEL_SHORT_SFT   3
+#define NAU8824_FEPGA_MODEL_SHORT_EN    (0x1 << NAU8824_FEPGA_MODEL_SHORT_SFT)
+#define NAU8824_FEPGA_MODEL_MIC1_SFT            1
+#define NAU8824_FEPGA_MODEL_MIC1_EN     (0x1 << NAU8824_FEPGA_MODEL_MIC1_SFT)
+#define NAU8824_FEPGA_MODEL_HSMIC_SFT   0
+#define NAU8824_FEPGA_MODEL_HSMIC_EN    (0x1 << NAU8824_FEPGA_MODEL_HSMIC_SFT)
+
+/* FEPGA_II (0x78) */
+#define NAU8824_FEPGA_GAINR_SFT 5
+#define NAU8824_FEPGA_GAINR_MASK        (0x1f << NAU8824_FEPGA_GAINR_SFT)
+#define NAU8824_FEPGA_GAINL_SFT 0
+#define NAU8824_FEPGA_GAINL_MASK        0x1f
+
+/* CHARGE_PUMP_CONTROL (0x80) */
+#define NAU8824_JAMNODCLOW              (0x1 << 15)
+#define NAU8824_SPKR_PULL_DOWN  (0x1 << 13)
+#define NAU8824_SPKL_PULL_DOWN  (0x1 << 12)
+#define NAU8824_POWER_DOWN_DACR (0x1 << 9)
+#define NAU8824_POWER_DOWN_DACL (0x1 << 8)
+#define NAU8824_CHARGE_PUMP_EN_SFT      5
+#define NAU8824_CHARGE_PUMP_EN  (0x1 << NAU8824_CHARGE_PUMP_EN_SFT)
+
+
+#define NAU8824_CODEC_DAI "nau8824-hifi"
+
+/* System Clock Source */
+enum {
+        NAU8824_CLK_DIS,
+        NAU8824_CLK_MCLK,
+        NAU8824_CLK_INTERNAL,
+        NAU8824_CLK_FLL_MCLK,
+        NAU8824_CLK_FLL_BLK,
+        NAU8824_CLK_FLL_FS,
+};
+
+struct nau8824 {
+        struct device *dev;
+        struct regmap *regmap;
+        struct snd_soc_dapm_context *dapm;
+        struct snd_soc_jack *jack;
+        struct work_struct jdet_work;
+        struct semaphore jd_sem;
+        int fs;
+        int irq;
+        int micbias_voltage;
+        int vref_impedance;
+        int jkdet_polarity;
+        int sar_threshold_num;
+        int sar_threshold[8];
+        int sar_hysteresis;
+        int sar_voltage;
+        int sar_compare_time;
+        int sar_sampling_time;
+        int key_debounce;
+        int jack_eject_debounce;
+};
+
+struct nau8824_fll {
+        int mclk_src;
+        int ratio;
+        int fll_frac;
+        int fll_int;
+        int clk_ref_div;
+};
+
+struct nau8824_fll_attr {
+        unsigned int param;
+        unsigned int val;
+};
+
+struct nau8824_osr_attr {
+        unsigned int osr;
+        unsigned int clk_src;
+};
+
+
+int nau8824_enable_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack);
+
+#endif                          /* _NAU8824_H */
+
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index b281a46d769d..f91221b1ddf0 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -1084,13 +1084,28 @@ static int rt5514_parse_dt(struct rt5514_priv *rt5514, struct device *dev)
         return 0;
 }
 
+static __maybe_unused int rt5514_i2c_resume(struct device *dev)
+{
+        struct rt5514_priv *rt5514 = dev_get_drvdata(dev);
+        unsigned int val;
+
+        /*
+         * Add a bogus read to avoid rt5514's confusion after s2r in case it
+         * saw glitches on the i2c lines and thought the other side sent a
+         * start bit.
+         */
+        regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+
+        return 0;
+}
+
 static int rt5514_i2c_probe(struct i2c_client *i2c,
                     const struct i2c_device_id *id)
 {
         struct rt5514_platform_data *pdata = dev_get_platdata(&i2c->dev);
         struct rt5514_priv *rt5514;
         int ret;
-        unsigned int val;
+        unsigned int val = ~0;
 
         rt5514 = devm_kzalloc(&i2c->dev, sizeof(struct rt5514_priv),
                                 GFP_KERNEL);
@@ -1120,8 +1135,16 @@ static int rt5514_i2c_probe(struct i2c_client *i2c,
                 return ret;
         }
 
-        regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
-        if (val != RT5514_DEVICE_ID) {
+        /*
+         * The rt5514 can get confused if the i2c lines glitch together, as
+         * can happen at bootup as regulators are turned off and on.  If it's
+         * in this glitched state the first i2c read will fail, so we'll give
+         * it one change to retry.
+         */
+        ret = regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+        if (ret || val != RT5514_DEVICE_ID)
+                ret = regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+        if (ret || val != RT5514_DEVICE_ID) {
                 dev_err(&i2c->dev,
                         "Device with ID register %x is not rt5514\n", val);
                 return -ENODEV;
@@ -1149,10 +1172,15 @@ static int rt5514_i2c_remove(struct i2c_client *i2c)
         return 0;
 }
 
-struct i2c_driver rt5514_i2c_driver = {
+static const struct dev_pm_ops rt5514_i2_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(NULL, rt5514_i2c_resume)
+};
+
+static struct i2c_driver rt5514_i2c_driver = {
         .driver = {
                 .name = "rt5514",
                 .of_match_table = of_match_ptr(rt5514_of_match),
+                .pm = &rt5514_i2_pm_ops,
         },
         .probe = rt5514_i2c_probe,
         .remove   = rt5514_i2c_remove,
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index e149f3ce5401..87844a45886a 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3542,6 +3542,15 @@ static const struct i2c_device_id rt5645_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, rt5645_i2c_id);
 
+#ifdef CONFIG_OF
+static const struct of_device_id rt5645_of_match[] = {
+        { .compatible = "realtek,rt5645", },
+        { .compatible = "realtek,rt5650", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, rt5645_of_match);
+#endif
+
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id rt5645_acpi_match[] = {
         { "10EC5645", 0 },
@@ -3912,6 +3921,7 @@ static void rt5645_i2c_shutdown(struct i2c_client *i2c)
 static struct i2c_driver rt5645_i2c_driver = {
         .driver = {
                 .name = "rt5645",
+                .of_match_table = of_match_ptr(rt5645_of_match),
                 .acpi_match_table = ACPI_PTR(rt5645_acpi_match),
         },
         .probe = rt5645_i2c_probe,
diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
index 476135ec5726..8cd22307f5b6 100644
--- a/sound/soc/codecs/rt5665.c
+++ b/sound/soc/codecs/rt5665.c
@@ -1139,7 +1139,8 @@ static void rt5665_enable_push_button_irq(struct snd_soc_codec *codec,
         bool enable)
 {
         if (enable) {
-                snd_soc_write(codec, RT5665_4BTN_IL_CMD_1, 0x000b);
+                snd_soc_write(codec, RT5665_4BTN_IL_CMD_1, 0x0003);
+                snd_soc_update_bits(codec, RT5665_SAR_IL_CMD_9, 0x1, 0x1);
                 snd_soc_write(codec, RT5665_IL_CMD_1, 0x0048);
                 snd_soc_update_bits(codec, RT5665_4BTN_IL_CMD_2,
                                 RT5665_4BTN_IL_MASK | RT5665_4BTN_IL_RST_MASK,
@@ -1192,10 +1193,13 @@ static int rt5665_headset_detect(struct snd_soc_codec *codec, int jack_insert)
                 }
 
                 regmap_update_bits(rt5665->regmap, RT5665_EJD_CTRL_1,
-                        0x180, 0x180);
+                        0x1a0, 0x120);
                 regmap_write(rt5665->regmap, RT5665_EJD_CTRL_3, 0x3424);
+                regmap_write(rt5665->regmap, RT5665_IL_CMD_1, 0x0048);
                 regmap_write(rt5665->regmap, RT5665_SAR_IL_CMD_1, 0xa291);
 
+                usleep_range(10000, 15000);
+
                 rt5665->sar_adc_value = snd_soc_read(rt5665->codec,
                         RT5665_SAR_IL_CMD_4) & 0x7ff;
 
@@ -1256,8 +1260,8 @@ static void rt5665_jd_check_handler(struct work_struct *work)
         }
 }
 
-int rt5665_set_jack_detect(struct snd_soc_codec *codec,
-        struct snd_soc_jack *hs_jack)
+static int rt5665_set_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *hs_jack, void *data)
 {
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
 
@@ -1284,7 +1288,6 @@ int rt5665_set_jack_detect(struct snd_soc_codec *codec,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(rt5665_set_jack_detect);
 
 static void rt5665_jack_detect_handler(struct work_struct *work)
 {
@@ -2600,6 +2603,55 @@ static int rt5655_set_verf(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+static int rt5665_i2s_pin_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        unsigned int val1, val2, mask1, mask2 = 0;
+
+        switch (w->shift) {
+        case RT5665_PWR_I2S2_1_BIT:
+                mask1 = RT5665_GP2_PIN_MASK | RT5665_GP3_PIN_MASK |
+                        RT5665_GP4_PIN_MASK | RT5665_GP5_PIN_MASK;
+                val1 = RT5665_GP2_PIN_BCLK2 | RT5665_GP3_PIN_LRCK2 |
+                        RT5665_GP4_PIN_DACDAT2_1 | RT5665_GP5_PIN_ADCDAT2_1;
+                break;
+        case RT5665_PWR_I2S2_2_BIT:
+                mask1 = RT5665_GP2_PIN_MASK | RT5665_GP3_PIN_MASK |
+                        RT5665_GP8_PIN_MASK;
+                val1 = RT5665_GP2_PIN_BCLK2 | RT5665_GP3_PIN_LRCK2 |
+                        RT5665_GP8_PIN_DACDAT2_2;
+                mask2 = RT5665_GP9_PIN_MASK;
+                val2 = RT5665_GP9_PIN_ADCDAT2_2;
+                break;
+        case RT5665_PWR_I2S3_BIT:
+                mask1 = RT5665_GP6_PIN_MASK | RT5665_GP7_PIN_MASK |
+                        RT5665_GP8_PIN_MASK;
+                val1 = RT5665_GP6_PIN_BCLK3 | RT5665_GP7_PIN_LRCK3 |
+                        RT5665_GP8_PIN_DACDAT3;
+                mask2 = RT5665_GP9_PIN_MASK;
+                val2 = RT5665_GP9_PIN_ADCDAT3;
+                break;
+        }
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, val1);
+                if (mask2)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
+                                            mask2, val2);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, 0);
+                if (mask2)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
+                                            mask2, 0);
+                break;
+        default:
+                return 0;
+        }
+
+        return 0;
+}
 
 static const struct snd_soc_dapm_widget rt5665_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("LDO2", RT5665_PWR_ANLG_3, RT5665_PWR_LDO2_BIT, 0,
@@ -2852,11 +2904,14 @@ static const struct snd_soc_dapm_widget rt5665_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("I2S1_2", RT5665_PWR_DIG_1, RT5665_PWR_I2S1_2_BIT,
                 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("I2S2_1", RT5665_PWR_DIG_1, RT5665_PWR_I2S2_1_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_SUPPLY("I2S2_2", RT5665_PWR_DIG_1, RT5665_PWR_I2S2_2_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_SUPPLY("I2S3", RT5665_PWR_DIG_1, RT5665_PWR_I2S3_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_PGA("IF1 DAC1", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1 DAC2", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1 DAC3", SND_SOC_NOPM, 0, 0, NULL, 0),
@@ -3963,12 +4018,68 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"PDMR", NULL, "PDM R Playback"},
 };
 
+static int rt5665_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
+                        unsigned int rx_mask, int slots, int slot_width)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        unsigned int val = 0;
+
+        if (rx_mask || tx_mask)
+                val |= RT5665_I2S1_MODE_TDM;
+
+        switch (slots) {
+        case 4:
+                val |= RT5665_TDM_IN_CH_4;
+                val |= RT5665_TDM_OUT_CH_4;
+                break;
+        case 6:
+                val |= RT5665_TDM_IN_CH_6;
+                val |= RT5665_TDM_OUT_CH_6;
+                break;
+        case 8:
+                val |= RT5665_TDM_IN_CH_8;
+                val |= RT5665_TDM_OUT_CH_8;
+                break;
+        case 2:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (slot_width) {
+        case 20:
+                val |= RT5665_TDM_IN_LEN_20;
+                val |= RT5665_TDM_OUT_LEN_20;
+                break;
+        case 24:
+                val |= RT5665_TDM_IN_LEN_24;
+                val |= RT5665_TDM_OUT_LEN_24;
+                break;
+        case 32:
+                val |= RT5665_TDM_IN_LEN_32;
+                val |= RT5665_TDM_OUT_LEN_32;
+                break;
+        case 16:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, RT5665_TDM_CTRL_1,
+                RT5665_I2S1_MODE_MASK | RT5665_TDM_IN_CH_MASK |
+                RT5665_TDM_OUT_CH_MASK | RT5665_TDM_IN_LEN_MASK |
+                RT5665_TDM_OUT_LEN_MASK, val);
+
+        return 0;
+}
+
+
 static int rt5665_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
         struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val_len = 0, val_clk, mask_clk, val_bits = 0x0100;
+        unsigned int val_len = 0, val_clk, reg_clk, mask_clk, val_bits = 0x0100;
         int pre_div, frame_size;
 
         rt5665->lrck[dai->id] = params_rate(params);
@@ -4009,6 +4120,10 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
         switch (dai->id) {
         case RT5665_AIF1_1:
         case RT5665_AIF1_2:
+                if (params_channels(params) > 2)
+                        rt5665_set_tdm_slot(dai, 0xf, 0xf,
+                                params_channels(params), params_width(params));
+                reg_clk = RT5665_ADDA_CLK_1;
                 mask_clk = RT5665_I2S_PD1_MASK;
                 val_clk = pre_div << RT5665_I2S_PD1_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S1_SDP,
@@ -4016,12 +4131,14 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
                 break;
         case RT5665_AIF2_1:
         case RT5665_AIF2_2:
+                reg_clk = RT5665_ADDA_CLK_2;
                 mask_clk = RT5665_I2S_PD2_MASK;
                 val_clk = pre_div << RT5665_I2S_PD2_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S2_SDP,
                         RT5665_I2S_DL_MASK, val_len);
                 break;
         case RT5665_AIF3:
+                reg_clk = RT5665_ADDA_CLK_2;
                 mask_clk = RT5665_I2S_PD3_MASK;
                 val_clk = pre_div << RT5665_I2S_PD3_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S3_SDP,
@@ -4032,7 +4149,7 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
                 return -EINVAL;
         }
 
-        snd_soc_update_bits(codec, RT5665_ADDA_CLK_1, mask_clk, val_clk);
+        snd_soc_update_bits(codec, reg_clk, mask_clk, val_clk);
         snd_soc_update_bits(codec, RT5665_STO1_DAC_SIL_DET, 0x3700, val_bits);
 
         switch (rt5665->lrck[dai->id]) {
@@ -4125,10 +4242,9 @@ static int rt5665_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         return 0;
 }
 
-static int rt5665_set_dai_sysclk(struct snd_soc_dai *dai,
-                int clk_id, unsigned int freq, int dir)
+static int rt5665_set_codec_sysclk(struct snd_soc_codec *codec, int clk_id,
+                                   int source, unsigned int freq, int dir)
 {
-        struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
         unsigned int reg_val = 0;
 
@@ -4154,20 +4270,20 @@ static int rt5665_set_dai_sysclk(struct snd_soc_dai *dai,
         rt5665->sysclk = freq;
         rt5665->sysclk_src = clk_id;
 
-        dev_dbg(dai->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
+        dev_dbg(codec->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
 
         return 0;
 }
 
-static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
-                        unsigned int freq_in, unsigned int freq_out)
+static int rt5665_set_codec_pll(struct snd_soc_codec *codec, int pll_id,
+                                int source, unsigned int freq_in,
+                                unsigned int freq_out)
 {
-        struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
         struct rl6231_pll_code pll_code;
         int ret;
 
-        if (Source == rt5665->pll_src && freq_in == rt5665->pll_in &&
+        if (source == rt5665->pll_src && freq_in == rt5665->pll_in &&
             freq_out == rt5665->pll_out)
                 return 0;
 
@@ -4181,7 +4297,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
                 return 0;
         }
 
-        switch (Source) {
+        switch (source) {
         case RT5665_PLL1_S_MCLK:
                 snd_soc_update_bits(codec, RT5665_GLB_CLK,
                         RT5665_PLL1_SRC_MASK, RT5665_PLL1_SRC_MCLK);
@@ -4199,7 +4315,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
                                 RT5665_PLL1_SRC_MASK, RT5665_PLL1_SRC_BCLK3);
                 break;
         default:
-                dev_err(codec->dev, "Unknown PLL Source %d\n", Source);
+                dev_err(codec->dev, "Unknown PLL Source %d\n", source);
                 return -EINVAL;
         }
 
@@ -4221,62 +4337,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
 
         rt5665->pll_in = freq_in;
         rt5665->pll_out = freq_out;
-        rt5665->pll_src = Source;
-
-        return 0;
-}
-
-static int rt5665_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
-                        unsigned int rx_mask, int slots, int slot_width)
-{
-        struct snd_soc_codec *codec = dai->codec;
-        unsigned int val = 0;
-
-        if (rx_mask || tx_mask)
-                val |= RT5665_I2S1_MODE_TDM;
-
-        switch (slots) {
-        case 4:
-                val |= RT5665_TDM_IN_CH_4;
-                val |= RT5665_TDM_OUT_CH_4;
-                break;
-        case 6:
-                val |= RT5665_TDM_IN_CH_6;
-                val |= RT5665_TDM_OUT_CH_6;
-                break;
-        case 8:
-                val |= RT5665_TDM_IN_CH_8;
-                val |= RT5665_TDM_OUT_CH_8;
-                break;
-        case 2:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        switch (slot_width) {
-        case 20:
-                val |= RT5665_TDM_IN_LEN_20;
-                val |= RT5665_TDM_OUT_LEN_20;
-                break;
-        case 24:
-                val |= RT5665_TDM_IN_LEN_24;
-                val |= RT5665_TDM_OUT_LEN_24;
-                break;
-        case 32:
-                val |= RT5665_TDM_IN_LEN_32;
-                val |= RT5665_TDM_OUT_LEN_32;
-                break;
-        case 16:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        snd_soc_update_bits(codec, RT5665_TDM_CTRL_1,
-                RT5665_I2S1_MODE_MASK | RT5665_TDM_IN_CH_MASK |
-                RT5665_TDM_OUT_CH_MASK | RT5665_TDM_IN_LEN_MASK |
-                RT5665_TDM_OUT_LEN_MASK, val);
+        rt5665->pll_src = source;
 
         return 0;
 }
@@ -4393,9 +4454,7 @@ static int rt5665_resume(struct snd_soc_codec *codec)
 static const struct snd_soc_dai_ops rt5665_aif_dai_ops = {
         .hw_params = rt5665_hw_params,
         .set_fmt = rt5665_set_dai_fmt,
-        .set_sysclk = rt5665_set_dai_sysclk,
         .set_tdm_slot = rt5665_set_tdm_slot,
-        .set_pll = rt5665_set_dai_pll,
         .set_bclk_ratio = rt5665_set_bclk_ratio,
 };
 
@@ -4504,7 +4563,10 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5665 = {
                 .num_dapm_widgets = ARRAY_SIZE(rt5665_dapm_widgets),
                 .dapm_routes = rt5665_dapm_routes,
                 .num_dapm_routes = ARRAY_SIZE(rt5665_dapm_routes),
-        }
+        },
+        .set_sysclk = rt5665_set_codec_sysclk,
+        .set_pll = rt5665_set_codec_pll,
+        .set_jack = rt5665_set_jack_detect,
 };
 
 
@@ -4783,7 +4845,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c,
 
         regmap_write(rt5665->regmap, RT5665_HP_LOGIC_CTRL_2, 0x0002);
         regmap_update_bits(rt5665->regmap, RT5665_EJD_CTRL_1,
-                0xf000 | RT5665_VREF_POW_MASK, 0xd000 | RT5665_VREF_POW_REG);
+                0xf000 | RT5665_VREF_POW_MASK, 0xe000 | RT5665_VREF_POW_REG);
         /* Work around for pow_pump */
         regmap_update_bits(rt5665->regmap, RT5665_STO1_DAC_SIL_DET,
                 RT5665_DEB_STO_DAC_MASK, RT5665_DEB_80_MS);
diff --git a/sound/soc/codecs/rt5665.h b/sound/soc/codecs/rt5665.h
index a30f5e6d0628..1db5c6a62a8e 100644
--- a/sound/soc/codecs/rt5665.h
+++ b/sound/soc/codecs/rt5665.h
@@ -1984,7 +1984,5 @@ enum {
 
 int rt5665_sel_asrc_clk_src(struct snd_soc_codec *codec,
                 unsigned int filter_mask, unsigned int clk_src);
-int rt5665_set_jack_detect(struct snd_soc_codec *codec,
-        struct snd_soc_jack *hs_jack);
 
 #endif /* __RT5665_H__ */
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index 17d20b99f041..e27c5a4a0a15 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -2835,6 +2835,27 @@ static const struct dmi_system_id dmi_platform_intel_braswell[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Wyse 3040"),
                 },
         },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 10"),
+                },
+        },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Tablet B"),
+                },
+        },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
+                },
+        },
         {}
 };
 
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index abc802a5a479..65ac4518ad06 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -5035,6 +5035,12 @@ static const struct i2c_device_id rt5677_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
 
+static const struct of_device_id rt5677_of_match[] = {
+        { .compatible = "realtek,rt5677", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, rt5677_of_match);
+
 static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
 static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
 static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
@@ -5294,6 +5300,7 @@ static int rt5677_i2c_remove(struct i2c_client *i2c)
 static struct i2c_driver rt5677_i2c_driver = {
         .driver = {
                 .name = "rt5677",
+                .of_match_table = rt5677_of_match,
         },
         .probe = rt5677_i2c_probe,
         .remove   = rt5677_i2c_remove,
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 1589325855bc..5a2702edeb77 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -99,6 +99,13 @@ enum sgtl5000_micbias_resistor {
         SGTL5000_MICBIAS_8K = 8,
 };
 
+enum  {
+        I2S_LRCLK_STRENGTH_DISABLE,
+        I2S_LRCLK_STRENGTH_LOW,
+        I2S_LRCLK_STRENGTH_MEDIUM,
+        I2S_LRCLK_STRENGTH_HIGH,
+};
+
 /* sgtl5000 private structure in codec */
 struct sgtl5000_priv {
         int sysclk;     /* sysclk rate */
@@ -111,6 +118,7 @@ struct sgtl5000_priv {
         int revision;
         u8 micbias_resistor;
         u8 micbias_voltage;
+        u8 lrclk_strength;
 };
 
 /*
@@ -1089,6 +1097,7 @@ static int sgtl5000_enable_regulators(struct i2c_client *client)
 static int sgtl5000_probe(struct snd_soc_codec *codec)
 {
         int ret;
+        u16 reg;
         struct sgtl5000_priv *sgtl5000 = snd_soc_codec_get_drvdata(codec);
 
         /* power up sgtl5000 */
@@ -1118,7 +1127,8 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
                         SGTL5000_DAC_MUTE_RIGHT |
                         SGTL5000_DAC_MUTE_LEFT);
 
-        snd_soc_write(codec, SGTL5000_CHIP_PAD_STRENGTH, 0x015f);
+        reg = ((sgtl5000->lrclk_strength) << SGTL5000_PAD_I2S_LRCLK_SHIFT | 0x5f);
+        snd_soc_write(codec, SGTL5000_CHIP_PAD_STRENGTH, reg);
 
         snd_soc_write(codec, SGTL5000_CHIP_ANA_CTRL,
                         SGTL5000_HP_ZCD_EN |
@@ -1347,6 +1357,13 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
                 }
         }
 
+        sgtl5000->lrclk_strength = I2S_LRCLK_STRENGTH_LOW;
+        if (!of_property_read_u32(np, "lrclk-strength", &value)) {
+                if (value > I2S_LRCLK_STRENGTH_HIGH)
+                        value = I2S_LRCLK_STRENGTH_LOW;
+                sgtl5000->lrclk_strength = value;
+        }
+
         /* Ensure sgtl5000 will start with sane register values */
         sgtl5000_fill_defaults(client);
 
diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c
index 2bb5a11c9ba1..a622623e8558 100644
--- a/sound/soc/codecs/ssm4567.c
+++ b/sound/soc/codecs/ssm4567.c
@@ -485,6 +485,14 @@ static const struct i2c_device_id ssm4567_i2c_ids[] = {
 };
 MODULE_DEVICE_TABLE(i2c, ssm4567_i2c_ids);
 
+#ifdef CONFIG_OF
+static const struct of_device_id ssm4567_of_match[] = {
+        { .compatible = "adi,ssm4567", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, ssm4567_of_match);
+#endif
+
 #ifdef CONFIG_ACPI
 
 static const struct acpi_device_id ssm4567_acpi_match[] = {
@@ -498,6 +506,7 @@ MODULE_DEVICE_TABLE(acpi, ssm4567_acpi_match);
 static struct i2c_driver ssm4567_driver = {
         .driver = {
                 .name = "ssm4567",
+                .of_match_table = of_match_ptr(ssm4567_of_match),
                 .acpi_match_table = ACPI_PTR(ssm4567_acpi_match),
         },
         .probe = ssm4567_i2c_probe,
diff --git a/sound/soc/codecs/sta529.c b/sound/soc/codecs/sta529.c
index d4b384e4b266..660734359bf3 100644
--- a/sound/soc/codecs/sta529.c
+++ b/sound/soc/codecs/sta529.c
@@ -375,9 +375,16 @@ static const struct i2c_device_id sta529_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, sta529_i2c_id);
 
+static const struct of_device_id sta529_of_match[] = {
+        { .compatible = "st,sta529", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, sta529_of_match);
+
 static struct i2c_driver sta529_i2c_driver = {
         .driver = {
                 .name = "sta529",
+                .of_match_table = sta529_of_match,
         },
         .probe          = sta529_i2c_probe,
         .remove         = sta529_i2c_remove,
diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
index baf455e8c2f7..8840f72f3c4a 100644
--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -611,7 +611,7 @@ probe_fail:
 
         regulator_bulk_disable(ARRAY_SIZE(tas2552->supplies),
                                         tas2552->supplies);
-        return -EIO;
+        return ret;
 }
 
 static int tas2552_codec_remove(struct snd_soc_codec *codec)
@@ -637,7 +637,7 @@ static int tas2552_suspend(struct snd_soc_codec *codec)
         if (ret != 0)
                 dev_err(codec->dev, "Failed to disable supplies: %d\n",
                         ret);
-        return 0;
+        return ret;
 }
 
 static int tas2552_resume(struct snd_soc_codec *codec)
@@ -653,7 +653,7 @@ static int tas2552_resume(struct snd_soc_codec *codec)
                         ret);
         }
 
-        return 0;
+        return ret;
 }
 #else
 #define tas2552_suspend NULL
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 410cae0f2060..628a8eeaab68 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -174,10 +174,9 @@ static const struct snd_soc_dapm_route tlv320aic23_intercon[] = {
         {"ROUT", NULL, "Output Mixer"},
 
         /* Inputs */
-        {"Line Input", "NULL", "LLINEIN"},
-        {"Line Input", "NULL", "RLINEIN"},
-
-        {"Mic Input", "NULL", "MICIN"},
+        {"Line Input", NULL, "LLINEIN"},
+        {"Line Input", NULL, "RLINEIN"},
+        {"Mic Input", NULL, "MICIN"},
 
         /* input mux */
         {"Capture Source", "Line", "Line Input"},
diff --git a/sound/soc/codecs/twl6040.c b/sound/soc/codecs/twl6040.c
index 748036e851ea..2b6ad09e0886 100644
--- a/sound/soc/codecs/twl6040.c
+++ b/sound/soc/codecs/twl6040.c
@@ -606,6 +606,14 @@ static const struct snd_kcontrol_new twl6040_snd_controls[] = {
                 twl6040_headset_power_get_enum,
                 twl6040_headset_power_put_enum),
 
+        /* Left HS PDM data routed to Right HSDAC */
+        SOC_SINGLE("Headset Mono to Stereo Playback Switch",
+                TWL6040_REG_HSRCTL, 7, 1, 0),
+
+        /* Left HF PDM data routed to Right HFDAC */
+        SOC_SINGLE("Handsfree Mono to Stereo Playback Switch",
+                TWL6040_REG_HFRCTL, 5, 1, 0),
+
         SOC_ENUM_EXT("PLL Selection", twl6040_power_mode_enum,
                 twl6040_pll_get_enum, twl6040_pll_put_enum),
 };
diff --git a/sound/soc/codecs/uda1380.c b/sound/soc/codecs/uda1380.c
index 2918fdb95e58..61cdc79840e7 100644
--- a/sound/soc/codecs/uda1380.c
+++ b/sound/soc/codecs/uda1380.c
@@ -791,9 +791,16 @@ static const struct i2c_device_id uda1380_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, uda1380_i2c_id);
 
+static const struct of_device_id uda1380_of_match[] = {
+        { .compatible = "nxp,uda1380", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, uda1380_of_match);
+
 static struct i2c_driver uda1380_i2c_driver = {
         .driver = {
                 .name =  "uda1380-codec",
+                .of_match_table = uda1380_of_match,
         },
         .probe =    uda1380_i2c_probe,
         .remove =   uda1380_i2c_remove,
diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
index 560575000cc5..138a84efdd54 100644
--- a/sound/soc/codecs/wm5100.c
+++ b/sound/soc/codecs/wm5100.c
@@ -2014,7 +2014,7 @@ static void wm5100_micd_irq(struct wm5100_priv *wm5100)
 
         ret = regmap_read(wm5100->regmap, WM5100_MIC_DETECT_3, &val);
         if (ret != 0) {
-                dev_err(wm5100->dev, "Failed to read micropone status: %d\n",
+                dev_err(wm5100->dev, "Failed to read microphone status: %d\n",
                         ret);
                 return;
         }
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index 6e887c2c42b1..237eeb9a8b97 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -24,6 +24,7 @@
 #include <linux/pm.h>
 #include <linux/i2c.h>
 #include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
 #include <linux/slab.h>
 #include <linux/irq.h>
 #include <linux/mutex.h>
@@ -115,10 +116,19 @@ static const struct reg_default wm8903_reg_defaults[] = {
         { 172, 0x0000 },    /* R172 - Analogue Output Bias 0 */
 };
 
+#define WM8903_NUM_SUPPLIES 4
+static const char *wm8903_supply_names[WM8903_NUM_SUPPLIES] = {
+        "AVDD",
+        "CPVDD",
+        "DBVDD",
+        "DCVDD",
+};
+
 struct wm8903_priv {
         struct wm8903_platform_data *pdata;
         struct device *dev;
         struct regmap *regmap;
+        struct regulator_bulk_data supplies[WM8903_NUM_SUPPLIES];
 
         int sysclk;
         int irq;
@@ -2030,6 +2040,23 @@ static int wm8903_i2c_probe(struct i2c_client *i2c,
 
         pdata = wm8903->pdata;
 
+        for (i = 0; i < ARRAY_SIZE(wm8903->supplies); i++)
+                wm8903->supplies[i].supply = wm8903_supply_names[i];
+
+        ret = devm_regulator_bulk_get(&i2c->dev, ARRAY_SIZE(wm8903->supplies),
+                                      wm8903->supplies);
+        if (ret != 0) {
+                dev_err(&i2c->dev, "Failed to request supplies: %d\n", ret);
+                return ret;
+        }
+
+        ret = regulator_bulk_enable(ARRAY_SIZE(wm8903->supplies),
+                                    wm8903->supplies);
+        if (ret != 0) {
+                dev_err(&i2c->dev, "Failed to enable supplies: %d\n", ret);
+                return ret;
+        }
+
         ret = regmap_read(wm8903->regmap, WM8903_SW_RESET_AND_ID, &val);
         if (ret != 0) {
                 dev_err(&i2c->dev, "Failed to read chip ID: %d\n", ret);
@@ -2160,6 +2187,8 @@ static int wm8903_i2c_probe(struct i2c_client *i2c,
 
         return 0;
 err:
+        regulator_bulk_disable(ARRAY_SIZE(wm8903->supplies),
+                               wm8903->supplies);
         return ret;
 }
 
@@ -2167,6 +2196,8 @@ static int wm8903_i2c_remove(struct i2c_client *client)
 {
         struct wm8903_priv *wm8903 = i2c_get_clientdata(client);
 
+        regulator_bulk_disable(ARRAY_SIZE(wm8903->supplies),
+                               wm8903->supplies);
         if (client->irq)
                 free_irq(client->irq, wm8903);
         wm8903_free_gpio(wm8903);
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 3bf081a7e450..9ed455700954 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -604,12 +604,150 @@ static const int bclk_divs[] = {
         120, 160, 220, 240, 320, 320, 320
 };
 
+/**
+ * wm8960_configure_sysclk - checks if there is a sysclk frequency available
+ *      The sysclk must be chosen such that:
+ *              - sysclk     = MCLK / sysclk_divs
+ *              - lrclk      = sysclk / dac_divs
+ *              - 10 * bclk  = sysclk / bclk_divs
+ *
+ *      If we cannot find an exact match for (sysclk, lrclk, bclk)
+ *      triplet, we relax the bclk such that bclk is chosen as the
+ *      closest available frequency greater than expected bclk.
+ *
+ * @wm8960_priv: wm8960 codec private data
+ * @mclk: MCLK used to derive sysclk
+ * @sysclk_idx: sysclk_divs index for found sysclk
+ * @dac_idx: dac_divs index for found lrclk
+ * @bclk_idx: bclk_divs index for found bclk
+ *
+ * Returns:
+ *  -1, in case no sysclk frequency available found
+ * >=0, in case we could derive bclk and lrclk from sysclk using
+ *      (@sysclk_idx, @dac_idx, @bclk_idx) dividers
+ */
+static
+int wm8960_configure_sysclk(struct wm8960_priv *wm8960, int mclk,
+                            int *sysclk_idx, int *dac_idx, int *bclk_idx)
+{
+        int sysclk, bclk, lrclk;
+        int i, j, k;
+        int diff, closest = mclk;
+
+        /* marker for no match */
+        *bclk_idx = -1;
+
+        bclk = wm8960->bclk;
+        lrclk = wm8960->lrclk;
+
+        /* check if the sysclk frequency is available. */
+        for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
+                if (sysclk_divs[i] == -1)
+                        continue;
+                sysclk = mclk / sysclk_divs[i];
+                for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+                        if (sysclk != dac_divs[j] * lrclk)
+                                continue;
+                        for (k = 0; k < ARRAY_SIZE(bclk_divs); ++k) {
+                                diff = sysclk - bclk * bclk_divs[k] / 10;
+                                if (diff == 0) {
+                                        *sysclk_idx = i;
+                                        *dac_idx = j;
+                                        *bclk_idx = k;
+                                        break;
+                                }
+                                if (diff > 0 && closest > diff) {
+                                        *sysclk_idx = i;
+                                        *dac_idx = j;
+                                        *bclk_idx = k;
+                                        closest = diff;
+                                }
+                        }
+                        if (k != ARRAY_SIZE(bclk_divs))
+                                break;
+                }
+                if (j != ARRAY_SIZE(dac_divs))
+                        break;
+        }
+        return *bclk_idx;
+}
+
+/**
+ * wm8960_configure_pll - checks if there is a PLL out frequency available
+ *      The PLL out frequency must be chosen such that:
+ *              - sysclk      = lrclk * dac_divs
+ *              - freq_out    = sysclk * sysclk_divs
+ *              - 10 * sysclk = bclk * bclk_divs
+ *
+ *      If we cannot find an exact match for (sysclk, lrclk, bclk)
+ *      triplet, we relax the bclk such that bclk is chosen as the
+ *      closest available frequency greater than expected bclk.
+ *
+ * @codec: codec structure
+ * @freq_in: input frequency used to derive freq out via PLL
+ * @sysclk_idx: sysclk_divs index for found sysclk
+ * @dac_idx: dac_divs index for found lrclk
+ * @bclk_idx: bclk_divs index for found bclk
+ *
+ * Returns:
+ * < 0, in case no PLL frequency out available was found
+ * >=0, in case we could derive bclk, lrclk, sysclk from PLL out using
+ *      (@sysclk_idx, @dac_idx, @bclk_idx) dividers
+ */
+static
+int wm8960_configure_pll(struct snd_soc_codec *codec, int freq_in,
+                         int *sysclk_idx, int *dac_idx, int *bclk_idx)
+{
+        struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+        int sysclk, bclk, lrclk, freq_out;
+        int diff, closest, best_freq_out;
+        int i, j, k;
+
+        bclk = wm8960->bclk;
+        lrclk = wm8960->lrclk;
+        closest = freq_in;
+
+        best_freq_out = -EINVAL;
+        *sysclk_idx = *dac_idx = *bclk_idx = -1;
+
+        for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
+                if (sysclk_divs[i] == -1)
+                        continue;
+                for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+                        sysclk = lrclk * dac_divs[j];
+                        freq_out = sysclk * sysclk_divs[i];
+
+                        for (k = 0; k < ARRAY_SIZE(bclk_divs); ++k) {
+                                if (!is_pll_freq_available(freq_in, freq_out))
+                                        continue;
+
+                                diff = sysclk - bclk * bclk_divs[k] / 10;
+                                if (diff == 0) {
+                                        *sysclk_idx = i;
+                                        *dac_idx = j;
+                                        *bclk_idx = k;
+                                        return freq_out;
+                                }
+                                if (diff > 0 && closest > diff) {
+                                        *sysclk_idx = i;
+                                        *dac_idx = j;
+                                        *bclk_idx = k;
+                                        closest = diff;
+                                        best_freq_out = freq_out;
+                                }
+                        }
+                }
+        }
+
+        return best_freq_out;
+}
 static int wm8960_configure_clocking(struct snd_soc_codec *codec)
 {
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-        int sysclk, bclk, lrclk, freq_out, freq_in;
+        int freq_out, freq_in;
         u16 iface1 = snd_soc_read(codec, WM8960_IFACE1);
         int i, j, k;
+        int ret;
 
         if (!(iface1 & (1<<6))) {
                 dev_dbg(codec->dev,
@@ -623,8 +761,6 @@ static int wm8960_configure_clocking(struct snd_soc_codec *codec)
         }
 
         freq_in = wm8960->freq_in;
-        bclk = wm8960->bclk;
-        lrclk = wm8960->lrclk;
         /*
          * If it's sysclk auto mode, check if the MCLK can provide sysclk or
          * not. If MCLK can provide sysclk, using MCLK to provide sysclk
@@ -643,60 +779,21 @@ static int wm8960_configure_clocking(struct snd_soc_codec *codec)
         }
 
         if (wm8960->clk_id != WM8960_SYSCLK_PLL) {
-                /* check if the sysclk frequency is available. */
-                for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
-                        if (sysclk_divs[i] == -1)
-                                continue;
-                        sysclk = freq_out / sysclk_divs[i];
-                        for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
-                                if (sysclk != dac_divs[j] * lrclk)
-                                        continue;
-                                for (k = 0; k < ARRAY_SIZE(bclk_divs); ++k)
-                                        if (sysclk == bclk * bclk_divs[k] / 10)
-                                                break;
-                                if (k != ARRAY_SIZE(bclk_divs))
-                                        break;
-                        }
-                        if (j != ARRAY_SIZE(dac_divs))
-                                break;
-                }
-
-                if (i != ARRAY_SIZE(sysclk_divs)) {
+                ret = wm8960_configure_sysclk(wm8960, freq_out, &i, &j, &k);
+                if (ret >= 0) {
                         goto configure_clock;
                 } else if (wm8960->clk_id != WM8960_SYSCLK_AUTO) {
                         dev_err(codec->dev, "failed to configure clock\n");
                         return -EINVAL;
                 }
         }
-        /* get a available pll out frequency and set pll */
-        for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
-                if (sysclk_divs[i] == -1)
-                        continue;
-                for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
-                        sysclk = lrclk * dac_divs[j];
-                        freq_out = sysclk * sysclk_divs[i];
 
-                        for (k = 0; k < ARRAY_SIZE(bclk_divs); ++k) {
-                                if (sysclk == bclk * bclk_divs[k] / 10 &&
-                                    is_pll_freq_available(freq_in, freq_out)) {
-                                        wm8960_set_pll(codec,
-                                                       freq_in, freq_out);
-                                        break;
-                                } else {
-                                        continue;
-                                }
-                        }
-                        if (k != ARRAY_SIZE(bclk_divs))
-                                break;
-                }
-                if (j != ARRAY_SIZE(dac_divs))
-                        break;
-        }
-
-        if (i == ARRAY_SIZE(sysclk_divs)) {
-                dev_err(codec->dev, "failed to configure clock\n");
-                return -EINVAL;
+        freq_out = wm8960_configure_pll(codec, freq_in, &i, &j, &k);
+        if (freq_out < 0) {
+                dev_err(codec->dev, "failed to configure clock via PLL\n");
+                return freq_out;
         }
+        wm8960_set_pll(codec, freq_in, freq_out);
 
 configure_clock:
         /* configure sysclk clock */
diff --git a/sound/soc/codecs/wm8978.c b/sound/soc/codecs/wm8978.c
index 90b2d418ef60..cf761e2d7546 100644
--- a/sound/soc/codecs/wm8978.c
+++ b/sound/soc/codecs/wm8978.c
@@ -1071,9 +1071,16 @@ static const struct i2c_device_id wm8978_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, wm8978_i2c_id);
 
+static const struct of_device_id wm8978_of_match[] = {
+        { .compatible = "wlf,wm8978", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, wm8978_of_match);
+
 static struct i2c_driver wm8978_i2c_driver = {
         .driver = {
                 .name = "wm8978",
+                .of_match_table = wm8978_of_match,
         },
         .probe =    wm8978_i2c_probe,
         .remove =   wm8978_i2c_remove,
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index bbdb72f73df1..20695b691aff 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -112,17 +112,22 @@
 #define ADSP1_CLK_SEL_SHIFT                    0  /* CLK_SEL_ENA */
 #define ADSP1_CLK_SEL_WIDTH                    3  /* CLK_SEL_ENA */
 
-#define ADSP2_CONTROL        0x0
-#define ADSP2_CLOCKING       0x1
-#define ADSP2_STATUS1        0x4
-#define ADSP2_WDMA_CONFIG_1 0x30
-#define ADSP2_WDMA_CONFIG_2 0x31
-#define ADSP2_RDMA_CONFIG_1 0x34
-
-#define ADSP2_SCRATCH0        0x40
-#define ADSP2_SCRATCH1        0x41
-#define ADSP2_SCRATCH2        0x42
-#define ADSP2_SCRATCH3        0x43
+#define ADSP2_CONTROL                     0x0
+#define ADSP2_CLOCKING                    0x1
+#define ADSP2V2_CLOCKING                  0x2
+#define ADSP2_STATUS1                     0x4
+#define ADSP2_WDMA_CONFIG_1               0x30
+#define ADSP2_WDMA_CONFIG_2               0x31
+#define ADSP2V2_WDMA_CONFIG_2             0x32
+#define ADSP2_RDMA_CONFIG_1               0x34
+
+#define ADSP2_SCRATCH0                    0x40
+#define ADSP2_SCRATCH1                    0x41
+#define ADSP2_SCRATCH2                    0x42
+#define ADSP2_SCRATCH3                    0x43
+
+#define ADSP2V2_SCRATCH0_1                0x40
+#define ADSP2V2_SCRATCH2_3                0x42
 
 /*
  * ADSP2 Control
@@ -153,6 +158,17 @@
 #define ADSP2_CLK_SEL_WIDTH                    3  /* CLK_SEL_ENA */
 
 /*
+ * ADSP2V2 clocking
+ */
+#define ADSP2V2_CLK_SEL_MASK             0x70000  /* CLK_SEL_ENA */
+#define ADSP2V2_CLK_SEL_SHIFT                 16  /* CLK_SEL_ENA */
+#define ADSP2V2_CLK_SEL_WIDTH                  3  /* CLK_SEL_ENA */
+
+#define ADSP2V2_RATE_MASK                 0x7800  /* DSP_RATE */
+#define ADSP2V2_RATE_SHIFT                    11  /* DSP_RATE */
+#define ADSP2V2_RATE_WIDTH                     4  /* DSP_RATE */
+
+/*
  * ADSP2 Status 1
  */
 #define ADSP2_RAM_RDY                     0x0001
@@ -160,6 +176,37 @@
 #define ADSP2_RAM_RDY_SHIFT                    0
 #define ADSP2_RAM_RDY_WIDTH                    1
 
+/*
+ * ADSP2 Lock support
+ */
+#define ADSP2_LOCK_CODE_0                    0x5555
+#define ADSP2_LOCK_CODE_1                    0xAAAA
+
+#define ADSP2_WATCHDOG                       0x0A
+#define ADSP2_BUS_ERR_ADDR                   0x52
+#define ADSP2_REGION_LOCK_STATUS             0x64
+#define ADSP2_LOCK_REGION_1_LOCK_REGION_0    0x66
+#define ADSP2_LOCK_REGION_3_LOCK_REGION_2    0x68
+#define ADSP2_LOCK_REGION_5_LOCK_REGION_4    0x6A
+#define ADSP2_LOCK_REGION_7_LOCK_REGION_6    0x6C
+#define ADSP2_LOCK_REGION_9_LOCK_REGION_8    0x6E
+#define ADSP2_LOCK_REGION_CTRL               0x7A
+#define ADSP2_PMEM_ERR_ADDR_XMEM_ERR_ADDR    0x7C
+
+#define ADSP2_REGION_LOCK_ERR_MASK           0x8000
+#define ADSP2_SLAVE_ERR_MASK                 0x4000
+#define ADSP2_WDT_TIMEOUT_STS_MASK           0x2000
+#define ADSP2_CTRL_ERR_PAUSE_ENA             0x0002
+#define ADSP2_CTRL_ERR_EINT                  0x0001
+
+#define ADSP2_BUS_ERR_ADDR_MASK              0x00FFFFFF
+#define ADSP2_XMEM_ERR_ADDR_MASK             0x0000FFFF
+#define ADSP2_PMEM_ERR_ADDR_MASK             0x7FFF0000
+#define ADSP2_PMEM_ERR_ADDR_SHIFT            16
+#define ADSP2_WDT_ENA_MASK                   0xFFFFFFFD
+
+#define ADSP2_LOCK_REGION_SHIFT              16
+
 #define ADSP_MAX_STD_CTRL_SIZE               512
 
 #define WM_ADSP_ACKED_CTL_TIMEOUT_MS         100
@@ -683,6 +730,9 @@ static const struct soc_enum wm_adsp_fw_enum[] = {
         SOC_ENUM_SINGLE(0, 1, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
         SOC_ENUM_SINGLE(0, 2, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
         SOC_ENUM_SINGLE(0, 3, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 4, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 5, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 6, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
 };
 
 const struct snd_kcontrol_new wm_adsp_fw_controls[] = {
@@ -694,6 +744,12 @@ const struct snd_kcontrol_new wm_adsp_fw_controls[] = {
                      wm_adsp_fw_get, wm_adsp_fw_put),
         SOC_ENUM_EXT("DSP4 Firmware", wm_adsp_fw_enum[3],
                      wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP5 Firmware", wm_adsp_fw_enum[4],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP6 Firmware", wm_adsp_fw_enum[5],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP7 Firmware", wm_adsp_fw_enum[6],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
 };
 EXPORT_SYMBOL_GPL(wm_adsp_fw_controls);
 
@@ -750,6 +806,29 @@ static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
                  be16_to_cpu(scratch[3]));
 }
 
+static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
+{
+        u32 scratch[2];
+        int ret;
+
+        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+                              scratch, sizeof(scratch));
+
+        if (ret) {
+                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+                return;
+        }
+
+        scratch[0] = be32_to_cpu(scratch[0]);
+        scratch[1] = be32_to_cpu(scratch[1]);
+
+        adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+                 scratch[0] & 0xFFFF,
+                 scratch[0] >> 16,
+                 scratch[1] & 0xFFFF,
+                 scratch[1] >> 16);
+}
+
 static inline struct wm_coeff_ctl *bytes_ext_to_ctl(struct soc_bytes_ext *ext)
 {
         return container_of(ext, struct wm_coeff_ctl, bytes_ext);
@@ -2435,10 +2514,17 @@ static int wm_adsp2_ena(struct wm_adsp *dsp)
         unsigned int val;
         int ret, count;
 
-        ret = regmap_update_bits_async(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                       ADSP2_SYS_ENA, ADSP2_SYS_ENA);
-        if (ret != 0)
-                return ret;
+        switch (dsp->rev) {
+        case 0:
+                ret = regmap_update_bits_async(dsp->regmap,
+                                               dsp->base + ADSP2_CONTROL,
+                                               ADSP2_SYS_ENA, ADSP2_SYS_ENA);
+                if (ret != 0)
+                        return ret;
+                break;
+        default:
+                break;
+        }
 
         /* Wait for the RAM to start, should be near instantaneous */
         for (count = 0; count < 10; ++count) {
@@ -2497,11 +2583,17 @@ static void wm_adsp2_boot_work(struct work_struct *work)
         if (ret != 0)
                 goto err_ena;
 
-        /* Turn DSP back off until we are ready to run */
-        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                 ADSP2_SYS_ENA, 0);
-        if (ret != 0)
-                goto err_ena;
+        switch (dsp->rev) {
+        case 0:
+                /* Turn DSP back off until we are ready to run */
+                ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                         ADSP2_SYS_ENA, 0);
+                if (ret != 0)
+                        goto err_ena;
+                break;
+        default:
+                break;
+        }
 
         dsp->booted = true;
 
@@ -2523,12 +2615,21 @@ static void wm_adsp2_set_dspclk(struct wm_adsp *dsp, unsigned int freq)
 {
         int ret;
 
-        ret = regmap_update_bits_async(dsp->regmap,
-                                       dsp->base + ADSP2_CLOCKING,
-                                       ADSP2_CLK_SEL_MASK,
-                                       freq << ADSP2_CLK_SEL_SHIFT);
-        if (ret != 0)
-                adsp_err(dsp, "Failed to set clock rate: %d\n", ret);
+        switch (dsp->rev) {
+        case 0:
+                ret = regmap_update_bits_async(dsp->regmap,
+                                               dsp->base + ADSP2_CLOCKING,
+                                               ADSP2_CLK_SEL_MASK,
+                                               freq << ADSP2_CLK_SEL_SHIFT);
+                if (ret) {
+                        adsp_err(dsp, "Failed to set clock rate: %d\n", ret);
+                        return;
+                }
+                break;
+        default:
+                /* clock is handled by parent codec driver */
+                break;
+        }
 }
 
 int wm_adsp2_preloader_get(struct snd_kcontrol *kcontrol,
@@ -2568,6 +2669,18 @@ int wm_adsp2_preloader_put(struct snd_kcontrol *kcontrol,
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_preloader_put);
 
+static void wm_adsp_stop_watchdog(struct wm_adsp *dsp)
+{
+        switch (dsp->rev) {
+        case 0:
+        case 1:
+                return;
+        default:
+                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_WATCHDOG,
+                                   ADSP2_WDT_ENA_MASK, 0);
+        }
+}
+
 int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
                          struct snd_kcontrol *kcontrol, int event,
                          unsigned int freq)
@@ -2640,6 +2753,8 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 if (ret != 0)
                         goto err;
 
+                wm_adsp2_lock(dsp, dsp->lock_regions);
+
                 ret = regmap_update_bits(dsp->regmap,
                                          dsp->base + ADSP2_CONTROL,
                                          ADSP2_CORE_ENA | ADSP2_START,
@@ -2663,23 +2778,49 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 /* Tell the firmware to cleanup */
                 wm_adsp_signal_event_controls(dsp, WM_ADSP_FW_EVENT_SHUTDOWN);
 
+                wm_adsp_stop_watchdog(dsp);
+
                 /* Log firmware state, it can be useful for analysis */
-                wm_adsp2_show_fw_status(dsp);
+                switch (dsp->rev) {
+                case 0:
+                        wm_adsp2_show_fw_status(dsp);
+                        break;
+                default:
+                        wm_adsp2v2_show_fw_status(dsp);
+                        break;
+                }
 
                 mutex_lock(&dsp->pwr_lock);
 
                 dsp->running = false;
 
-                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                regmap_update_bits(dsp->regmap,
+                                   dsp->base + ADSP2_CONTROL,
                                    ADSP2_CORE_ENA | ADSP2_START, 0);
 
                 /* Make sure DMAs are quiesced */
-                regmap_write(dsp->regmap, dsp->base + ADSP2_RDMA_CONFIG_1, 0);
-                regmap_write(dsp->regmap, dsp->base + ADSP2_WDMA_CONFIG_1, 0);
-                regmap_write(dsp->regmap, dsp->base + ADSP2_WDMA_CONFIG_2, 0);
-
-                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                   ADSP2_SYS_ENA, 0);
+                switch (dsp->rev) {
+                case 0:
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_RDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_2, 0);
+
+                        regmap_update_bits(dsp->regmap,
+                                           dsp->base + ADSP2_CONTROL,
+                                           ADSP2_SYS_ENA, 0);
+                        break;
+                default:
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_RDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2V2_WDMA_CONFIG_2, 0);
+                        break;
+                }
 
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
                         wm_adsp_buffer_free(dsp);
@@ -2732,15 +2873,22 @@ int wm_adsp2_init(struct wm_adsp *dsp)
 {
         int ret;
 
-        /*
-         * Disable the DSP memory by default when in reset for a small
-         * power saving.
-         */
-        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                 ADSP2_MEM_ENA, 0);
-        if (ret != 0) {
-                adsp_err(dsp, "Failed to clear memory retention: %d\n", ret);
-                return ret;
+        switch (dsp->rev) {
+        case 0:
+                /*
+                 * Disable the DSP memory by default when in reset for a small
+                 * power saving.
+                 */
+                ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                         ADSP2_MEM_ENA, 0);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to clear memory retention: %d\n", ret);
+                        return ret;
+                }
+                break;
+        default:
+                break;
         }
 
         INIT_LIST_HEAD(&dsp->alg_regions);
@@ -3523,4 +3671,94 @@ int wm_adsp_compr_copy(struct snd_compr_stream *stream, char __user *buf,
 }
 EXPORT_SYMBOL_GPL(wm_adsp_compr_copy);
 
+int wm_adsp2_lock(struct wm_adsp *dsp, unsigned int lock_regions)
+{
+        struct regmap *regmap = dsp->regmap;
+        unsigned int code0, code1, lock_reg;
+
+        if (!(lock_regions & WM_ADSP2_REGION_ALL))
+                return 0;
+
+        lock_regions &= WM_ADSP2_REGION_ALL;
+        lock_reg = dsp->base + ADSP2_LOCK_REGION_1_LOCK_REGION_0;
+
+        while (lock_regions) {
+                code0 = code1 = 0;
+                if (lock_regions & BIT(0)) {
+                        code0 = ADSP2_LOCK_CODE_0;
+                        code1 = ADSP2_LOCK_CODE_1;
+                }
+                if (lock_regions & BIT(1)) {
+                        code0 |= ADSP2_LOCK_CODE_0 << ADSP2_LOCK_REGION_SHIFT;
+                        code1 |= ADSP2_LOCK_CODE_1 << ADSP2_LOCK_REGION_SHIFT;
+                }
+                regmap_write(regmap, lock_reg, code0);
+                regmap_write(regmap, lock_reg, code1);
+                lock_regions >>= 2;
+                lock_reg += 2;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(wm_adsp2_lock);
+
+irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+{
+        unsigned int val;
+        struct regmap *regmap = dsp->regmap;
+        int ret = 0;
+
+        ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+        if (ret) {
+                adsp_err(dsp,
+                        "Failed to read Region Lock Ctrl register: %d\n", ret);
+                return IRQ_HANDLED;
+        }
+
+        if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+                adsp_err(dsp, "watchdog timeout error\n");
+                wm_adsp_stop_watchdog(dsp);
+        }
+
+        if (val & (ADSP2_SLAVE_ERR_MASK | ADSP2_REGION_LOCK_ERR_MASK)) {
+                if (val & ADSP2_SLAVE_ERR_MASK)
+                        adsp_err(dsp, "bus error: slave error\n");
+                else
+                        adsp_err(dsp, "bus error: region lock error\n");
+
+                ret = regmap_read(regmap, dsp->base + ADSP2_BUS_ERR_ADDR, &val);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to read Bus Err Addr register: %d\n",
+                                 ret);
+                        return IRQ_HANDLED;
+                }
+
+                adsp_err(dsp, "bus error address = 0x%x\n",
+                         val & ADSP2_BUS_ERR_ADDR_MASK);
+
+                ret = regmap_read(regmap,
+                                  dsp->base + ADSP2_PMEM_ERR_ADDR_XMEM_ERR_ADDR,
+                                  &val);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to read Pmem Xmem Err Addr register: %d\n",
+                                 ret);
+                        return IRQ_HANDLED;
+                }
+
+                adsp_err(dsp, "xmem error address = 0x%x\n",
+                         val & ADSP2_XMEM_ERR_ADDR_MASK);
+                adsp_err(dsp, "pmem error address = 0x%x\n",
+                         (val & ADSP2_PMEM_ERR_ADDR_MASK) >>
+                         ADSP2_PMEM_ERR_ADDR_SHIFT);
+        }
+
+        regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+                           ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
+        return IRQ_HANDLED;
+}
+EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+
 MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/wm_adsp.h b/sound/soc/codecs/wm_adsp.h
index 3706b11053a3..41cc11c19b83 100644
--- a/sound/soc/codecs/wm_adsp.h
+++ b/sound/soc/codecs/wm_adsp.h
@@ -23,6 +23,23 @@
 #define WM_ADSP_COMPR_OK                 0
 #define WM_ADSP_COMPR_VOICE_TRIGGER      1
 
+#define WM_ADSP2_REGION_0 BIT(0)
+#define WM_ADSP2_REGION_1 BIT(1)
+#define WM_ADSP2_REGION_2 BIT(2)
+#define WM_ADSP2_REGION_3 BIT(3)
+#define WM_ADSP2_REGION_4 BIT(4)
+#define WM_ADSP2_REGION_5 BIT(5)
+#define WM_ADSP2_REGION_6 BIT(6)
+#define WM_ADSP2_REGION_7 BIT(7)
+#define WM_ADSP2_REGION_8 BIT(8)
+#define WM_ADSP2_REGION_9 BIT(9)
+#define WM_ADSP2_REGION_1_9 (WM_ADSP2_REGION_1 | \
+                WM_ADSP2_REGION_2 | WM_ADSP2_REGION_3 | \
+                WM_ADSP2_REGION_4 | WM_ADSP2_REGION_5 | \
+                WM_ADSP2_REGION_6 | WM_ADSP2_REGION_7 | \
+                WM_ADSP2_REGION_8 | WM_ADSP2_REGION_9)
+#define WM_ADSP2_REGION_ALL (WM_ADSP2_REGION_0 | WM_ADSP2_REGION_1_9)
+
 struct wm_adsp_region {
         int type;
         unsigned int base;
@@ -40,6 +57,7 @@ struct wm_adsp_compr_buf;
 
 struct wm_adsp {
         const char *part;
+        int rev;
         int num;
         int type;
         struct device *dev;
@@ -75,6 +93,8 @@ struct wm_adsp {
 
         struct mutex pwr_lock;
 
+        unsigned int lock_regions;
+
 #ifdef CONFIG_DEBUG_FS
         struct dentry *debugfs_root;
         char *wmfw_file_name;
@@ -113,6 +133,10 @@ int wm_adsp1_event(struct snd_soc_dapm_widget *w,
 int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
                          struct snd_kcontrol *kcontrol, int event,
                          unsigned int freq);
+
+int wm_adsp2_lock(struct wm_adsp *adsp, unsigned int regions);
+irqreturn_t wm_adsp2_bus_error(struct wm_adsp *adsp);
+
 int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                    struct snd_kcontrol *kcontrol, int event);
 
diff --git a/sound/soc/dwc/Kconfig b/sound/soc/dwc/Kconfig
index c297efe43861..c6fd95fa5ca6 100644
--- a/sound/soc/dwc/Kconfig
+++ b/sound/soc/dwc/Kconfig
@@ -8,10 +8,10 @@ config SND_DESIGNWARE_I2S
          maximum of 8 channels each for play and record.
 
 config SND_DESIGNWARE_PCM
-        tristate "PCM PIO extension for I2S driver"
+        bool "PCM PIO extension for I2S driver"
         depends on SND_DESIGNWARE_I2S
         help
-         Say Y, M or N if you want to add a custom ALSA extension that registers
+         Say Y or N if you want to add a custom ALSA extension that registers
          a PCM and uses PIO to transfer data.
 
          This functionality is specially suited for I2S devices that don't have
diff --git a/sound/soc/dwc/Makefile b/sound/soc/dwc/Makefile
index 38f1ca31c5fa..3e24c0ff95fb 100644
--- a/sound/soc/dwc/Makefile
+++ b/sound/soc/dwc/Makefile
@@ -1,5 +1,5 @@
 # SYNOPSYS Platform Support
 obj-$(CONFIG_SND_DESIGNWARE_I2S) += designware_i2s.o
-ifdef CONFIG_SND_DESIGNWARE_PCM
-obj-$(CONFIG_SND_DESIGNWARE_I2S) += designware_pcm.o
-endif
+
+designware_i2s-y := dwc-i2s.o
+designware_i2s-$(CONFIG_SND_DESIGNWARE_PCM) += dwc-pcm.o
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/dwc-i2s.c
index 9c46e4112026..9c46e4112026 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/dwc-i2s.c
diff --git a/sound/soc/dwc/designware_pcm.c b/sound/soc/dwc/dwc-pcm.c
index 459ec861e6b6..406fd867117b 100644
--- a/sound/soc/dwc/designware_pcm.c
+++ b/sound/soc/dwc/dwc-pcm.c
@@ -129,13 +129,11 @@ void dw_pcm_push_tx(struct dw_i2s_dev *dev)
 {
         dw_pcm_transfer(dev, true);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_push_tx);
 
 void dw_pcm_pop_rx(struct dw_i2s_dev *dev)
 {
         dw_pcm_transfer(dev, false);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_pop_rx);
 
 static int dw_pcm_open(struct snd_pcm_substream *substream)
 {
@@ -281,4 +279,3 @@ int dw_pcm_register(struct platform_device *pdev)
 {
         return devm_snd_soc_register_platform(&pdev->dev, &dw_pcm_platform);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_register);
diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c
index 883087f2b092..84ef6385736c 100644
--- a/sound/soc/fsl/eukrea-tlv320.c
+++ b/sound/soc/fsl/eukrea-tlv320.c
@@ -64,7 +64,7 @@ static int eukrea_tlv320_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops eukrea_tlv320_snd_ops = {
+static const struct snd_soc_ops eukrea_tlv320_snd_ops = {
         .hw_params      = eukrea_tlv320_hw_params,
 };
 
diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index dc30d780f874..282d841840b1 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -76,7 +76,7 @@ static int fsl_asrc_dma_prepare_and_submit(struct snd_pcm_substream *substream)
                         pair->dma_chan[!dir], runtime->dma_addr,
                         snd_pcm_lib_buffer_bytes(substream),
                         snd_pcm_lib_period_bytes(substream),
-                        dir == OUT ? DMA_TO_DEVICE : DMA_FROM_DEVICE, flags);
+                        dir == OUT ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM, flags);
         if (!pair->desc[!dir]) {
                 dev_err(dev, "failed to prepare slave DMA for Front-End\n");
                 return -ENOMEM;
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 38bfd46f4ad8..809a069d490b 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -19,7 +19,6 @@
 #include "fsl_esai.h"
 #include "imx-pcm.h"
 
-#define FSL_ESAI_RATES          SNDRV_PCM_RATE_8000_192000
 #define FSL_ESAI_FORMATS        (SNDRV_PCM_FMTBIT_S8 | \
                                 SNDRV_PCM_FMTBIT_S16_LE | \
                                 SNDRV_PCM_FMTBIT_S20_3LE | \
@@ -647,14 +646,14 @@ static struct snd_soc_dai_driver fsl_esai_dai = {
                 .stream_name = "CPU-Playback",
                 .channels_min = 1,
                 .channels_max = 12,
-                .rates = FSL_ESAI_RATES,
+                .rates = SNDRV_PCM_RATE_8000_192000,
                 .formats = FSL_ESAI_FORMATS,
         },
         .capture = {
                 .stream_name = "CPU-Capture",
                 .channels_min = 1,
                 .channels_max = 8,
-                .rates = FSL_ESAI_RATES,
+                .rates = SNDRV_PCM_RATE_8000_192000,
                 .formats = FSL_ESAI_FORMATS,
         },
         .ops = &fsl_esai_dai_ops,
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index fde08660b63b..173cb8496641 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -35,6 +35,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/clk.h>
+#include <linux/ctype.h>
 #include <linux/device.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
@@ -55,16 +56,6 @@
 #include "imx-pcm.h"
 
 /**
- * FSLSSI_I2S_RATES: sample rates supported by the I2S
- *
- * This driver currently only supports the SSI running in I2S slave mode,
- * which means the codec determines the sample rate.  Therefore, we tell
- * ALSA that we support all rates and let the codec driver decide what rates
- * are really supported.
- */
-#define FSLSSI_I2S_RATES SNDRV_PCM_RATE_CONTINUOUS
-
-/**
  * FSLSSI_I2S_FORMATS: audio formats supported by the SSI
  *
  * The SSI has a limitation in that the samples must be in the same byte
@@ -1212,14 +1203,14 @@ static struct snd_soc_dai_driver fsl_ssi_dai_template = {
                 .stream_name = "CPU-Playback",
                 .channels_min = 1,
                 .channels_max = 32,
-                .rates = FSLSSI_I2S_RATES,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
                 .formats = FSLSSI_I2S_FORMATS,
         },
         .capture = {
                 .stream_name = "CPU-Capture",
                 .channels_min = 1,
                 .channels_max = 32,
-                .rates = FSLSSI_I2S_RATES,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
                 .formats = FSLSSI_I2S_FORMATS,
         },
         .ops = &fsl_ssi_dai_ops,
@@ -1325,14 +1316,10 @@ static struct snd_ac97_bus_ops fsl_ssi_ac97_ops = {
  */
 static void make_lowercase(char *s)
 {
-        char *p = s;
-        char c;
-
-        while ((c = *p)) {
-                if ((c >= 'A') && (c <= 'Z'))
-                        *p = c + ('a' - 'A');
-                p++;
-        }
+        if (!s)
+                return;
+        for (; *s; s++)
+                *s = tolower(*s);
 }
 
 static int fsl_ssi_imx_probe(struct platform_device *pdev,
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index bb0459018b45..9d19b808f634 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -48,7 +48,7 @@ static int imx_mc13783_hifi_hw_params(struct snd_pcm_substream *substream,
         return snd_soc_dai_set_tdm_slot(cpu_dai, 0x3, 0x3, 2, 16);
 }
 
-static struct snd_soc_ops imx_mc13783_hifi_ops = {
+static const struct snd_soc_ops imx_mc13783_hifi_ops = {
         .hw_params = imx_mc13783_hifi_hw_params,
 };
 
diff --git a/sound/soc/fsl/imx-pcm-dma.c b/sound/soc/fsl/imx-pcm-dma.c
index f3d3d1ffa84e..314814ddd2b0 100644
--- a/sound/soc/fsl/imx-pcm-dma.c
+++ b/sound/soc/fsl/imx-pcm-dma.c
@@ -33,48 +33,20 @@ static bool filter(struct dma_chan *chan, void *param)
         return true;
 }
 
-static const struct snd_pcm_hardware imx_pcm_hardware = {
-        .info = SNDRV_PCM_INFO_INTERLEAVED |
-                SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                SNDRV_PCM_INFO_MMAP |
-                SNDRV_PCM_INFO_MMAP_VALID |
-                SNDRV_PCM_INFO_PAUSE |
-                SNDRV_PCM_INFO_RESUME,
-        .buffer_bytes_max = IMX_DEFAULT_DMABUF_SIZE,
-        .period_bytes_min = 128,
-        .period_bytes_max = 65535, /* Limited by SDMA engine */
-        .periods_min = 2,
-        .periods_max = 255,
-        .fifo_size = 0,
-};
-
 static const struct snd_dmaengine_pcm_config imx_dmaengine_pcm_config = {
-        .pcm_hardware = &imx_pcm_hardware,
         .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
         .compat_filter_fn = filter,
-        .prealloc_buffer_size = IMX_DEFAULT_DMABUF_SIZE,
 };
 
 int imx_pcm_dma_init(struct platform_device *pdev, size_t size)
 {
         struct snd_dmaengine_pcm_config *config;
-        struct snd_pcm_hardware *pcm_hardware;
 
         config = devm_kzalloc(&pdev->dev,
                         sizeof(struct snd_dmaengine_pcm_config), GFP_KERNEL);
         if (!config)
                 return -ENOMEM;
         *config = imx_dmaengine_pcm_config;
-        if (size)
-                config->prealloc_buffer_size = size;
-
-        pcm_hardware = devm_kzalloc(&pdev->dev,
-                        sizeof(struct snd_pcm_hardware), GFP_KERNEL);
-        *pcm_hardware = imx_pcm_hardware;
-        if (size)
-                pcm_hardware->buffer_bytes_max = size;
-
-        config->pcm_hardware = pcm_hardware;
 
         return devm_snd_dmaengine_pcm_register(&pdev->dev,
                 config,
diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
index dac6688540dc..92410f7ca1fa 100644
--- a/sound/soc/fsl/imx-pcm-fiq.c
+++ b/sound/soc/fsl/imx-pcm-fiq.c
@@ -282,7 +282,7 @@ static int imx_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static int ssi_irq = 0;
+static int ssi_irq;
 
 static int imx_pcm_fiq_new(struct snd_soc_pcm_runtime *rtd)
 {
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 1b60958e2080..206b898e554c 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -33,14 +33,14 @@ struct imx_wm8962_data {
         struct snd_soc_card card;
         char codec_dai_name[DAI_NAME_SIZE];
         char platform_name[DAI_NAME_SIZE];
-        struct clk *codec_clk;
         unsigned int clk_frequency;
 };
 
 struct imx_priv {
         struct platform_device *pdev;
+        int sample_rate;
+        snd_pcm_format_t sample_format;
 };
-static struct imx_priv card_priv;
 
 static const struct snd_soc_dapm_widget imx_wm8962_dapm_widgets[] = {
         SND_SOC_DAPM_HP("Headphone Jack", NULL),
@@ -49,14 +49,14 @@ static const struct snd_soc_dapm_widget imx_wm8962_dapm_widgets[] = {
         SND_SOC_DAPM_MIC("DMIC", NULL),
 };
 
-static int sample_rate = 44100;
-static snd_pcm_format_t sample_format = SNDRV_PCM_FORMAT_S16_LE;
-
 static int imx_hifi_hw_params(struct snd_pcm_substream *substream,
                 struct snd_pcm_hw_params *params)
 {
-        sample_rate = params_rate(params);
-        sample_format = params_format(params);
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+
+        priv->sample_rate = params_rate(params);
+        priv->sample_format = params_format(params);
 
         return 0;
 }
@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
 {
         struct snd_soc_pcm_runtime *rtd;
         struct snd_soc_dai *codec_dai;
-        struct imx_priv *priv = &card_priv;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(card);
         struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         unsigned int pll_out;
@@ -85,10 +85,10 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
         switch (level) {
         case SND_SOC_BIAS_PREPARE:
                 if (dapm->bias_level == SND_SOC_BIAS_STANDBY) {
-                        if (sample_format == SNDRV_PCM_FORMAT_S24_LE)
-                                pll_out = sample_rate * 384;
+                        if (priv->sample_format == SNDRV_PCM_FORMAT_S24_LE)
+                                pll_out = priv->sample_rate * 384;
                         else
-                                pll_out = sample_rate * 256;
+                                pll_out = priv->sample_rate * 256;
 
                         ret = snd_soc_dai_set_pll(codec_dai, WM8962_FLL,
                                         WM8962_FLL_MCLK, data->clk_frequency,
@@ -140,7 +140,7 @@ static int imx_wm8962_late_probe(struct snd_soc_card *card)
 {
         struct snd_soc_pcm_runtime *rtd;
         struct snd_soc_dai *codec_dai;
-        struct imx_priv *priv = &card_priv;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(card);
         struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         int ret;
@@ -160,13 +160,20 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         struct device_node *np = pdev->dev.of_node;
         struct device_node *ssi_np, *codec_np;
         struct platform_device *ssi_pdev;
-        struct imx_priv *priv = &card_priv;
         struct i2c_client *codec_dev;
         struct imx_wm8962_data *data;
+        struct imx_priv *priv;
+        struct clk *codec_clk;
         int int_port, ext_port;
         int ret;
 
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
         priv->pdev = pdev;
+        priv->sample_rate = 44100;
+        priv->sample_format = SNDRV_PCM_FORMAT_S16_LE;
 
         ret = of_property_read_u32(np, "mux-int-port", &int_port);
         if (ret) {
@@ -231,19 +238,15 @@ static int imx_wm8962_probe(struct platform_device *pdev)
                 goto fail;
         }
 
-        data->codec_clk = devm_clk_get(&codec_dev->dev, NULL);
-        if (IS_ERR(data->codec_clk)) {
-                ret = PTR_ERR(data->codec_clk);
+        codec_clk = clk_get(&codec_dev->dev, NULL);
+        if (IS_ERR(codec_clk)) {
+                ret = PTR_ERR(codec_clk);
                 dev_err(&codec_dev->dev, "failed to get codec clk: %d\n", ret);
                 goto fail;
         }
 
-        data->clk_frequency = clk_get_rate(data->codec_clk);
-        ret = clk_prepare_enable(data->codec_clk);
-        if (ret) {
-                dev_err(&codec_dev->dev, "failed to enable codec clk: %d\n", ret);
-                goto fail;
-        }
+        data->clk_frequency = clk_get_rate(codec_clk);
+        clk_put(codec_clk);
 
         data->dai.name = "HiFi";
         data->dai.stream_name = "HiFi";
@@ -258,10 +261,10 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         data->card.dev = &pdev->dev;
         ret = snd_soc_of_parse_card_name(&data->card, "model");
         if (ret)
-                goto clk_fail;
+                goto fail;
         ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing");
         if (ret)
-                goto clk_fail;
+                goto fail;
         data->card.num_links = 1;
         data->card.owner = THIS_MODULE;
         data->card.dai_link = &data->dai;
@@ -277,16 +280,9 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
-                goto clk_fail;
+                goto fail;
         }
 
-        of_node_put(ssi_np);
-        of_node_put(codec_np);
-
-        return 0;
-
-clk_fail:
-        clk_disable_unprepare(data->codec_clk);
 fail:
         of_node_put(ssi_np);
         of_node_put(codec_np);
@@ -294,17 +290,6 @@ fail:
         return ret;
 }
 
-static int imx_wm8962_remove(struct platform_device *pdev)
-{
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
-
-        if (!IS_ERR(data->codec_clk))
-                clk_disable_unprepare(data->codec_clk);
-
-        return 0;
-}
-
 static const struct of_device_id imx_wm8962_dt_ids[] = {
         { .compatible = "fsl,imx-audio-wm8962", },
         { /* sentinel */ }
@@ -318,7 +303,6 @@ static struct platform_driver imx_wm8962_driver = {
                 .of_match_table = imx_wm8962_dt_ids,
         },
         .probe = imx_wm8962_probe,
-        .remove = imx_wm8962_remove,
 };
 module_platform_driver(imx_wm8962_driver);
 
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index ddf49f30b23f..a639b52c16f6 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -174,7 +174,7 @@ static int mpc8610_hpcd_machine_remove(struct snd_soc_card *card)
 /**
  * mpc8610_hpcd_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops mpc8610_hpcd_ops = {
+static const struct snd_soc_ops mpc8610_hpcd_ops = {
         .startup = mpc8610_hpcd_startup,
 };
 
diff --git a/sound/soc/fsl/mx27vis-aic32x4.c b/sound/soc/fsl/mx27vis-aic32x4.c
index 198eeb3f3f7a..d7ec3d20065c 100644
--- a/sound/soc/fsl/mx27vis-aic32x4.c
+++ b/sound/soc/fsl/mx27vis-aic32x4.c
@@ -73,7 +73,7 @@ static int mx27vis_aic32x4_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
+static const struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
         .hw_params      = mx27vis_aic32x4_hw_params,
 };
 
diff --git a/sound/soc/fsl/p1022_ds.c b/sound/soc/fsl/p1022_ds.c
index a1f780ecadf5..41c623c55c16 100644
--- a/sound/soc/fsl/p1022_ds.c
+++ b/sound/soc/fsl/p1022_ds.c
@@ -184,7 +184,7 @@ static int p1022_ds_machine_remove(struct snd_soc_card *card)
 /**
  * p1022_ds_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops p1022_ds_ops = {
+static const struct snd_soc_ops p1022_ds_ops = {
         .startup = p1022_ds_startup,
 };
 
diff --git a/sound/soc/fsl/p1022_rdk.c b/sound/soc/fsl/p1022_rdk.c
index d4d88a8cb9c0..4afbdd610bfa 100644
--- a/sound/soc/fsl/p1022_rdk.c
+++ b/sound/soc/fsl/p1022_rdk.c
@@ -188,7 +188,7 @@ static int p1022_rdk_machine_remove(struct snd_soc_card *card)
 /**
  * p1022_rdk_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops p1022_rdk_ops = {
+static const struct snd_soc_ops p1022_rdk_ops = {
         .startup = p1022_rdk_startup,
 };
 
diff --git a/sound/soc/fsl/phycore-ac97.c b/sound/soc/fsl/phycore-ac97.c
index ae403c29688f..66fb6c4614d2 100644
--- a/sound/soc/fsl/phycore-ac97.c
+++ b/sound/soc/fsl/phycore-ac97.c
@@ -23,7 +23,7 @@
 
 static struct snd_soc_card imx_phycore;
 
-static struct snd_soc_ops imx_phycore_hifi_ops = {
+static const struct snd_soc_ops imx_phycore_hifi_ops = {
 };
 
 static struct snd_soc_dai_link imx_phycore_dai_ac97[] = {
diff --git a/sound/soc/fsl/wm1133-ev1.c b/sound/soc/fsl/wm1133-ev1.c
index b454972dce35..cdaf16367b47 100644
--- a/sound/soc/fsl/wm1133-ev1.c
+++ b/sound/soc/fsl/wm1133-ev1.c
@@ -139,7 +139,7 @@ static int wm1133_ev1_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops wm1133_ev1_ops = {
+static const struct snd_soc_ops wm1133_ev1_ops = {
         .hw_params = wm1133_ev1_hw_params,
 };
 
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 85b4f1806514..2c9dedab5184 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -40,9 +40,10 @@ struct simple_card_data {
         struct snd_soc_dai_link *dai_link;
 };
 
-#define simple_priv_to_dev(priv) ((priv)->snd_card.dev)
-#define simple_priv_to_link(priv, i) ((priv)->snd_card.dai_link + (i))
+#define simple_priv_to_card(priv) (&(priv)->snd_card)
 #define simple_priv_to_props(priv, i) ((priv)->dai_props + (i))
+#define simple_priv_to_dev(priv) (simple_priv_to_card(priv)->dev)
+#define simple_priv_to_link(priv, i) (simple_priv_to_card(priv)->dai_link + (i))
 
 #define DAI     "sound-dai"
 #define CELL    "#sound-dai-cells"
@@ -323,6 +324,7 @@ static int asoc_simple_card_parse_aux_devs(struct device_node *node,
 {
         struct device *dev = simple_priv_to_dev(priv);
         struct device_node *aux_node;
+        struct snd_soc_card *card = simple_priv_to_card(priv);
         int i, n, len;
 
         if (!of_find_property(node, PREFIX "aux-devs", &len))
@@ -332,19 +334,19 @@ static int asoc_simple_card_parse_aux_devs(struct device_node *node,
         if (n <= 0)
                 return -EINVAL;
 
-        priv->snd_card.aux_dev = devm_kzalloc(dev,
-                        n * sizeof(*priv->snd_card.aux_dev), GFP_KERNEL);
-        if (!priv->snd_card.aux_dev)
+        card->aux_dev = devm_kzalloc(dev,
+                        n * sizeof(*card->aux_dev), GFP_KERNEL);
+        if (!card->aux_dev)
                 return -ENOMEM;
 
         for (i = 0; i < n; i++) {
                 aux_node = of_parse_phandle(node, PREFIX "aux-devs", i);
                 if (!aux_node)
                         return -EINVAL;
-                priv->snd_card.aux_dev[i].codec_of_node = aux_node;
+                card->aux_dev[i].codec_of_node = aux_node;
         }
 
-        priv->snd_card.num_aux_devs = n;
+        card->num_aux_devs = n;
         return 0;
 }
 
@@ -352,6 +354,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                                      struct simple_card_data *priv)
 {
         struct device *dev = simple_priv_to_dev(priv);
+        struct snd_soc_card *card = simple_priv_to_card(priv);
         struct device_node *dai_link;
         int ret;
 
@@ -362,7 +365,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
 
         /* The off-codec widgets */
         if (of_property_read_bool(node, PREFIX "widgets")) {
-                ret = snd_soc_of_parse_audio_simple_widgets(&priv->snd_card,
+                ret = snd_soc_of_parse_audio_simple_widgets(card,
                                         PREFIX "widgets");
                 if (ret)
                         goto card_parse_end;
@@ -370,7 +373,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
 
         /* DAPM routes */
         if (of_property_read_bool(node, PREFIX "routing")) {
-                ret = snd_soc_of_parse_audio_routing(&priv->snd_card,
+                ret = snd_soc_of_parse_audio_routing(card,
                                         PREFIX "routing");
                 if (ret)
                         goto card_parse_end;
@@ -401,7 +404,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                         goto card_parse_end;
         }
 
-        ret = asoc_simple_card_parse_card_name(&priv->snd_card, PREFIX);
+        ret = asoc_simple_card_parse_card_name(card, PREFIX);
         if (ret < 0)
                 goto card_parse_end;
 
@@ -418,8 +421,9 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         struct simple_card_data *priv;
         struct snd_soc_dai_link *dai_link;
         struct simple_dai_props *dai_props;
-        struct device_node *np = pdev->dev.of_node;
         struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct snd_soc_card *card;
         int num, ret;
 
         /* Get the number of DAI links */
@@ -442,10 +446,11 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         priv->dai_link                  = dai_link;
 
         /* Init snd_soc_card */
-        priv->snd_card.owner            = THIS_MODULE;
-        priv->snd_card.dev              = dev;
-        priv->snd_card.dai_link         = priv->dai_link;
-        priv->snd_card.num_links        = num;
+        card = simple_priv_to_card(priv);
+        card->owner             = THIS_MODULE;
+        card->dev               = dev;
+        card->dai_link          = priv->dai_link;
+        card->num_links         = num;
 
         if (np && of_device_is_available(np)) {
 
@@ -474,7 +479,7 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
                         return -EINVAL;
                 }
 
-                priv->snd_card.name     = (cinfo->card) ? cinfo->card : cinfo->name;
+                card->name              = (cinfo->card) ? cinfo->card : cinfo->name;
                 dai_link->name          = cinfo->name;
                 dai_link->stream_name   = cinfo->name;
                 dai_link->platform_name = cinfo->platform;
@@ -489,13 +494,13 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
                                         sizeof(priv->dai_props->codec_dai));
         }
 
-        snd_soc_card_set_drvdata(&priv->snd_card, priv);
+        snd_soc_card_set_drvdata(card, priv);
 
-        ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
+        ret = devm_snd_soc_register_card(dev, card);
         if (ret >= 0)
                 return ret;
 err:
-        asoc_simple_card_clean_reference(&priv->snd_card);
+        asoc_simple_card_clean_reference(card);
 
         return ret;
 }
diff --git a/sound/soc/generic/simple-scu-card.c b/sound/soc/generic/simple-scu-card.c
index 308ff4c11a8d..dcbcab230d1b 100644
--- a/sound/soc/generic/simple-scu-card.c
+++ b/sound/soc/generic/simple-scu-card.c
@@ -31,9 +31,10 @@ struct simple_card_data {
         u32 convert_channels;
 };
 
-#define simple_priv_to_dev(priv) ((priv)->snd_card.dev)
-#define simple_priv_to_link(priv, i) ((priv)->snd_card.dai_link + (i))
+#define simple_priv_to_card(priv) (&(priv)->snd_card)
 #define simple_priv_to_props(priv, i) ((priv)->dai_props + (i))
+#define simple_priv_to_dev(priv) (simple_priv_to_card(priv)->dev)
+#define simple_priv_to_link(priv, i) (simple_priv_to_card(priv)->dai_link + (i))
 
 #define DAI     "sound-dai"
 #define CELL    "#sound-dai-cells"
@@ -109,6 +110,7 @@ static int asoc_simple_card_dai_link_of(struct device_node *np,
         struct device *dev = simple_priv_to_dev(priv);
         struct snd_soc_dai_link *dai_link = simple_priv_to_link(priv, idx);
         struct asoc_simple_dai *dai_props = simple_priv_to_props(priv, idx);
+        struct snd_soc_card *card = simple_priv_to_card(priv);
         int ret;
 
         if (is_fe) {
@@ -163,7 +165,7 @@ static int asoc_simple_card_dai_link_of(struct device_node *np,
                 if (ret < 0)
                         return ret;
 
-                snd_soc_of_parse_audio_prefix(&priv->snd_card,
+                snd_soc_of_parse_audio_prefix(card,
                                               &priv->codec_conf,
                                               dai_link->codec_of_node,
                                               PREFIX "prefix");
@@ -201,6 +203,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
 {
         struct device *dev = simple_priv_to_dev(priv);
         struct device_node *np;
+        struct snd_soc_card *card = simple_priv_to_card(priv);
         unsigned int daifmt = 0;
         bool is_fe;
         int ret, i;
@@ -208,7 +211,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
         if (!node)
                 return -EINVAL;
 
-        ret = snd_soc_of_parse_audio_routing(&priv->snd_card, PREFIX "routing");
+        ret = snd_soc_of_parse_audio_routing(card, PREFIX "routing");
         if (ret < 0)
                 return ret;
 
@@ -239,12 +242,12 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                 i++;
         }
 
-        ret = asoc_simple_card_parse_card_name(&priv->snd_card, PREFIX);
+        ret = asoc_simple_card_parse_card_name(card, PREFIX);
         if (ret < 0)
                 return ret;
 
         dev_dbg(dev, "New card: %s\n",
-                priv->snd_card.name ? priv->snd_card.name : "");
+                card->name ? card->name : "");
         dev_dbg(dev, "convert_rate     %d\n", priv->convert_rate);
         dev_dbg(dev, "convert_channels %d\n", priv->convert_channels);
 
@@ -256,8 +259,9 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         struct simple_card_data *priv;
         struct snd_soc_dai_link *dai_link;
         struct asoc_simple_dai *dai_props;
+        struct snd_soc_card *card;
         struct device *dev = &pdev->dev;
-        struct device_node *np = pdev->dev.of_node;
+        struct device_node *np = dev->of_node;
         int num, ret;
 
         /* Allocate the private data */
@@ -276,12 +280,13 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         priv->dai_link                          = dai_link;
 
         /* Init snd_soc_card */
-        priv->snd_card.owner                    = THIS_MODULE;
-        priv->snd_card.dev                      = dev;
-        priv->snd_card.dai_link                 = priv->dai_link;
-        priv->snd_card.num_links                = num;
-        priv->snd_card.codec_conf               = &priv->codec_conf;
-        priv->snd_card.num_configs              = 1;
+        card = simple_priv_to_card(priv);
+        card->owner             = THIS_MODULE;
+        card->dev               = dev;
+        card->dai_link          = priv->dai_link;
+        card->num_links         = num;
+        card->codec_conf        = &priv->codec_conf;
+        card->num_configs       = 1;
 
         ret = asoc_simple_card_parse_of(np, priv);
         if (ret < 0) {
@@ -290,13 +295,13 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
                 goto err;
         }
 
-        snd_soc_card_set_drvdata(&priv->snd_card, priv);
+        snd_soc_card_set_drvdata(card, priv);
 
-        ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
+        ret = devm_snd_soc_register_card(dev, card);
         if (ret >= 0)
                 return ret;
 err:
-        asoc_simple_card_clean_reference(&priv->snd_card);
+        asoc_simple_card_clean_reference(card);
 
         return ret;
 }
diff --git a/sound/soc/hisilicon/Kconfig b/sound/soc/hisilicon/Kconfig
new file mode 100644
index 000000000000..4356d5a1d338
--- /dev/null
+++ b/sound/soc/hisilicon/Kconfig
@@ -0,0 +1,5 @@
+config SND_I2S_HI6210_I2S
+        tristate "Hisilicon I2S controller"
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        help
+          Hisilicon I2S
diff --git a/sound/soc/hisilicon/Makefile b/sound/soc/hisilicon/Makefile
new file mode 100644
index 000000000000..e8095e2af91a
--- /dev/null
+++ b/sound/soc/hisilicon/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SND_I2S_HI6210_I2S) += hi6210-i2s.o
diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c
new file mode 100644
index 000000000000..45163e5202f5
--- /dev/null
+++ b/sound/soc/hisilicon/hi6210-i2s.c
@@ -0,0 +1,618 @@
+/*
+ * linux/sound/soc/m8m/hi6210_i2s.c - I2S IP driver
+ *
+ * Copyright (C) 2015 Linaro, Ltd
+ * Author: Andy Green <andy.green@linaro.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * This driver only deals with S2 interface (BT)
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/jiffies.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/dmaengine_pcm.h>
+#include <sound/initval.h>
+#include <sound/soc.h>
+#include <linux/interrupt.h>
+#include <linux/reset.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/mfd/syscon.h>
+#include <linux/reset-controller.h>
+#include <linux/clk.h>
+
+#include "hi6210-i2s.h"
+
+struct hi6210_i2s {
+        struct device *dev;
+        struct reset_control *rc;
+        struct clk *clk[8];
+        int clocks;
+        struct snd_soc_dai_driver dai;
+        void __iomem *base;
+        struct regmap *sysctrl;
+        phys_addr_t base_phys;
+        struct snd_dmaengine_dai_dma_data dma_data[2];
+        int clk_rate;
+        spinlock_t lock;
+        int rate;
+        int format;
+        u8 bits;
+        u8 channels;
+        u8 id;
+        u8 channel_length;
+        u8 use;
+        u32 master:1;
+        u32 status:1;
+};
+
+#define SC_PERIPH_CLKEN1        0x210
+#define SC_PERIPH_CLKDIS1       0x214
+
+#define SC_PERIPH_CLKEN3        0x230
+#define SC_PERIPH_CLKDIS3       0x234
+
+#define SC_PERIPH_CLKEN12       0x270
+#define SC_PERIPH_CLKDIS12      0x274
+
+#define SC_PERIPH_RSTEN1        0x310
+#define SC_PERIPH_RSTDIS1       0x314
+#define SC_PERIPH_RSTSTAT1      0x318
+
+#define SC_PERIPH_RSTEN2        0x320
+#define SC_PERIPH_RSTDIS2       0x324
+#define SC_PERIPH_RSTSTAT2      0x328
+
+#define SOC_PMCTRL_BBPPLLALIAS  0x48
+
+enum {
+        CLK_DACODEC,
+        CLK_I2S_BASE,
+};
+
+static inline void hi6210_write_reg(struct hi6210_i2s *i2s, int reg, u32 val)
+{
+        writel(val, i2s->base + reg);
+}
+
+static inline u32 hi6210_read_reg(struct hi6210_i2s *i2s, int reg)
+{
+        return readl(i2s->base + reg);
+}
+
+int hi6210_i2s_startup(struct snd_pcm_substream *substream,
+                     struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        int ret, n;
+        u32 val;
+
+        /* deassert reset on ABB */
+        regmap_read(i2s->sysctrl, SC_PERIPH_RSTSTAT2, &val);
+        if (val & BIT(4))
+                regmap_write(i2s->sysctrl, SC_PERIPH_RSTDIS2, BIT(4));
+
+        for (n = 0; n < i2s->clocks; n++) {
+                ret = clk_prepare_enable(i2s->clk[n]);
+                if (ret) {
+                        while (n--)
+                                clk_disable_unprepare(i2s->clk[n]);
+                        return ret;
+                }
+        }
+
+        ret = clk_set_rate(i2s->clk[CLK_I2S_BASE], 49152000);
+        if (ret) {
+                dev_err(i2s->dev, "%s: setting 49.152MHz base rate failed %d\n",
+                        __func__, ret);
+                return ret;
+        }
+
+        /* enable clock before frequency division */
+        regmap_write(i2s->sysctrl, SC_PERIPH_CLKEN12, BIT(9));
+
+        /* enable codec working clock / == "codec bus clock" */
+        regmap_write(i2s->sysctrl, SC_PERIPH_CLKEN1, BIT(5));
+
+        /* deassert reset on codec / interface clock / working clock */
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTEN1, BIT(5));
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTDIS1, BIT(5));
+
+        /* not interested in i2s irqs */
+        val = hi6210_read_reg(i2s, HII2S_CODEC_IRQ_MASK);
+        val |= 0x3f;
+        hi6210_write_reg(i2s, HII2S_CODEC_IRQ_MASK, val);
+
+
+        /* reset the stereo downlink fifo */
+        val = hi6210_read_reg(i2s, HII2S_APB_AFIFO_CFG_1);
+        val |= (BIT(5) | BIT(4));
+        hi6210_write_reg(i2s, HII2S_APB_AFIFO_CFG_1, val);
+
+        val = hi6210_read_reg(i2s, HII2S_APB_AFIFO_CFG_1);
+        val &= ~(BIT(5) | BIT(4));
+        hi6210_write_reg(i2s, HII2S_APB_AFIFO_CFG_1, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_SW_RST_N);
+        val &= ~(HII2S_SW_RST_N__ST_DL_WORDLEN_MASK <<
+                        HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT);
+        val |= (HII2S_BITS_16 << HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT);
+        hi6210_write_reg(i2s, HII2S_SW_RST_N, val);
+
+        val = hi6210_read_reg(i2s, HII2S_MISC_CFG);
+        /* mux 11/12 = APB not i2s */
+        val &= ~HII2S_MISC_CFG__ST_DL_TEST_SEL;
+        /* BT R ch  0 = mixer op of DACR ch */
+        val &= ~HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL;
+        val &= ~HII2S_MISC_CFG__S2_DOUT_TEST_SEL;
+
+        val |= HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL;
+        /* BT L ch = 1 = mux 7 = "mixer output of DACL */
+        val |= HII2S_MISC_CFG__S2_DOUT_TEST_SEL;
+        hi6210_write_reg(i2s, HII2S_MISC_CFG, val);
+
+        val = hi6210_read_reg(i2s, HII2S_SW_RST_N);
+        val |= HII2S_SW_RST_N__SW_RST_N;
+        hi6210_write_reg(i2s, HII2S_SW_RST_N, val);
+
+        return 0;
+}
+void hi6210_i2s_shutdown(struct snd_pcm_substream *substream,
+                       struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        int n;
+
+        for (n = 0; n < i2s->clocks; n++)
+                clk_disable_unprepare(i2s->clk[n]);
+
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTEN1, BIT(5));
+}
+
+static void hi6210_i2s_txctrl(struct snd_soc_dai *cpu_dai, int on)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 val;
+
+        spin_lock(&i2s->lock);
+        if (on) {
+                /* enable S2 TX */
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_IF_TX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        } else {
+                /* disable S2 TX */
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_IF_TX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        }
+        spin_unlock(&i2s->lock);
+}
+
+static void hi6210_i2s_rxctrl(struct snd_soc_dai *cpu_dai, int on)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 val;
+
+        spin_lock(&i2s->lock);
+        if (on) {
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_IF_RX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        } else {
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_IF_RX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        }
+        spin_unlock(&i2s->lock);
+}
+
+static int hi6210_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+
+        /*
+         * We don't actually set the hardware until the hw_params
+         * call, but we need to validate the user input here.
+         */
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+        case SND_SOC_DAIFMT_LEFT_J:
+        case SND_SOC_DAIFMT_RIGHT_J:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        i2s->format = fmt;
+        i2s->master = (i2s->format & SND_SOC_DAIFMT_MASTER_MASK) ==
+                      SND_SOC_DAIFMT_CBS_CFS;
+
+        return 0;
+}
+
+static int hi6210_i2s_hw_params(struct snd_pcm_substream *substream,
+                            struct snd_pcm_hw_params *params,
+                            struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 bits = 0, rate = 0, signed_data = 0, fmt = 0;
+        u32 val;
+        struct snd_dmaengine_dai_dma_data *dma_data;
+
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_U16_LE:
+                signed_data = HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+                /* fallthru */
+        case SNDRV_PCM_FORMAT_S16_LE:
+                bits = HII2S_BITS_16;
+                break;
+        case SNDRV_PCM_FORMAT_U24_LE:
+                signed_data = HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+                /* fallthru */
+        case SNDRV_PCM_FORMAT_S24_LE:
+                bits = HII2S_BITS_24;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Bad format\n");
+                return -EINVAL;
+        }
+
+
+        switch (params_rate(params)) {
+        case 8000:
+                rate = HII2S_FS_RATE_8KHZ;
+                break;
+        case 16000:
+                rate = HII2S_FS_RATE_16KHZ;
+                break;
+        case 32000:
+                rate = HII2S_FS_RATE_32KHZ;
+                break;
+        case 48000:
+                rate = HII2S_FS_RATE_48KHZ;
+                break;
+        case 96000:
+                rate = HII2S_FS_RATE_96KHZ;
+                break;
+        case 192000:
+                rate = HII2S_FS_RATE_192KHZ;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Bad rate: %d\n", params_rate(params));
+                return -EINVAL;
+        }
+
+        if (!(params_channels(params))) {
+                dev_err(cpu_dai->dev, "Bad channels\n");
+                return -EINVAL;
+        }
+
+        dma_data = snd_soc_dai_get_dma_data(cpu_dai, substream);
+
+        switch (bits) {
+        case HII2S_BITS_24:
+                i2s->bits = 32;
+                dma_data->addr_width = 3;
+                break;
+        default:
+                i2s->bits = 16;
+                dma_data->addr_width = 2;
+                break;
+        }
+        i2s->rate = params_rate(params);
+        i2s->channels = params_channels(params);
+        i2s->channel_length = i2s->channels * i2s->bits;
+
+        val = hi6210_read_reg(i2s, HII2S_ST_DL_FIFO_TH_CFG);
+        val &= ~((HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT));
+        val |= ((16 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT) |
+                (30 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT) |
+                (16 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT) |
+                (30 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT));
+        hi6210_write_reg(i2s, HII2S_ST_DL_FIFO_TH_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_IF_CLK_EN_CFG);
+        val |= (BIT(19) | BIT(18) | BIT(17) |
+                HII2S_IF_CLK_EN_CFG__S2_IF_CLK_EN |
+                HII2S_IF_CLK_EN_CFG__S2_OL_MIXER_EN |
+                HII2S_IF_CLK_EN_CFG__S2_OL_SRC_EN |
+                HII2S_IF_CLK_EN_CFG__ST_DL_R_EN |
+                HII2S_IF_CLK_EN_CFG__ST_DL_L_EN);
+        hi6210_write_reg(i2s, HII2S_IF_CLK_EN_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_DIG_FILTER_CLK_EN_CFG);
+        val &= ~(HII2S_DIG_FILTER_CLK_EN_CFG__DACR_SDM_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACR_HBF2I_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACR_AGC_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_SDM_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_HBF2I_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_AGC_EN);
+        val |= (HII2S_DIG_FILTER_CLK_EN_CFG__DACR_MIXER_EN |
+                HII2S_DIG_FILTER_CLK_EN_CFG__DACL_MIXER_EN);
+        hi6210_write_reg(i2s, HII2S_DIG_FILTER_CLK_EN_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_DIG_FILTER_MODULE_CFG);
+        val &= ~(HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN2_MUTE |
+                 HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN2_MUTE);
+        hi6210_write_reg(i2s, HII2S_DIG_FILTER_MODULE_CFG, val);
+
+        val = hi6210_read_reg(i2s, HII2S_MUX_TOP_MODULE_CFG);
+        val &= ~(HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN1_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN2_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN1_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN2_MUTE);
+        hi6210_write_reg(i2s, HII2S_MUX_TOP_MODULE_CFG, val);
+
+
+        switch (i2s->format & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                i2s->master = false;
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_MST_SLV;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                i2s->master = true;
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_MST_SLV;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        default:
+                WARN_ONCE(1, "Invalid i2s->fmt MASTER_MASK. This shouldn't happen\n");
+                return -EINVAL;
+        }
+
+        switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                fmt = HII2S_FORMAT_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                fmt = HII2S_FORMAT_LEFT_JUST;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                fmt = HII2S_FORMAT_RIGHT_JUST;
+                break;
+        default:
+                WARN_ONCE(1, "Invalid i2s->fmt FORMAT_MASK. This shouldn't happen\n");
+                return -EINVAL;
+        }
+
+        val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+        val &= ~(HII2S_I2S_CFG__S2_FUNC_MODE_MASK <<
+                        HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT);
+        val |= fmt << HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT;
+        hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_CLK_SEL);
+        val &= ~(HII2S_CLK_SEL__I2S_BT_FM_SEL | /* BT gets the I2S */
+                        HII2S_CLK_SEL__EXT_12_288MHZ_SEL);
+        hi6210_write_reg(i2s, HII2S_CLK_SEL, val);
+
+        dma_data->maxburst = 2;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                dma_data->addr = i2s->base_phys + HII2S_ST_DL_CHANNEL;
+        else
+                dma_data->addr = i2s->base_phys + HII2S_STEREO_UPLINK_CHANNEL;
+
+        switch (i2s->channels) {
+        case 1:
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_FRAME_MODE;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        default:
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_FRAME_MODE;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        }
+
+        /* clear loopback, set signed type and word length */
+        val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+        val &= ~HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+        val &= ~(HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_MASK <<
+                        HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT);
+        val &= ~(HII2S_I2S_CFG__S2_DIRECT_LOOP_MASK <<
+                        HII2S_I2S_CFG__S2_DIRECT_LOOP_SHIFT);
+        val |= signed_data;
+        val |= (bits << HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT);
+        hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+
+
+        if (!i2s->master)
+                return 0;
+
+        /* set DAC and related units to correct rate */
+        val = hi6210_read_reg(i2s, HII2S_FS_CFG);
+        val &= ~(HII2S_FS_CFG__FS_S2_MASK << HII2S_FS_CFG__FS_S2_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_DACLR_MASK << HII2S_FS_CFG__FS_DACLR_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_ST_DL_R_MASK <<
+                                        HII2S_FS_CFG__FS_ST_DL_R_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_ST_DL_L_MASK <<
+                                        HII2S_FS_CFG__FS_ST_DL_L_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_S2_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_DACLR_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_ST_DL_R_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_ST_DL_L_SHIFT);
+        hi6210_write_reg(i2s, HII2S_FS_CFG, val);
+
+        return 0;
+}
+
+static int hi6210_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+                          struct snd_soc_dai *cpu_dai)
+{
+        pr_debug("%s\n", __func__);
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        hi6210_i2s_rxctrl(cpu_dai, 1);
+                else
+                        hi6210_i2s_txctrl(cpu_dai, 1);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        hi6210_i2s_rxctrl(cpu_dai, 0);
+                else
+                        hi6210_i2s_txctrl(cpu_dai, 0);
+                break;
+        default:
+                dev_err(cpu_dai->dev, "uknown cmd\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int hi6210_i2s_dai_probe(struct snd_soc_dai *dai)
+{
+        struct hi6210_i2s *i2s = snd_soc_dai_get_drvdata(dai);
+
+        snd_soc_dai_init_dma_data(dai,
+                                  &i2s->dma_data[SNDRV_PCM_STREAM_PLAYBACK],
+                                  &i2s->dma_data[SNDRV_PCM_STREAM_CAPTURE]);
+
+        return 0;
+}
+
+
+static struct snd_soc_dai_ops hi6210_i2s_dai_ops = {
+        .trigger        = hi6210_i2s_trigger,
+        .hw_params      = hi6210_i2s_hw_params,
+        .set_fmt        = hi6210_i2s_set_fmt,
+        .startup        = hi6210_i2s_startup,
+        .shutdown       = hi6210_i2s_shutdown,
+};
+
+struct snd_soc_dai_driver hi6210_i2s_dai_init = {
+        .probe          = hi6210_i2s_dai_probe,
+        .playback = {
+                .channels_min = 2,
+                .channels_max = 2,
+                .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                           SNDRV_PCM_FMTBIT_U16_LE,
+                .rates = SNDRV_PCM_RATE_48000,
+        },
+        .capture = {
+                .channels_min = 2,
+                .channels_max = 2,
+                .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                           SNDRV_PCM_FMTBIT_U16_LE,
+                .rates = SNDRV_PCM_RATE_48000,
+        },
+        .ops = &hi6210_i2s_dai_ops,
+};
+
+static const struct snd_soc_component_driver hi6210_i2s_i2s_comp = {
+        .name = "hi6210_i2s-i2s",
+};
+
+static int hi6210_i2s_probe(struct platform_device *pdev)
+{
+        struct device_node *node = pdev->dev.of_node;
+        struct device *dev = &pdev->dev;
+        struct hi6210_i2s *i2s;
+        struct resource *res;
+        int ret;
+
+        i2s = devm_kzalloc(&pdev->dev, sizeof(*i2s), GFP_KERNEL);
+        if (!i2s)
+                return -ENOMEM;
+
+        i2s->dev = dev;
+        spin_lock_init(&i2s->lock);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        i2s->base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(i2s->base))
+                return PTR_ERR(i2s->base);
+
+        i2s->base_phys = (phys_addr_t)res->start;
+        i2s->dai = hi6210_i2s_dai_init;
+
+        dev_set_drvdata(&pdev->dev, i2s);
+
+        i2s->sysctrl = syscon_regmap_lookup_by_phandle(node,
+                                                "hisilicon,sysctrl-syscon");
+        if (IS_ERR(i2s->sysctrl))
+                return PTR_ERR(i2s->sysctrl);
+
+        i2s->clk[CLK_DACODEC] = devm_clk_get(&pdev->dev, "dacodec");
+        if (IS_ERR_OR_NULL(i2s->clk[CLK_DACODEC]))
+                return PTR_ERR(i2s->clk[CLK_DACODEC]);
+        i2s->clocks++;
+
+        i2s->clk[CLK_I2S_BASE] = devm_clk_get(&pdev->dev, "i2s-base");
+        if (IS_ERR_OR_NULL(i2s->clk[CLK_I2S_BASE]))
+                return PTR_ERR(i2s->clk[CLK_I2S_BASE]);
+        i2s->clocks++;
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+        if (ret)
+                return ret;
+
+        ret = devm_snd_soc_register_component(&pdev->dev, &hi6210_i2s_i2s_comp,
+                                         &i2s->dai, 1);
+        return ret;
+}
+
+static const struct of_device_id hi6210_i2s_dt_ids[] = {
+        { .compatible = "hisilicon,hi6210-i2s" },
+        { /* sentinel */ }
+};
+
+MODULE_DEVICE_TABLE(of, hi6210_i2s_dt_ids);
+
+static struct platform_driver hi6210_i2s_driver = {
+        .probe = hi6210_i2s_probe,
+        .driver = {
+                .name = "hi6210_i2s",
+                .of_match_table = hi6210_i2s_dt_ids,
+        },
+};
+
+module_platform_driver(hi6210_i2s_driver);
+
+MODULE_DESCRIPTION("Hisilicon HI6210 I2S driver");
+MODULE_AUTHOR("Andy Green <andy.green@linaro.org>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/hisilicon/hi6210-i2s.h b/sound/soc/hisilicon/hi6210-i2s.h
new file mode 100644
index 000000000000..85cecc4939a0
--- /dev/null
+++ b/sound/soc/hisilicon/hi6210-i2s.h
@@ -0,0 +1,276 @@
+/*
+ * linux/sound/soc/hisilicon/hi6210-i2s.h
+ *
+ * Copyright (C) 2015 Linaro, Ltd
+ * Author: Andy Green <andy.green@linaro.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Note at least on 6220, S2 == BT, S1 == Digital FM Radio IF
+ */
+
+#ifndef _HI6210_I2S_H
+#define _HI6210_I2S_H
+
+#define HII2S_SW_RST_N                          0
+
+#define HII2S_SW_RST_N__STEREO_UPLINK_WORDLEN_SHIFT                     28
+#define HII2S_SW_RST_N__STEREO_UPLINK_WORDLEN_MASK                      3
+#define HII2S_SW_RST_N__THIRDMD_UPLINK_WORDLEN_SHIFT                    26
+#define HII2S_SW_RST_N__THIRDMD_UPLINK_WORDLEN_MASK                     3
+#define HII2S_SW_RST_N__VOICE_UPLINK_WORDLEN_SHIFT                      24
+#define HII2S_SW_RST_N__VOICE_UPLINK_WORDLEN_MASK                       3
+#define HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT                             20
+#define HII2S_SW_RST_N__ST_DL_WORDLEN_MASK                              3
+#define HII2S_SW_RST_N__THIRDMD_DLINK_WORDLEN_SHIFT                     18
+#define HII2S_SW_RST_N__THIRDMD_DLINK_WORDLEN_MASK                      3
+#define HII2S_SW_RST_N__VOICE_DLINK_WORDLEN_SHIFT                       16
+#define HII2S_SW_RST_N__VOICE_DLINK_WORDLEN_MASK                        3
+
+#define HII2S_SW_RST_N__SW_RST_N                                        BIT(0)
+
+enum hi6210_bits {
+        HII2S_BITS_16,
+        HII2S_BITS_18,
+        HII2S_BITS_20,
+        HII2S_BITS_24,
+};
+
+
+#define HII2S_IF_CLK_EN_CFG                     4
+
+#define HII2S_IF_CLK_EN_CFG__THIRDMD_UPLINK_EN                          BIT(25)
+#define HII2S_IF_CLK_EN_CFG__THIRDMD_DLINK_EN                           BIT(24)
+#define HII2S_IF_CLK_EN_CFG__S3_IF_CLK_EN                               BIT(20)
+#define HII2S_IF_CLK_EN_CFG__S2_IF_CLK_EN                               BIT(16)
+#define HII2S_IF_CLK_EN_CFG__S2_OL_MIXER_EN                             BIT(15)
+#define HII2S_IF_CLK_EN_CFG__S2_OL_SRC_EN                               BIT(14)
+#define HII2S_IF_CLK_EN_CFG__S2_IR_PGA_EN                               BIT(13)
+#define HII2S_IF_CLK_EN_CFG__S2_IL_PGA_EN                               BIT(12)
+#define HII2S_IF_CLK_EN_CFG__S1_IR_PGA_EN                               BIT(10)
+#define HII2S_IF_CLK_EN_CFG__S1_IL_PGA_EN                               BIT(9)
+#define HII2S_IF_CLK_EN_CFG__S1_IF_CLK_EN                               BIT(8)
+#define HII2S_IF_CLK_EN_CFG__VOICE_DLINK_SRC_EN                         BIT(7)
+#define HII2S_IF_CLK_EN_CFG__VOICE_DLINK_EN                             BIT(6)
+#define HII2S_IF_CLK_EN_CFG__ST_DL_R_EN                                 BIT(5)
+#define HII2S_IF_CLK_EN_CFG__ST_DL_L_EN                                 BIT(4)
+#define HII2S_IF_CLK_EN_CFG__VOICE_UPLINK_R_EN                          BIT(3)
+#define HII2S_IF_CLK_EN_CFG__VOICE_UPLINK_L_EN                          BIT(2)
+#define HII2S_IF_CLK_EN_CFG__STEREO_UPLINK_R_EN                         BIT(1)
+#define HII2S_IF_CLK_EN_CFG__STEREO_UPLINK_L_EN                         BIT(0)
+
+#define HII2S_DIG_FILTER_CLK_EN_CFG             8
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_SDM_EN                        BIT(30)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_HBF2I_EN                      BIT(28)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_MIXER_EN                      BIT(25)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_AGC_EN                        BIT(24)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_SDM_EN                        BIT(22)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_HBF2I_EN                      BIT(20)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_MIXER_EN                      BIT(17)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_AGC_EN                        BIT(16)
+
+#define HII2S_FS_CFG                            0xc
+
+#define HII2S_FS_CFG__FS_S2_SHIFT                                       28
+#define HII2S_FS_CFG__FS_S2_MASK                                        7
+#define HII2S_FS_CFG__FS_S1_SHIFT                                       24
+#define HII2S_FS_CFG__FS_S1_MASK                                        7
+#define HII2S_FS_CFG__FS_ADCLR_SHIFT                                    20
+#define HII2S_FS_CFG__FS_ADCLR_MASK                                     7
+#define HII2S_FS_CFG__FS_DACLR_SHIFT                                    16
+#define HII2S_FS_CFG__FS_DACLR_MASK                                     7
+#define HII2S_FS_CFG__FS_ST_DL_R_SHIFT                                  8
+#define HII2S_FS_CFG__FS_ST_DL_R_MASK                                   7
+#define HII2S_FS_CFG__FS_ST_DL_L_SHIFT                                  4
+#define HII2S_FS_CFG__FS_ST_DL_L_MASK                                   7
+#define HII2S_FS_CFG__FS_VOICE_DLINK_SHIFT                              0
+#define HII2S_FS_CFG__FS_VOICE_DLINK_MASK                               7
+
+enum hi6210_i2s_rates {
+        HII2S_FS_RATE_8KHZ = 0,
+        HII2S_FS_RATE_16KHZ = 1,
+        HII2S_FS_RATE_32KHZ = 2,
+        HII2S_FS_RATE_48KHZ = 4,
+        HII2S_FS_RATE_96KHZ = 5,
+        HII2S_FS_RATE_192KHZ = 6,
+};
+
+#define HII2S_I2S_CFG                           0x10
+
+#define HII2S_I2S_CFG__S2_IF_TX_EN                                      BIT(31)
+#define HII2S_I2S_CFG__S2_IF_RX_EN                                      BIT(30)
+#define HII2S_I2S_CFG__S2_FRAME_MODE                                    BIT(29)
+#define HII2S_I2S_CFG__S2_MST_SLV                                       BIT(28)
+#define HII2S_I2S_CFG__S2_LRCK_MODE                                     BIT(27)
+#define HII2S_I2S_CFG__S2_CHNNL_MODE                                    BIT(26)
+#define HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT                     24
+#define HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_MASK                      3
+#define HII2S_I2S_CFG__S2_DIRECT_LOOP_SHIFT                             22
+#define HII2S_I2S_CFG__S2_DIRECT_LOOP_MASK                              3
+#define HII2S_I2S_CFG__S2_TX_CLK_SEL                                    BIT(21)
+#define HII2S_I2S_CFG__S2_RX_CLK_SEL                                    BIT(20)
+#define HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT                             BIT(19)
+#define HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT                               16
+#define HII2S_I2S_CFG__S2_FUNC_MODE_MASK                                7
+#define HII2S_I2S_CFG__S1_IF_TX_EN                                      BIT(15)
+#define HII2S_I2S_CFG__S1_IF_RX_EN                                      BIT(14)
+#define HII2S_I2S_CFG__S1_FRAME_MODE                                    BIT(13)
+#define HII2S_I2S_CFG__S1_MST_SLV                                       BIT(12)
+#define HII2S_I2S_CFG__S1_LRCK_MODE                                     BIT(11)
+#define HII2S_I2S_CFG__S1_CHNNL_MODE                                    BIT(10)
+#define HII2S_I2S_CFG__S1_CODEC_IO_WORDLENGTH_SHIFT                     8
+#define HII2S_I2S_CFG__S1_CODEC_IO_WORDLENGTH_MASK                      3
+#define HII2S_I2S_CFG__S1_DIRECT_LOOP_SHIFT                             6
+#define HII2S_I2S_CFG__S1_DIRECT_LOOP_MASK                              3
+#define HII2S_I2S_CFG__S1_TX_CLK_SEL                                    BIT(5)
+#define HII2S_I2S_CFG__S1_RX_CLK_SEL                                    BIT(4)
+#define HII2S_I2S_CFG__S1_CODEC_DATA_FORMAT                             BIT(3)
+#define HII2S_I2S_CFG__S1_FUNC_MODE_SHIFT                               0
+#define HII2S_I2S_CFG__S1_FUNC_MODE_MASK                                7
+
+enum hi6210_i2s_formats {
+        HII2S_FORMAT_I2S,
+        HII2S_FORMAT_PCM_STD,
+        HII2S_FORMAT_PCM_USER,
+        HII2S_FORMAT_LEFT_JUST,
+        HII2S_FORMAT_RIGHT_JUST,
+};
+
+#define HII2S_DIG_FILTER_MODULE_CFG             0x14
+
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_GAIN_SHIFT              28
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_GAIN_MASK               3
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN4_MUTE                BIT(27)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN3_MUTE                BIT(26)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN2_MUTE                BIT(25)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN1_MUTE                BIT(24)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_GAIN_SHIFT              20
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_GAIN_MASK               3
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN4_MUTE                BIT(19)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN3_MUTE                BIT(18)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN2_MUTE                BIT(17)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN1_MUTE                BIT(16)
+#define HII2S_DIG_FILTER_MODULE_CFG__SW_DACR_SDM_DITHER                 BIT(9)
+#define HII2S_DIG_FILTER_MODULE_CFG__SW_DACL_SDM_DITHER                 BIT(8)
+#define HII2S_DIG_FILTER_MODULE_CFG__LM_CODEC_DAC2ADC_SHIFT             4
+#define HII2S_DIG_FILTER_MODULE_CFG__LM_CODEC_DAC2ADC_MASK              7
+#define HII2S_DIG_FILTER_MODULE_CFG__RM_CODEC_DAC2ADC_SHIFT             0
+#define HII2S_DIG_FILTER_MODULE_CFG__RM_CODEC_DAC2ADC_MASK              7
+
+enum hi6210_gains {
+        HII2S_GAIN_100PC,
+        HII2S_GAIN_50PC,
+        HII2S_GAIN_25PC,
+};
+
+#define HII2S_MUX_TOP_MODULE_CFG                0x18
+
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_GAIN_SHIFT          14
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_GAIN_MASK           3
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN2_MUTE            BIT(13)
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN1_MUTE            BIT(12)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_GAIN_SHIFT                10
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_GAIN_MASK                 3
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN2_MUTE                  BIT(9)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN1_MUTE                  BIT(8)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_RDY                         BIT(6)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_MODE_SHIFT                  4
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_MODE_MASK                   3
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_RDY                   BIT(3)
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_MODE_SHIFT            0
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_MODE_MASK             7
+
+enum hi6210_s2_src_mode {
+        HII2S_S2_SRC_MODE_3,
+        HII2S_S2_SRC_MODE_12,
+        HII2S_S2_SRC_MODE_6,
+        HII2S_S2_SRC_MODE_2,
+};
+
+enum hi6210_voice_dlink_src_mode {
+        HII2S_VOICE_DL_SRC_MODE_12 = 1,
+        HII2S_VOICE_DL_SRC_MODE_6,
+        HII2S_VOICE_DL_SRC_MODE_2,
+        HII2S_VOICE_DL_SRC_MODE_3,
+};
+
+#define HII2S_ADC_PGA_CFG                       0x1c
+#define HII2S_S1_INPUT_PGA_CFG                  0x20
+#define HII2S_S2_INPUT_PGA_CFG                  0x24
+#define HII2S_ST_DL_PGA_CFG                     0x28
+#define HII2S_VOICE_SIDETONE_DLINK_PGA_CFG      0x2c
+#define HII2S_APB_AFIFO_CFG_1                   0x30
+#define HII2S_APB_AFIFO_CFG_2                   0x34
+#define HII2S_ST_DL_FIFO_TH_CFG                 0x38
+
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT                   24
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_MASK                    0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT                    16
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_MASK                     0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT                   8
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_MASK                    0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT                    0
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_MASK                     0x1f
+
+#define HII2S_STEREO_UPLINK_FIFO_TH_CFG         0x3c
+#define HII2S_VOICE_UPLINK_FIFO_TH_CFG          0x40
+#define HII2S_CODEC_IRQ_MASK                    0x44
+#define HII2S_CODEC_IRQ                         0x48
+#define HII2S_DACL_AGC_CFG_1                    0x4c
+#define HII2S_DACL_AGC_CFG_2                    0x50
+#define HII2S_DACR_AGC_CFG_1                    0x54
+#define HII2S_DACR_AGC_CFG_2                    0x58
+#define HII2S_DMIC_SIF_CFG                      0x5c
+#define HII2S_MISC_CFG                          0x60
+
+#define HII2S_MISC_CFG__THIRDMD_DLINK_TEST_SEL                          BIT(17)
+#define HII2S_MISC_CFG__THIRDMD_DLINK_DIN_SEL                           BIT(16)
+#define HII2S_MISC_CFG__S3_DOUT_RIGHT_SEL                               BIT(14)
+#define HII2S_MISC_CFG__S3_DOUT_LEFT_SEL                                BIT(13)
+#define HII2S_MISC_CFG__S3_DIN_TEST_SEL                                 BIT(12)
+#define HII2S_MISC_CFG__VOICE_DLINK_SRC_UP_DOUT_VLD_SEL                 BIT(8)
+#define HII2S_MISC_CFG__VOICE_DLINK_TEST_SEL                            BIT(7)
+#define HII2S_MISC_CFG__VOICE_DLINK_DIN_SEL                             BIT(6)
+#define HII2S_MISC_CFG__ST_DL_TEST_SEL                                  BIT(4)
+#define HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL                               BIT(3)
+#define HII2S_MISC_CFG__S2_DOUT_TEST_SEL                                BIT(2)
+#define HII2S_MISC_CFG__S1_DOUT_TEST_SEL                                BIT(1)
+#define HII2S_MISC_CFG__S2_DOUT_LEFT_SEL                                BIT(0)
+
+#define HII2S_S2_SRC_CFG                        0x64
+#define HII2S_MEM_CFG                           0x68
+#define HII2S_THIRDMD_PCM_PGA_CFG               0x6c
+#define HII2S_THIRD_MODEM_FIFO_TH               0x70
+#define HII2S_S3_ANTI_FREQ_JITTER_TX_INC_CNT    0x74
+#define HII2S_S3_ANTI_FREQ_JITTER_TX_DEC_CNT    0x78
+#define HII2S_S3_ANTI_FREQ_JITTER_RX_INC_CNT    0x7c
+#define HII2S_S3_ANTI_FREQ_JITTER_RX_DEC_CNT    0x80
+#define HII2S_ANTI_FREQ_JITTER_EN               0x84
+#define HII2S_CLK_SEL                           0x88
+
+/* 0 = BT owns the i2s */
+#define HII2S_CLK_SEL__I2S_BT_FM_SEL                                    BIT(0)
+/* 0 = internal source, 1 = ext */
+#define HII2S_CLK_SEL__EXT_12_288MHZ_SEL                                BIT(1)
+
+
+#define HII2S_THIRDMD_DLINK_CHANNEL             0xe8
+#define HII2S_THIRDMD_ULINK_CHANNEL             0xec
+#define HII2S_VOICE_DLINK_CHANNEL               0xf0
+
+/* shovel data in here for playback */
+#define HII2S_ST_DL_CHANNEL                     0xf4
+#define HII2S_STEREO_UPLINK_CHANNEL             0xf8
+#define HII2S_VOICE_UPLINK_CHANNEL              0xfc
+
+#endif/* _HI6210_I2S_H */
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 526855ad479e..67968ef3bbda 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -202,6 +202,30 @@ config SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH
           platforms with MAX98090 audio codec it also can support TI jack chip as aux device.
           If unsure select "N".
 
+config SND_SOC_INTEL_BYT_CHT_DA7213_MACH
+        tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail with DA7212/7213 codec"
+        depends on X86_INTEL_LPSS && I2C && ACPI
+        select SND_SOC_DA7213
+        select SND_SST_ATOM_HIFI2_PLATFORM
+        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
+        help
+          This adds support for ASoC machine driver for Intel(R) Baytrail & CherryTrail
+          platforms with DA7212/7213 audio codec.
+          If unsure select "N".
+
+config SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH
+        tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail platform with no codec (MinnowBoard MAX, Up)"
+        depends on X86_INTEL_LPSS && I2C && ACPI
+        select SND_SST_ATOM_HIFI2_PLATFORM
+        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
+        help
+          This adds support for ASoC machine driver for the MinnowBoard Max or
+          Up boards and provides access to I2S signals on the Low-Speed
+          connector
+          If unsure select "N".
+
 config SND_SOC_INTEL_SKYLAKE
         tristate
         select SND_HDA_EXT_CORE
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 747c0f393d2d..dd250b8b26f2 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -420,7 +420,21 @@ static const struct dmi_system_id byt_table[] = {
                 .callback = byt_thinkpad10_quirk_cb,
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "20C3001VHH"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 10"),
+                },
+        },
+        {
+                .callback = byt_thinkpad10_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Tablet B"),
+                },
+        },
+        {
+                .callback = byt_thinkpad10_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
                 },
         },
         { }
@@ -480,12 +494,23 @@ static struct sst_acpi_mach sst_acpi_bytcr[] = {
                                                 &byt_rvp_platform_data },
         {"10EC5651", "bytcr_rt5651", "intel/fw_sst_0f28.bin", "bytcr_rt5651", NULL,
                                                 &byt_rvp_platform_data },
+        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
+                                                &byt_rvp_platform_data },
+        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
+                                                &byt_rvp_platform_data },
         /* some Baytrail platforms rely on RT5645, use CHT machine driver */
         {"10EC5645", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
                                                 &byt_rvp_platform_data },
         {"10EC5648", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
                                                 &byt_rvp_platform_data },
-
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
+        /*
+         * This is always last in the table so that it is selected only when
+         * enabled explicitly and there is no codec-related information in SSDT
+         */
+        {"80860F28", "bytcht_nocodec", "intel/fw_sst_0f28.bin", "bytcht_nocodec", NULL,
+                                                &byt_rvp_platform_data },
+#endif
         {},
 };
 
@@ -504,6 +529,10 @@ static struct sst_acpi_mach sst_acpi_chv[] = {
 
         {"193C9890", "cht-bsw-max98090", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
                                                 &chv_platform_data },
+        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
+                                                &chv_platform_data },
+        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
+                                                &chv_platform_data },
         /* some CHT-T platforms rely on RT5640, use Baytrail machine driver */
         {"10EC5640", "bytcr_rt5640", "intel/fw_sst_22a8.bin", "bytcr_rt5640", cht_quirk,
                                                 &chv_platform_data },
@@ -512,6 +541,14 @@ static struct sst_acpi_mach sst_acpi_chv[] = {
         /* some CHT-T platforms rely on RT5651, use Baytrail machine driver */
         {"10EC5651", "bytcr_rt5651", "intel/fw_sst_22a8.bin", "bytcr_rt5651", NULL,
                                                 &chv_platform_data },
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
+        /*
+         * This is always last in the table so that it is selected only when
+         * enabled explicitly and there is no codec-related information in SSDT
+         */
+        {"808622A8", "bytcht_nocodec", "intel/fw_sst_22a8.bin", "bytcht_nocodec", NULL,
+                                                &chv_platform_data },
+#endif
         {},
 };
 
diff --git a/sound/soc/intel/atom/sst/sst_ipc.c b/sound/soc/intel/atom/sst/sst_ipc.c
index 14c2d9d18180..20b01e02ed8f 100644
--- a/sound/soc/intel/atom/sst/sst_ipc.c
+++ b/sound/soc/intel/atom/sst/sst_ipc.c
@@ -236,7 +236,9 @@ static void process_fw_init(struct intel_sst_drv *sst_drv_ctx,
                 retval = init->result;
                 goto ret;
         }
-        dev_info(sst_drv_ctx->dev, "FW Version %02x.%02x.%02x.%02x\n",
+        if (memcmp(&sst_drv_ctx->fw_version, &init->fw_version,
+                   sizeof(init->fw_version)))
+                dev_info(sst_drv_ctx->dev, "FW Version %02x.%02x.%02x.%02x\n",
                         init->fw_version.type, init->fw_version.major,
                         init->fw_version.minor, init->fw_version.build);
         dev_dbg(sst_drv_ctx->dev, "Build date %s Time %s\n",
diff --git a/sound/soc/intel/boards/Makefile b/sound/soc/intel/boards/Makefile
index 5639f10774e6..56896e09445d 100644
--- a/sound/soc/intel/boards/Makefile
+++ b/sound/soc/intel/boards/Makefile
@@ -10,6 +10,8 @@ snd-soc-sst-bytcr-rt5651-objs := bytcr_rt5651.o
 snd-soc-sst-cht-bsw-rt5672-objs := cht_bsw_rt5672.o
 snd-soc-sst-cht-bsw-rt5645-objs := cht_bsw_rt5645.o
 snd-soc-sst-cht-bsw-max98090_ti-objs := cht_bsw_max98090_ti.o
+snd-soc-sst-byt-cht-da7213-objs := bytcht_da7213.o
+snd-soc-sst-byt-cht-nocodec-objs := bytcht_nocodec.o
 snd-soc-skl_rt286-objs := skl_rt286.o
 snd-skl_nau88l25_max98357a-objs := skl_nau88l25_max98357a.o
 snd-soc-skl_nau88l25_ssm4567-objs := skl_nau88l25_ssm4567.o
@@ -26,6 +28,8 @@ obj-$(CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH) += snd-soc-sst-bytcr-rt5651.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH) += snd-soc-sst-cht-bsw-rt5672.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH) += snd-soc-sst-cht-bsw-rt5645.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH) += snd-soc-sst-cht-bsw-max98090_ti.o
+obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH) += snd-soc-sst-byt-cht-da7213.o
+obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH) += snd-soc-sst-byt-cht-nocodec.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_RT286_MACH) += snd-soc-skl_rt286.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH) += snd-skl_nau88l25_max98357a.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH) += snd-soc-skl_nau88l25_ssm4567.o
diff --git a/sound/soc/intel/boards/bdw-rt5677.c b/sound/soc/intel/boards/bdw-rt5677.c
index 53c6b4cbb1e1..14d9693c1641 100644
--- a/sound/soc/intel/boards/bdw-rt5677.c
+++ b/sound/soc/intel/boards/bdw-rt5677.c
@@ -193,13 +193,12 @@ static int bdw_rt5677_init(struct snd_soc_pcm_runtime *rtd)
                         RT5677_CLK_SEL_I2S1_ASRC);
 
         /* Request rt5677 GPIO for headphone amp control */
-        bdw_rt5677->gpio_hp_en = devm_gpiod_get_index(codec->dev,
-                        "headphone-enable", 0, 0);
+        bdw_rt5677->gpio_hp_en = devm_gpiod_get(codec->dev, "headphone-enable",
+                                                GPIOD_OUT_LOW);
         if (IS_ERR(bdw_rt5677->gpio_hp_en)) {
                 dev_err(codec->dev, "Can't find HP_AMP_SHDN_L gpio\n");
                 return PTR_ERR(bdw_rt5677->gpio_hp_en);
         }
-        gpiod_direction_output(bdw_rt5677->gpio_hp_en, 0);
 
         /* Create and initialize headphone jack */
         if (!snd_soc_card_jack_new(rtd->card, "Headphone Jack",
diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
index faf865bb1765..6dcbbcefc25b 100644
--- a/sound/soc/intel/boards/broadwell.c
+++ b/sound/soc/intel/boards/broadwell.c
@@ -269,9 +269,6 @@ static struct snd_soc_card broadwell_rt286 = {
 static int broadwell_audio_probe(struct platform_device *pdev)
 {
         broadwell_rt286.dev = &pdev->dev;
-
-        snd_soc_set_dmi_name(&broadwell_rt286, NULL);
-
         return devm_snd_soc_register_card(&pdev->dev, &broadwell_rt286);
 }
 
diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
index 2cda06cde4d1..3a8c4d954a91 100644
--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -55,6 +55,54 @@ enum {
         BXT_DPCM_AUDIO_HDMI3_PB,
 };
 
+static inline struct snd_soc_dai *bxt_get_codec_dai(struct snd_soc_card *card)
+{
+        struct snd_soc_pcm_runtime *rtd;
+
+        list_for_each_entry(rtd, &card->rtd_list, list) {
+
+                if (!strncmp(rtd->codec_dai->name, BXT_DIALOG_CODEC_DAI,
+                             strlen(BXT_DIALOG_CODEC_DAI)))
+                        return rtd->codec_dai;
+        }
+
+        return NULL;
+}
+
+static int platform_clock_control(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *k, int  event)
+{
+        int ret = 0;
+        struct snd_soc_dapm_context *dapm = w->dapm;
+        struct snd_soc_card *card = dapm->card;
+        struct snd_soc_dai *codec_dai;
+
+        codec_dai = bxt_get_codec_dai(card);
+        if (!codec_dai) {
+                dev_err(card->dev, "Codec dai not found; Unable to set/unset codec pll\n");
+                return -EIO;
+        }
+
+        if (SND_SOC_DAPM_EVENT_OFF(event)) {
+                ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7219_SYSCLK_MCLK, 0, 0);
+                if (ret)
+                        dev_err(card->dev, "failed to stop PLL: %d\n", ret);
+        } else if(SND_SOC_DAPM_EVENT_ON(event)) {
+                ret = snd_soc_dai_set_sysclk(codec_dai,
+                        DA7219_CLKSRC_MCLK, 19200000, SND_SOC_CLOCK_IN);
+                if (ret)
+                        dev_err(card->dev, "can't set codec sysclk configuration\n");
+
+                ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7219_SYSCLK_PLL_SRM, 0, DA7219_PLL_FREQ_OUT_98304);
+                if (ret)
+                        dev_err(card->dev, "failed to start PLL: %d\n", ret);
+        }
+
+        return ret;
+}
+
 static const struct snd_kcontrol_new broxton_controls[] = {
         SOC_DAPM_PIN_SWITCH("Headphone Jack"),
         SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -69,6 +117,8 @@ static const struct snd_soc_dapm_widget broxton_widgets[] = {
         SND_SOC_DAPM_SPK("HDMI1", NULL),
         SND_SOC_DAPM_SPK("HDMI2", NULL),
         SND_SOC_DAPM_SPK("HDMI3", NULL),
+        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
+                        platform_clock_control, SND_SOC_DAPM_POST_PMD|SND_SOC_DAPM_PRE_PMU),
 };
 
 static const struct snd_soc_dapm_route broxton_map[] = {
@@ -109,6 +159,9 @@ static const struct snd_soc_dapm_route broxton_map[] = {
         /* DMIC */
         {"dmic01_hifi", NULL, "DMIC01 Rx"},
         {"DMIC01 Rx", NULL, "DMIC AIF"},
+
+        { "Headphone Jack", NULL, "Platform Clock" },
+        { "Headset Mic", NULL, "Platform Clock" },
 };
 
 static int broxton_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
@@ -243,49 +296,6 @@ static const struct snd_soc_ops broxton_da7219_fe_ops = {
         .startup = bxt_fe_startup,
 };
 
-static int broxton_da7219_hw_params(struct snd_pcm_substream *substream,
-                                struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        int ret;
-
-        ret = snd_soc_dai_set_sysclk(codec_dai,
-                        DA7219_CLKSRC_MCLK, 19200000, SND_SOC_CLOCK_IN);
-        if (ret < 0)
-                dev_err(codec_dai->dev, "can't set codec sysclk configuration\n");
-
-        ret = snd_soc_dai_set_pll(codec_dai, 0,
-                        DA7219_SYSCLK_PLL_SRM, 0, DA7219_PLL_FREQ_OUT_98304);
-        if (ret < 0) {
-                dev_err(codec_dai->dev, "failed to start PLL: %d\n", ret);
-                return -EIO;
-        }
-
-        return ret;
-}
-
-static int broxton_da7219_hw_free(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        int ret;
-
-        ret = snd_soc_dai_set_pll(codec_dai, 0,
-                        DA7219_SYSCLK_MCLK, 0, 0);
-        if (ret < 0) {
-                dev_err(codec_dai->dev, "failed to stop PLL: %d\n", ret);
-                return -EIO;
-        }
-
-        return ret;
-}
-
-static const struct snd_soc_ops broxton_da7219_ops = {
-        .hw_params = broxton_da7219_hw_params,
-        .hw_free = broxton_da7219_hw_free,
-};
-
 static int broxton_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
                         struct snd_pcm_hw_params *params)
 {
@@ -467,7 +477,6 @@ static struct snd_soc_dai_link broxton_dais[] = {
                         SND_SOC_DAIFMT_CBS_CFS,
                 .ignore_pmdown_time = 1,
                 .be_hw_params_fixup = broxton_ssp_fixup,
-                .ops = &broxton_da7219_ops,
                 .dpcm_playback = 1,
                 .dpcm_capture = 1,
         },
diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
index 176c080a9818..1a68d043c803 100644
--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -274,12 +274,15 @@ static int bxt_fe_startup(struct snd_pcm_substream *substream)
          * on this platform for PCM device we support:
          *      48Khz
          *      stereo
+         *      16-bit audio
          */
 
         runtime->hw.channels_max = 2;
         snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
                                 &constraints_channels);
 
+        runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+        snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
         snd_pcm_hw_constraint_list(runtime, 0,
                                 SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
 
diff --git a/sound/soc/intel/boards/bytcht_da7213.c b/sound/soc/intel/boards/bytcht_da7213.c
new file mode 100644
index 000000000000..18873e23f404
--- /dev/null
+++ b/sound/soc/intel/boards/bytcht_da7213.c
@@ -0,0 +1,283 @@
+/*
+ *  bytcht-da7213.c - ASoc Machine driver for Intel Baytrail and
+ *             Cherrytrail-based platforms, with Dialog DA7213 codec
+ *
+ *  Copyright (C) 2017 Intel Corporation
+ *  Author: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/module.h>
+#include <linux/acpi.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <asm/platform_sst_audio.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../../codecs/da7213.h"
+#include "../atom/sst-atom-controls.h"
+#include "../common/sst-acpi.h"
+
+static const struct snd_kcontrol_new controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Mic"),
+        SOC_DAPM_PIN_SWITCH("Aux In"),
+};
+
+static const struct snd_soc_dapm_widget dapm_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone Jack", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_MIC("Mic", NULL),
+        SND_SOC_DAPM_LINE("Aux In", NULL),
+};
+
+static const struct snd_soc_dapm_route audio_map[] = {
+        {"Headphone Jack", NULL, "HPL"},
+        {"Headphone Jack", NULL, "HPR"},
+
+        {"AUXL", NULL, "Aux In"},
+        {"AUXR", NULL, "Aux In"},
+
+        /* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
+        {"MIC1", NULL, "Headset Mic"},
+        {"MIC2", NULL, "Mic"},
+
+        /* SOC-codec link */
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"Playback", NULL, "ssp2 Tx"},
+        {"ssp2 Rx", NULL, "Capture"},
+};
+
+static int codec_fixup(struct snd_soc_pcm_runtime *rtd,
+                       struct snd_pcm_hw_params *params)
+{
+        int ret;
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        /* The DSP will convert the FE rate to 48k, stereo, 24bits */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP2 to 24-bit */
+        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+        /*
+         * Default mode for SSP configuration is TDM 4 slot, override config
+         * with explicit setting to I2S 2ch 24-bit. The word length is set with
+         * dai_set_tdm_slot() since there is no other API exposed
+         */
+        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                  SND_SOC_DAIFMT_I2S     |
+                                  SND_SOC_DAIFMT_NB_NF   |
+                                  SND_SOC_DAIFMT_CBS_CFS);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int aif1_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_single(substream->runtime,
+                        SNDRV_PCM_HW_PARAM_RATE, 48000);
+}
+
+static int aif1_hw_params(struct snd_pcm_substream *substream,
+                          struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_sysclk(codec_dai, DA7213_CLKSRC_MCLK,
+                                     19200000, SND_SOC_CLOCK_IN);
+        if (ret < 0)
+                dev_err(codec_dai->dev, "can't set codec sysclk configuration\n");
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7213_SYSCLK_PLL_SRM, 0, DA7213_PLL_FREQ_OUT_98304000);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "failed to start PLL: %d\n", ret);
+                return -EIO;
+        }
+
+        return ret;
+}
+
+static int aif1_hw_free(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                  DA7213_SYSCLK_MCLK, 0, 0);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "failed to stop PLL: %d\n", ret);
+                return -EIO;
+        }
+
+        return ret;
+}
+
+static const struct snd_soc_ops aif1_ops = {
+        .startup = aif1_startup,
+};
+
+static const struct snd_soc_ops ssp2_ops = {
+        .hw_params = aif1_hw_params,
+        .hw_free = aif1_hw_free,
+
+};
+
+static struct snd_soc_dai_link dailink[] = {
+        [MERR_DPCM_AUDIO] = {
+                .name = "Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "media-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_DEEP_BUFFER] = {
+                .name = "Deep-Buffer Audio Port",
+                .stream_name = "Deep-Buffer Audio",
+                .cpu_dai_name = "deepbuffer-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_COMPR] = {
+                .name = "Compressed Port",
+                .stream_name = "Compress",
+                .cpu_dai_name = "compress-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+        },
+        /* CODEC<->CODEC link */
+        /* back ends */
+        {
+                .name = "SSP2-Codec",
+                .id = 1,
+                .cpu_dai_name = "ssp2-port",
+                .platform_name = "sst-mfld-platform",
+                .no_pcm = 1,
+                .codec_dai_name = "da7213-hifi",
+                .codec_name = "i2c-DLGS7213:00",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+                                                | SND_SOC_DAIFMT_CBS_CFS,
+                .be_hw_params_fixup = codec_fixup,
+                .nonatomic = true,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &ssp2_ops,
+        },
+};
+
+/* SoC card */
+static struct snd_soc_card bytcht_da7213_card = {
+        .name = "bytcht-da7213",
+        .owner = THIS_MODULE,
+        .dai_link = dailink,
+        .num_links = ARRAY_SIZE(dailink),
+        .controls = controls,
+        .num_controls = ARRAY_SIZE(controls),
+        .dapm_widgets = dapm_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(dapm_widgets),
+        .dapm_routes = audio_map,
+        .num_dapm_routes = ARRAY_SIZE(audio_map),
+};
+
+static char codec_name[16]; /* i2c-<HID>:00 with HID being 8 chars */
+
+static int bytcht_da7213_probe(struct platform_device *pdev)
+{
+        int ret_val = 0;
+        int i;
+        struct snd_soc_card *card;
+        struct sst_acpi_mach *mach;
+        const char *i2c_name = NULL;
+        int dai_index = 0;
+
+        mach = (&pdev->dev)->platform_data;
+        card = &bytcht_da7213_card;
+        card->dev = &pdev->dev;
+
+        /* fix index of codec dai */
+        dai_index = MERR_DPCM_COMPR + 1;
+        for (i = 0; i < ARRAY_SIZE(dailink); i++) {
+                if (!strcmp(dailink[i].codec_name, "i2c-DLGS7213:00")) {
+                        dai_index = i;
+                        break;
+                }
+        }
+
+        /* fixup codec name based on HID */
+        i2c_name = sst_acpi_find_name_from_hid(mach->id);
+        if (i2c_name != NULL) {
+                snprintf(codec_name, sizeof(codec_name),
+                        "%s%s", "i2c-", i2c_name);
+                dailink[dai_index].codec_name = codec_name;
+        }
+
+        ret_val = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret_val) {
+                dev_err(&pdev->dev,
+                        "snd_soc_register_card failed %d\n", ret_val);
+                return ret_val;
+        }
+        platform_set_drvdata(pdev, card);
+        return ret_val;
+}
+
+static struct platform_driver bytcht_da7213_driver = {
+        .driver = {
+                .name = "bytcht_da7213",
+        },
+        .probe = bytcht_da7213_probe,
+};
+module_platform_driver(bytcht_da7213_driver);
+
+MODULE_DESCRIPTION("ASoC Intel(R) Baytrail/Cherrytrail+DA7213 Machine driver");
+MODULE_AUTHOR("Pierre-Louis Bossart");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bytcht_da7213");
diff --git a/sound/soc/intel/boards/bytcht_nocodec.c b/sound/soc/intel/boards/bytcht_nocodec.c
new file mode 100644
index 000000000000..89853eeaaf9d
--- /dev/null
+++ b/sound/soc/intel/boards/bytcht_nocodec.c
@@ -0,0 +1,208 @@
+/*
+ *  bytcht_nocodec.c - ASoc Machine driver for MinnowBoard Max and Up
+ *  to make I2S signals observable on the Low-Speed connector. Audio codec
+ *  is not managed by ASoC/DAPM
+ *
+ *  Copyright (C) 2015-2017 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/module.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../atom/sst-atom-controls.h"
+
+static const struct snd_soc_dapm_widget widgets[] = {
+        SND_SOC_DAPM_MIC("Mic", NULL),
+        SND_SOC_DAPM_SPK("Speaker", NULL),
+};
+
+static const struct snd_kcontrol_new controls[] = {
+        SOC_DAPM_PIN_SWITCH("Mic"),
+        SOC_DAPM_PIN_SWITCH("Speaker"),
+};
+
+static const struct snd_soc_dapm_route audio_map[] = {
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"ssp2 Rx", NULL, "Mic"},
+        {"Speaker", NULL, "ssp2 Tx"},
+};
+
+static int codec_fixup(struct snd_soc_pcm_runtime *rtd,
+                            struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+        int ret;
+
+        /* The DSP will convert the FE rate to 48k, stereo, 24bits */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP2 to 24-bit */
+        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+        /*
+         * Default mode for SSP configuration is TDM 4 slot, override config
+         * with explicit setting to I2S 2ch 24-bit. The word length is set with
+         * dai_set_tdm_slot() since there is no other API exposed
+         */
+        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                  SND_SOC_DAIFMT_I2S     |
+                                  SND_SOC_DAIFMT_NB_NF   |
+                                  SND_SOC_DAIFMT_CBS_CFS);
+
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static unsigned int rates_48000[] = {
+        48000,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_48000 = {
+        .count = ARRAY_SIZE(rates_48000),
+        .list  = rates_48000,
+};
+
+static int aif1_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE,
+                        &constraints_48000);
+}
+
+static struct snd_soc_ops aif1_ops = {
+        .startup = aif1_startup,
+};
+
+static struct snd_soc_dai_link dais[] = {
+        [MERR_DPCM_AUDIO] = {
+                .name = "Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "media-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_DEEP_BUFFER] = {
+                .name = "Deep-Buffer Audio Port",
+                .stream_name = "Deep-Buffer Audio",
+                .cpu_dai_name = "deepbuffer-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_COMPR] = {
+                .name = "Compressed Port",
+                .stream_name = "Compress",
+                .cpu_dai_name = "compress-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+        },
+        /* CODEC<->CODEC link */
+        /* back ends */
+        {
+                .name = "SSP2-LowSpeed Connector",
+                .id = 1,
+                .cpu_dai_name = "ssp2-port",
+                .platform_name = "sst-mfld-platform",
+                .no_pcm = 1,
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+                                                | SND_SOC_DAIFMT_CBS_CFS,
+                .be_hw_params_fixup = codec_fixup,
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+};
+
+/* SoC card */
+static struct snd_soc_card bytcht_nocodec_card = {
+        .name = "bytcht-nocodec",
+        .owner = THIS_MODULE,
+        .dai_link = dais,
+        .num_links = ARRAY_SIZE(dais),
+        .dapm_widgets = widgets,
+        .num_dapm_widgets = ARRAY_SIZE(widgets),
+        .dapm_routes = audio_map,
+        .num_dapm_routes = ARRAY_SIZE(audio_map),
+        .controls = controls,
+        .num_controls = ARRAY_SIZE(controls),
+        .fully_routed = true,
+};
+
+static int snd_bytcht_nocodec_mc_probe(struct platform_device *pdev)
+{
+        int ret_val = 0;
+
+        /* register the soc card */
+        bytcht_nocodec_card.dev = &pdev->dev;
+
+        ret_val = devm_snd_soc_register_card(&pdev->dev, &bytcht_nocodec_card);
+
+        if (ret_val) {
+                dev_err(&pdev->dev, "devm_snd_soc_register_card failed %d\n",
+                        ret_val);
+                return ret_val;
+        }
+        platform_set_drvdata(pdev, &bytcht_nocodec_card);
+        return ret_val;
+}
+
+static struct platform_driver snd_bytcht_nocodec_mc_driver = {
+        .driver = {
+                .name = "bytcht_nocodec",
+        },
+        .probe = snd_bytcht_nocodec_mc_probe,
+};
+module_platform_driver(snd_bytcht_nocodec_mc_driver);
+
+MODULE_DESCRIPTION("ASoC Intel(R) Baytrail/Cherrytrail Nocodec Machine driver");
+MODULE_AUTHOR("Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bytcht_nocodec");
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 9e2a3404a836..4a76b099a508 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -19,6 +19,7 @@
 
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/platform_device.h>
 #include <linux/acpi.h>
 #include <linux/device.h>
@@ -56,35 +57,88 @@ enum {
 struct byt_rt5640_private {
         struct clk *mclk;
 };
+static bool is_bytcr;
 
 static unsigned long byt_rt5640_quirk = BYT_RT5640_MCLK_EN;
+static unsigned int quirk_override;
+module_param_named(quirk, quirk_override, uint, 0444);
+MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC1_MAP)
-                dev_info(dev, "quirk DMIC1_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC2_MAP)
-                dev_info(dev, "quirk DMIC2_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN1_MAP)
-                dev_info(dev, "quirk IN1_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN3_MAP)
-                dev_info(dev, "quirk IN3_MAP enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN)
-                dev_info(dev, "quirk DMIC enabled");
+        int map;
+        bool has_dmic = false;
+        bool has_mclk = false;
+        bool has_ssp0 = false;
+        bool has_ssp0_aif1 = false;
+        bool has_ssp0_aif2 = false;
+        bool has_ssp2_aif2 = false;
+
+        map = BYT_RT5640_MAP(byt_rt5640_quirk);
+        switch (map) {
+        case BYT_RT5640_DMIC1_MAP:
+                dev_info(dev, "quirk DMIC1_MAP enabled\n");
+                has_dmic = true;
+                break;
+        case BYT_RT5640_DMIC2_MAP:
+                dev_info(dev, "quirk DMIC2_MAP enabled\n");
+                has_dmic = true;
+                break;
+        case BYT_RT5640_IN1_MAP:
+                dev_info(dev, "quirk IN1_MAP enabled\n");
+                break;
+        case BYT_RT5640_IN3_MAP:
+                dev_info(dev, "quirk IN3_MAP enabled\n");
+                break;
+        default:
+                dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
+                break;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN) {
+                if (has_dmic)
+                        dev_info(dev, "quirk DMIC enabled\n");
+                else
+                        dev_err(dev, "quirk DMIC enabled but no DMIC input set, will be ignored\n");
+        }
         if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER)
-                dev_info(dev, "quirk MONO_SPEAKER enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC)
-                dev_info(dev, "quirk DIFF_MIC enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2)
-                dev_info(dev, "quirk SSP2_AIF2 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1)
-                dev_info(dev, "quirk SSP0_AIF1 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)
-                dev_info(dev, "quirk SSP0_AIF2 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN)
-                dev_info(dev, "quirk MCLK_EN enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ)
-                dev_info(dev, "quirk MCLK_25MHZ enabled");
+                dev_info(dev, "quirk MONO_SPEAKER enabled\n");
+        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC) {
+                if (!has_dmic)
+                        dev_info(dev, "quirk DIFF_MIC enabled\n");
+                else
+                        dev_info(dev, "quirk DIFF_MIC enabled but DMIC input selected, will be ignored\n");
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) {
+                dev_info(dev, "quirk SSP0_AIF1 enabled\n");
+                has_ssp0 = true;
+                has_ssp0_aif1 = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2) {
+                dev_info(dev, "quirk SSP0_AIF2 enabled\n");
+                has_ssp0 = true;
+                has_ssp0_aif2 = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) {
+                dev_info(dev, "quirk SSP2_AIF2 enabled\n");
+                has_ssp2_aif2 = true;
+        }
+        if (is_bytcr && !has_ssp0)
+                dev_err(dev, "Invalid routing, bytcr detected but no SSP0-based quirk, audio cannot work with SSP2 on bytcr\n");
+        if (has_ssp0_aif1 && has_ssp0_aif2)
+                dev_err(dev, "Invalid routing, SSP0 cannot be connected to both AIF1 and AIF2\n");
+        if (has_ssp0 && has_ssp2_aif2)
+                dev_err(dev, "Invalid routing, cannot have both SSP0 and SSP2 connected to codec\n");
+
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN) {
+                dev_info(dev, "quirk MCLK_EN enabled\n");
+                has_mclk = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ) {
+                if (has_mclk)
+                        dev_info(dev, "quirk MCLK_25MHZ enabled\n");
+                else
+                        dev_err(dev, "quirk MCLK_25MHZ enabled but quirk MCLK not selected, will be ignored\n");
+        }
 }
 
 
@@ -128,7 +182,7 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
                         ret = clk_prepare_enable(priv->mclk);
                         if (ret < 0) {
                                 dev_err(card->dev,
-                                        "could not configure MCLK state");
+                                        "could not configure MCLK state\n");
                                 return ret;
                         }
                 }
@@ -710,8 +764,8 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
         int i;
         int dai_index;
         struct byt_rt5640_private *priv;
-        bool is_bytcr = false;
 
+        is_bytcr = false;
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_ATOMIC);
         if (!priv)
                 return -ENOMEM;
@@ -806,6 +860,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 
         /* check quirks before creating card */
         dmi_check_system(byt_rt5640_quirk_table);
+        if (quirk_override) {
+                dev_info(&pdev->dev, "Overriding quirk 0x%x => 0x%x\n",
+                         (unsigned int)byt_rt5640_quirk, quirk_override);
+                byt_rt5640_quirk = quirk_override;
+        }
         log_quirks(&pdev->dev);
 
         if ((byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) ||
diff --git a/sound/soc/intel/haswell/sst-haswell-ipc.c b/sound/soc/intel/haswell/sst-haswell-ipc.c
index a3459d1682a6..d33bdaf92c57 100644
--- a/sound/soc/intel/haswell/sst-haswell-ipc.c
+++ b/sound/soc/intel/haswell/sst-haswell-ipc.c
@@ -2000,10 +2000,8 @@ int sst_hsw_module_set_param(struct sst_hsw *hsw,
         u32 param_size, char *param)
 {
         int ret;
-        unsigned char *data = NULL;
         u32 header = 0;
         u32 payload_size = 0, transfer_parameter_size = 0;
-        dma_addr_t dma_addr = 0;
         struct sst_hsw_transfer_parameter *parameter;
         struct device *dev = hsw->dev;
 
@@ -2047,10 +2045,6 @@ int sst_hsw_module_set_param(struct sst_hsw *hsw,
 
         kfree(parameter);
 
-        if (data)
-                dma_free_coherent(hsw->dsp->dma_dev,
-                        param_size, (void *)data, dma_addr);
-
         return ret;
 }
 
diff --git a/sound/soc/intel/skylake/bxt-sst.c b/sound/soc/intel/skylake/bxt-sst.c
index 15a063a403cc..f5e7dbb1ba39 100644
--- a/sound/soc/intel/skylake/bxt-sst.c
+++ b/sound/soc/intel/skylake/bxt-sst.c
@@ -25,7 +25,8 @@
 #include "skl-sst-ipc.h"
 
 #define BXT_BASEFW_TIMEOUT      3000
-#define BXT_INIT_TIMEOUT        500
+#define BXT_INIT_TIMEOUT        300
+#define BXT_ROM_INIT_TIMEOUT    70
 #define BXT_IPC_PURGE_FW        0x01004000
 
 #define BXT_ROM_INIT            0x5
@@ -45,6 +46,8 @@
 /* Delay before scheduling D0i3 entry */
 #define BXT_D0I3_DELAY 5000
 
+#define BXT_FW_ROM_INIT_RETRY 3
+
 static unsigned int bxt_get_errorcode(struct sst_dsp *ctx)
 {
          return sst_dsp_shim_read(ctx, BXT_ADSP_ERROR_CODE);
@@ -55,29 +58,15 @@ bxt_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
 {
         struct snd_dma_buffer dmab;
         struct skl_sst *skl = ctx->thread_context;
-        const struct firmware *fw = NULL;
         struct firmware stripped_fw;
         int ret = 0, i, dma_id, stream_tag;
 
         /* library indices start from 1 to N. 0 represents base FW */
         for (i = 1; i < lib_count; i++) {
-                ret = request_firmware(&fw, linfo[i].name, ctx->dev);
-                if (ret < 0) {
-                        dev_err(ctx->dev, "Request lib %s failed:%d\n",
-                                        linfo[i].name, ret);
-                        return ret;
-                }
-
-                if (skl->is_first_boot) {
-                        ret = snd_skl_parse_uuids(ctx, fw,
+                ret = skl_prepare_lib_load(skl, &skl->lib_info[i], &stripped_fw,
                                         BXT_ADSP_FW_BIN_HDR_OFFSET, i);
-                        if (ret < 0)
-                                goto load_library_failed;
-                }
-
-                stripped_fw.data = fw->data;
-                stripped_fw.size = fw->size;
-                skl_dsp_strip_extended_manifest(&stripped_fw);
+                if (ret < 0)
+                        goto load_library_failed;
 
                 stream_tag = ctx->dsp_ops.prepare(ctx->dev, 0x40,
                                         stripped_fw.size, &dmab);
@@ -92,21 +81,19 @@ bxt_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
                 memcpy(dmab.area, stripped_fw.data, stripped_fw.size);
 
                 ctx->dsp_ops.trigger(ctx->dev, true, stream_tag);
-                ret = skl_sst_ipc_load_library(&skl->ipc, dma_id, i);
+                ret = skl_sst_ipc_load_library(&skl->ipc, dma_id, i, true);
                 if (ret < 0)
                         dev_err(ctx->dev, "IPC Load Lib for %s fail: %d\n",
                                         linfo[i].name, ret);
 
                 ctx->dsp_ops.trigger(ctx->dev, false, stream_tag);
                 ctx->dsp_ops.cleanup(ctx->dev, &dmab, stream_tag);
-                release_firmware(fw);
-                fw = NULL;
         }
 
         return ret;
 
 load_library_failed:
-        release_firmware(fw);
+        skl_release_library(linfo, lib_count);
         return ret;
 }
 
@@ -156,7 +143,7 @@ static int sst_bxt_prepare_fw(struct sst_dsp *ctx,
                                         SKL_ADSP_REG_HIPCIE_DONE,
                                         BXT_INIT_TIMEOUT, "HIPCIE Done");
         if (ret < 0) {
-                dev_err(ctx->dev, "Timout for Purge Request%d\n", ret);
+                dev_err(ctx->dev, "Timeout for Purge Request%d\n", ret);
                 goto base_fw_load_failed;
         }
 
@@ -173,7 +160,7 @@ static int sst_bxt_prepare_fw(struct sst_dsp *ctx,
 
         /* Step 7: Wait for ROM init */
         ret = sst_dsp_register_poll(ctx, BXT_ADSP_FW_STATUS, SKL_FW_STS_MASK,
-                        SKL_FW_INIT, BXT_INIT_TIMEOUT, "ROM Load");
+                        SKL_FW_INIT, BXT_ROM_INIT_TIMEOUT, "ROM Load");
         if (ret < 0) {
                 dev_err(ctx->dev, "Timeout for ROM init, ret:%d\n", ret);
                 goto base_fw_load_failed;
@@ -206,18 +193,16 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
 {
         struct firmware stripped_fw;
         struct skl_sst *skl = ctx->thread_context;
-        int ret;
+        int ret, i;
 
-        ret = request_firmware(&ctx->fw, ctx->fw_name, ctx->dev);
-        if (ret < 0) {
-                dev_err(ctx->dev, "Request firmware failed %d\n", ret);
-                goto sst_load_base_firmware_failed;
+        if (ctx->fw == NULL) {
+                ret = request_firmware(&ctx->fw, ctx->fw_name, ctx->dev);
+                if (ret < 0) {
+                        dev_err(ctx->dev, "Request firmware failed %d\n", ret);
+                        return ret;
+                }
         }
 
-        /* check for extended manifest */
-        if (ctx->fw == NULL)
-                goto sst_load_base_firmware_failed;
-
         /* prase uuids on first boot */
         if (skl->is_first_boot) {
                 ret = snd_skl_parse_uuids(ctx, ctx->fw, BXT_ADSP_FW_BIN_HDR_OFFSET, 0);
@@ -229,18 +214,20 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
         stripped_fw.size = ctx->fw->size;
         skl_dsp_strip_extended_manifest(&stripped_fw);
 
-        ret = sst_bxt_prepare_fw(ctx, stripped_fw.data, stripped_fw.size);
-        /* Retry Enabling core and ROM load. Retry seemed to help */
-        if (ret < 0) {
+
+        for (i = 0; i < BXT_FW_ROM_INIT_RETRY; i++) {
                 ret = sst_bxt_prepare_fw(ctx, stripped_fw.data, stripped_fw.size);
-                if (ret < 0) {
-                        dev_err(ctx->dev, "Error code=0x%x: FW status=0x%x\n",
+                if (ret == 0)
+                        break;
+        }
+
+        if (ret < 0) {
+                dev_err(ctx->dev, "Error code=0x%x: FW status=0x%x\n",
                         sst_dsp_shim_read(ctx, BXT_ADSP_ERROR_CODE),
                         sst_dsp_shim_read(ctx, BXT_ADSP_FW_STATUS));
 
-                        dev_err(ctx->dev, "Core En/ROM load fail:%d\n", ret);
-                        goto sst_load_base_firmware_failed;
-                }
+                dev_err(ctx->dev, "Core En/ROM load fail:%d\n", ret);
+                goto sst_load_base_firmware_failed;
         }
 
         ret = sst_transfer_fw_host_dma(ctx);
@@ -265,8 +252,11 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
                 }
         }
 
+        return ret;
+
 sst_load_base_firmware_failed:
         release_firmware(ctx->fw);
+        ctx->fw = NULL;
         return ret;
 }
 
@@ -428,6 +418,7 @@ static int bxt_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
                                 return ret;
                         }
                 }
+                skl->cores.state[core_id] = SKL_DSP_RUNNING;
                 return ret;
         }
 
@@ -514,11 +505,22 @@ static int bxt_set_dsp_D3(struct sst_dsp *ctx, unsigned int core_id)
 
         ret = skl_ipc_set_dx(&skl->ipc, BXT_INSTANCE_ID,
                                 BXT_BASE_FW_MODULE_ID, &dx);
-        if (ret < 0)
+        if (ret < 0) {
                 dev_err(ctx->dev,
                 "Failed to set DSP to D3:core id = %d;Continue reset\n",
                 core_id);
+                /*
+                 * In case of D3 failure, re-download the firmware, so set
+                 * fw_loaded to false.
+                 */
+                skl->fw_loaded = false;
+        }
 
+        if (core_id == SKL_DSP_CORE0_ID) {
+                /* disable Interrupt */
+                skl_ipc_op_int_disable(ctx);
+                skl_ipc_int_disable(ctx);
+        }
         ret = skl_dsp_disable_core(ctx, core_mask);
         if (ret < 0) {
                 dev_err(ctx->dev, "Failed to disable core %d\n", ret);
@@ -560,23 +562,14 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         struct sst_dsp *sst;
         int ret;
 
-        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
-        if (skl == NULL)
-                return -ENOMEM;
-
-        skl->dev = dev;
-        skl_dev.thread_context = skl;
-        INIT_LIST_HEAD(&skl->uuid_list);
-
-        skl->dsp = skl_dsp_ctx_init(dev, &skl_dev, irq);
-        if (!skl->dsp) {
-                dev_err(skl->dev, "skl_dsp_ctx_init failed\n");
-                return -ENODEV;
+        ret = skl_sst_ctx_init(dev, irq, fw_name, dsp_ops, dsp, &skl_dev);
+        if (ret < 0) {
+                dev_err(dev, "%s: no device\n", __func__);
+                return ret;
         }
 
+        skl = *dsp;
         sst = skl->dsp;
-        sst->fw_name = fw_name;
-        sst->dsp_ops = dsp_ops;
         sst->fw_ops = bxt_fw_ops;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
@@ -584,24 +577,15 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         sst_dsp_mailbox_init(sst, (BXT_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, BXT_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
 
-        INIT_LIST_HEAD(&sst->module_list);
-        ret = skl_ipc_init(dev, skl);
-        if (ret)
-                return ret;
-
         /* set the D0i3 check */
         skl->ipc.ops.check_dsp_lp_on = skl_ipc_check_D0i0;
 
         skl->cores.count = 2;
         skl->boot_complete = false;
         init_waitqueue_head(&skl->boot_wait);
-        skl->is_first_boot = true;
         INIT_DELAYED_WORK(&skl->d0i3.work, bxt_set_dsp_D0i3);
         skl->d0i3.state = SKL_DSP_D0I3_NONE;
 
-        if (dsp)
-                *dsp = skl;
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(bxt_sst_dsp_init);
@@ -635,6 +619,10 @@ EXPORT_SYMBOL_GPL(bxt_sst_init_fw);
 
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx)
 {
+
+        skl_release_library(ctx->lib_info, ctx->lib_count);
+        if (ctx->dsp->fw)
+                release_firmware(ctx->dsp->fw);
         skl_freeup_uuid_list(ctx);
         skl_ipc_free(&ctx->ipc);
         ctx->dsp->cl_dev.ops.cl_cleanup_controller(ctx->dsp);
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index e66870474f10..ab1adc0c9cc3 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -58,7 +58,7 @@ static int skl_free_dma_buf(struct device *dev, struct snd_dma_buffer *dmab)
 #define NOTIFICATION_MASK 0xf
 
 /* disable notfication for underruns/overruns from firmware module */
-static void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable)
+void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable)
 {
         struct notification_mask mask;
         struct skl_ipc_large_config_msg msg = {0};
@@ -209,7 +209,7 @@ static const struct skl_dsp_ops dsp_ops[] = {
         {
                 .id = 0x9d71,
                 .loader_ops = skl_get_loader_ops,
-                .init = skl_sst_dsp_init,
+                .init = kbl_sst_dsp_init,
                 .init_fw = skl_sst_init_fw,
                 .cleanup = skl_sst_dsp_cleanup
         },
@@ -274,6 +274,7 @@ int skl_init_dsp(struct skl *skl)
         if (ret < 0)
                 return ret;
 
+        skl->skl_sst->dsp_ops = ops;
         dev_dbg(bus->dev, "dsp registration status=%d\n", ret);
 
         return ret;
@@ -284,16 +285,11 @@ int skl_free_dsp(struct skl *skl)
         struct hdac_ext_bus *ebus = &skl->ebus;
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         struct skl_sst *ctx = skl->skl_sst;
-        const struct skl_dsp_ops *ops;
 
         /* disable  ppcap interrupt */
         snd_hdac_ext_bus_ppcap_int_enable(&skl->ebus, false);
 
-        ops = skl_get_dsp_ops(skl->pci->device);
-        if (!ops)
-                return -EIO;
-
-        ops->cleanup(bus->dev, ctx);
+        ctx->dsp_ops->cleanup(bus->dev, ctx);
 
         if (ctx->dsp->addr.lpe)
                 iounmap(ctx->dsp->addr.lpe);
@@ -866,7 +862,7 @@ static void skl_clear_module_state(struct skl_module_pin *mpin, int max,
         }
 
         if (!found)
-                mcfg->m_state = SKL_MODULE_UNINIT;
+                mcfg->m_state = SKL_MODULE_INIT_DONE;
         return;
 }
 
@@ -1098,7 +1094,7 @@ int skl_delete_pipe(struct skl_sst *ctx, struct skl_pipe *pipe)
         dev_dbg(ctx->dev, "%s: pipe = %d\n", __func__, pipe->ppl_id);
 
         /* If pipe is started, do stop the pipe in FW. */
-        if (pipe->state > SKL_PIPE_STARTED) {
+        if (pipe->state >= SKL_PIPE_STARTED) {
                 ret = skl_set_pipe_state(ctx, pipe, PPL_PAUSED);
                 if (ret < 0) {
                         dev_err(ctx->dev, "Failed to stop pipeline\n");
diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c
index 7eb9c419dc7f..e3f06672fd6d 100644
--- a/sound/soc/intel/skylake/skl-nhlt.c
+++ b/sound/soc/intel/skylake/skl-nhlt.c
@@ -24,8 +24,6 @@
 static u8 OSC_UUID[16] = {0x6E, 0x88, 0x9F, 0xA6, 0xEB, 0x6C, 0x94, 0x45,
                                 0xA4, 0x1F, 0x7B, 0x5D, 0xCE, 0x24, 0xC5, 0x53};
 
-#define DSDT_NHLT_PATH "\\_SB.PCI0.HDAS"
-
 struct nhlt_acpi_table *skl_nhlt_init(struct device *dev)
 {
         acpi_handle handle;
@@ -33,8 +31,9 @@ struct nhlt_acpi_table *skl_nhlt_init(struct device *dev)
         struct nhlt_resource_desc  *nhlt_ptr = NULL;
         struct nhlt_acpi_table *nhlt_table = NULL;
 
-        if (ACPI_FAILURE(acpi_get_handle(NULL, DSDT_NHLT_PATH, &handle))) {
-                dev_err(dev, "Requested NHLT device not found\n");
+        handle = ACPI_HANDLE(dev);
+        if (!handle) {
+                dev_err(dev, "Didn't find ACPI_HANDLE\n");
                 return NULL;
         }
 
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index e12520e142ff..e91bbcffc856 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -21,6 +21,7 @@
 
 #include <linux/pci.h>
 #include <linux/pm_runtime.h>
+#include <linux/delay.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 #include "skl.h"
@@ -155,7 +156,7 @@ int skl_pcm_host_dma_prepare(struct device *dev, struct skl_pipe_params *params)
         snd_hdac_ext_stream_decouple(ebus, stream, true);
 
         format_val = snd_hdac_calc_stream_format(params->s_freq,
-                                params->ch, params->format, 32, 0);
+                        params->ch, params->format, params->host_bps, 0);
 
         dev_dbg(dev, "format_val=%d, rate=%d, ch=%d, format=%d\n",
                 format_val, params->s_freq, params->ch, params->format);
@@ -190,8 +191,8 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
 
         stream = stream_to_hdac_ext_stream(hstream);
         snd_hdac_ext_stream_decouple(ebus, stream, true);
-        format_val = snd_hdac_calc_stream_format(params->s_freq,
-                                params->ch, params->format, 24, 0);
+        format_val = snd_hdac_calc_stream_format(params->s_freq, params->ch,
+                                        params->format, params->link_bps, 0);
 
         dev_dbg(dev, "format_val=%d, rate=%d, ch=%d, format=%d\n",
                 format_val, params->s_freq, params->ch, params->format);
@@ -262,23 +263,6 @@ static int skl_pcm_open(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static int skl_be_prepare(struct snd_pcm_substream *substream,
-                struct snd_soc_dai *dai)
-{
-        struct skl *skl = get_skl_ctx(dai->dev);
-        struct skl_sst *ctx = skl->skl_sst;
-        struct skl_module_cfg *mconfig;
-
-        if (dai->playback_widget->power || dai->capture_widget->power)
-                return 0;
-
-        mconfig = skl_tplg_be_get_cpr_module(dai, substream->stream);
-        if (mconfig == NULL)
-                return -EINVAL;
-
-        return skl_dsp_set_dma_control(ctx, mconfig);
-}
-
 static int skl_pcm_prepare(struct snd_pcm_substream *substream,
                 struct snd_soc_dai *dai)
 {
@@ -326,6 +310,11 @@ static int skl_pcm_hw_params(struct snd_pcm_substream *substream,
         p_params.host_dma_id = dma_id;
         p_params.stream = substream->stream;
         p_params.format = params_format(params);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                p_params.host_bps = dai->driver->playback.sig_bits;
+        else
+                p_params.host_bps = dai->driver->capture.sig_bits;
+
 
         m_cfg = skl_tplg_fe_get_cpr_module(dai, p_params.stream);
         if (m_cfg)
@@ -564,6 +553,11 @@ static int skl_link_hw_params(struct snd_pcm_substream *substream,
         p_params.link_index = link->index;
         p_params.format = params_format(params);
 
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                p_params.link_bps = codec_dai->driver->playback.sig_bits;
+        else
+                p_params.link_bps = codec_dai->driver->capture.sig_bits;
+
         return skl_tplg_be_update_params(dai, &p_params);
 }
 
@@ -649,7 +643,6 @@ static struct snd_soc_dai_ops skl_dmic_dai_ops = {
 
 static struct snd_soc_dai_ops skl_be_ssp_dai_ops = {
         .hw_params = skl_be_hw_params,
-        .prepare = skl_be_prepare,
 };
 
 static struct snd_soc_dai_ops skl_link_dai_ops = {
@@ -670,6 +663,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_8000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE |
                         SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
         .capture = {
                 .stream_name = "System Capture",
@@ -677,6 +671,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -688,6 +683,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_QUAD,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -699,6 +695,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -710,6 +707,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -721,6 +719,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_QUAD,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -736,6 +735,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -751,6 +751,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -766,6 +767,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 
@@ -949,14 +951,12 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
 
 static int skl_platform_open(struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime;
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct snd_soc_dai_link *dai_link = rtd->dai_link;
 
         dev_dbg(rtd->cpu_dai->dev, "In %s:%s\n", __func__,
                                         dai_link->cpu_dai_name);
 
-        runtime = substream->runtime;
         snd_soc_set_runtime_hwparams(substream, &azx_pcm_hw);
 
         return 0;
@@ -1062,13 +1062,31 @@ static snd_pcm_uframes_t skl_platform_pcm_pointer
          * HAD space reflects the actual data that is transferred.
          * Use the position buffer for capture, as DPIB write gets
          * completed earlier than the actual data written to the DDR.
+         *
+         * For capture stream following workaround is required to fix the
+         * incorrect position reporting.
+         *
+         * 1. Wait for 20us before reading the DMA position in buffer once
+         * the interrupt is generated for stream completion as update happens
+         * on the HDA frame boundary i.e. 20.833uSec.
+         * 2. Read DPIB register to flush the DMA position value. This dummy
+         * read is required to flush DMA position value.
+         * 3. Read the DMA Position-in-Buffer. This value now will be equal to
+         * or greater than period boundary.
          */
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 pos = readl(ebus->bus.remap_addr + AZX_REG_VS_SDXDPIB_XBASE +
                                 (AZX_REG_VS_SDXDPIB_XINTERVAL *
                                 hdac_stream(hstream)->index));
-        else
+        } else {
+                udelay(20);
+                readl(ebus->bus.remap_addr +
+                                AZX_REG_VS_SDXDPIB_XBASE +
+                                (AZX_REG_VS_SDXDPIB_XINTERVAL *
+                                 hdac_stream(hstream)->index));
                 pos = snd_hdac_stream_get_pos_posbuf(hdac_stream(hstream));
+        }
 
         if (pos >= hdac_stream(hstream)->bufsize)
                 pos = 0;
@@ -1165,7 +1183,7 @@ static int skl_pcm_new(struct snd_soc_pcm_runtime *rtd)
                                                 snd_dma_pci_data(skl->pci),
                                                 size, MAX_PREALLOC_SIZE);
                 if (retval) {
-                        dev_err(dai->dev, "dma buffer allocationf fail\n");
+                        dev_err(dai->dev, "dma buffer allocation fail\n");
                         return retval;
                 }
         }
@@ -1173,29 +1191,52 @@ static int skl_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return retval;
 }
 
+static int skl_get_module_info(struct skl *skl, struct skl_module_cfg *mconfig)
+{
+        struct skl_sst *ctx = skl->skl_sst;
+        struct uuid_module *module;
+        uuid_le *uuid_mod;
+
+        uuid_mod = (uuid_le *)mconfig->guid;
+
+        if (list_empty(&ctx->uuid_list)) {
+                dev_err(ctx->dev, "Module list is empty\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(module, &ctx->uuid_list, list) {
+                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
+                        mconfig->id.module_id = module->id;
+                        mconfig->is_loadable = module->is_loadable;
+                        return 0;
+                }
+        }
+
+        return -EIO;
+}
+
 static int skl_populate_modules(struct skl *skl)
 {
         struct skl_pipeline *p;
         struct skl_pipe_module *m;
         struct snd_soc_dapm_widget *w;
         struct skl_module_cfg *mconfig;
-        int ret;
+        int ret = 0;
 
         list_for_each_entry(p, &skl->ppl_list, node) {
                 list_for_each_entry(m, &p->pipe->w_list, node) {
-
                         w = m->w;
                         mconfig = w->priv;
 
-                        ret = snd_skl_get_module_info(skl->skl_sst, mconfig);
+                        ret = skl_get_module_info(skl, mconfig);
                         if (ret < 0) {
                                 dev_err(skl->skl_sst->dev,
-                                        "query module info failed:%d\n", ret);
-                                goto err;
+                                        "query module info failed\n");
+                                return ret;
                         }
                 }
         }
-err:
+
         return ret;
 }
 
@@ -1232,6 +1273,7 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform)
                 }
                 skl_populate_modules(skl);
                 skl->skl_sst->update_d0i3c = skl_update_d0i3c;
+                skl_dsp_enable_notification(skl->skl_sst, false);
         }
         pm_runtime_mark_last_busy(platform->dev);
         pm_runtime_put_autosuspend(platform->dev);
@@ -1256,6 +1298,7 @@ int skl_platform_register(struct device *dev)
         struct skl *skl = ebus_to_skl(ebus);
 
         INIT_LIST_HEAD(&skl->ppl_list);
+        INIT_LIST_HEAD(&skl->bind_list);
 
         ret = snd_soc_register_platform(dev, &skl_platform_drv);
         if (ret) {
@@ -1276,6 +1319,17 @@ int skl_platform_register(struct device *dev)
 
 int skl_platform_unregister(struct device *dev)
 {
+        struct hdac_ext_bus *ebus = dev_get_drvdata(dev);
+        struct skl *skl = ebus_to_skl(ebus);
+        struct skl_module_deferred_bind *modules, *tmp;
+
+        if (!list_empty(&skl->bind_list)) {
+                list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
+                        list_del(&modules->node);
+                        kfree(modules);
+                }
+        }
+
         snd_soc_unregister_component(dev);
         snd_soc_unregister_platform(dev);
         return 0;
diff --git a/sound/soc/intel/skylake/skl-sst-cldma.c b/sound/soc/intel/skylake/skl-sst-cldma.c
index c9f6d87381db..d2b1d60fec02 100644
--- a/sound/soc/intel/skylake/skl-sst-cldma.c
+++ b/sound/soc/intel/skylake/skl-sst-cldma.c
@@ -164,7 +164,7 @@ static void skl_cldma_cleanup(struct sst_dsp  *ctx)
         ctx->dsp_ops.free_dma_buf(ctx->dev, &ctx->cl_dev.dmab_bdl);
 }
 
-static int skl_cldma_wait_interruptible(struct sst_dsp *ctx)
+int skl_cldma_wait_interruptible(struct sst_dsp *ctx)
 {
         int ret = 0;
 
@@ -243,9 +243,14 @@ static void skl_cldma_fill_buffer(struct sst_dsp *ctx, unsigned int size,
  * 2. Polling on fw register to identify if data left to transferred doesn't
  *    fill the ring buffer. Caller takes care of polling the required status
  *    register to identify the transfer status.
+ * 3. if wait flag is set, waits for DBL interrupt to copy the next chunk till
+ *    bytes_left is 0.
+ *    if wait flag is not set, doesn't wait for BDL interrupt. after ccopying
+ *    the first chunk return the no of bytes_left to be copied.
  */
 static int
-skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
+skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin,
+                        u32 total_size, bool wait)
 {
         int ret = 0;
         bool start = true;
@@ -272,13 +277,14 @@ skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
                         size = ctx->cl_dev.bufsize;
                         skl_cldma_fill_buffer(ctx, size, curr_pos, true, start);
 
-                        start = false;
-                        ret = skl_cldma_wait_interruptible(ctx);
-                        if (ret < 0) {
-                                skl_cldma_stop(ctx);
-                                return ret;
+                        if (wait) {
+                                start = false;
+                                ret = skl_cldma_wait_interruptible(ctx);
+                                if (ret < 0) {
+                                        skl_cldma_stop(ctx);
+                                        return ret;
+                                }
                         }
-
                 } else {
                         skl_cldma_int_disable(ctx);
 
@@ -298,9 +304,11 @@ skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
                 }
                 bytes_left -= size;
                 curr_pos = curr_pos + size;
+                if (!wait)
+                        return bytes_left;
         }
 
-        return ret;
+        return bytes_left;
 }
 
 void skl_cldma_process_intr(struct sst_dsp *ctx)
diff --git a/sound/soc/intel/skylake/skl-sst-cldma.h b/sound/soc/intel/skylake/skl-sst-cldma.h
index 99e4c86b6358..5b730a1a0ae4 100644
--- a/sound/soc/intel/skylake/skl-sst-cldma.h
+++ b/sound/soc/intel/skylake/skl-sst-cldma.h
@@ -213,7 +213,7 @@ struct skl_cl_dev_ops {
         void (*cl_trigger)(struct sst_dsp  *ctx, bool enable);
         void (*cl_cleanup_controller)(struct sst_dsp  *ctx);
         int (*cl_copy_to_dmabuf)(struct sst_dsp *ctx,
-                        const void *bin, u32 size);
+                        const void *bin, u32 size, bool wait);
         void (*cl_stop_dma)(struct sst_dsp *ctx);
 };
 
diff --git a/sound/soc/intel/skylake/skl-sst-dsp.c b/sound/soc/intel/skylake/skl-sst-dsp.c
index c3deefab65d6..08332723c700 100644
--- a/sound/soc/intel/skylake/skl-sst-dsp.c
+++ b/sound/soc/intel/skylake/skl-sst-dsp.c
@@ -355,12 +355,13 @@ int skl_dsp_get_core(struct sst_dsp *ctx, unsigned int core_id)
                 ret = ctx->fw_ops.set_state_D0(ctx, core_id);
                 if (ret < 0) {
                         dev_err(ctx->dev, "unable to get core%d\n", core_id);
-                        return ret;
+                        goto out;
                 }
         }
 
         skl->cores.usage_count[core_id]++;
 
+out:
         dev_dbg(ctx->dev, "core id %d state %d usage_count %d\n",
                         core_id, skl->cores.state[core_id],
                         skl->cores.usage_count[core_id]);
@@ -379,7 +380,8 @@ int skl_dsp_put_core(struct sst_dsp *ctx, unsigned int core_id)
                 return -EINVAL;
         }
 
-        if (--skl->cores.usage_count[core_id] == 0) {
+        if ((--skl->cores.usage_count[core_id] == 0) &&
+                (skl->cores.state[core_id] != SKL_DSP_RESET)) {
                 ret = ctx->fw_ops.set_state_D3(ctx, core_id);
                 if (ret < 0) {
                         dev_err(ctx->dev, "unable to put core %d: %d\n",
diff --git a/sound/soc/intel/skylake/skl-sst-dsp.h b/sound/soc/intel/skylake/skl-sst-dsp.h
index 849410d0823e..eba20d37ba8c 100644
--- a/sound/soc/intel/skylake/skl-sst-dsp.h
+++ b/sound/soc/intel/skylake/skl-sst-dsp.h
@@ -17,13 +17,15 @@
 #define __SKL_SST_DSP_H__
 
 #include <linux/interrupt.h>
+#include <linux/uuid.h>
+#include <linux/firmware.h>
 #include <sound/memalloc.h>
 #include "skl-sst-cldma.h"
-#include "skl-topology.h"
 
 struct sst_dsp;
 struct skl_sst;
 struct sst_dsp_device;
+struct skl_lib_info;
 
 /* Intel HD Audio General DSP Registers */
 #define SKL_ADSP_GEN_BASE               0x0
@@ -144,7 +146,7 @@ struct skl_dsp_fw_ops {
         int (*load_fw)(struct sst_dsp  *ctx);
         /* FW module parser/loader */
         int (*load_library)(struct sst_dsp *ctx,
-                struct skl_lib_info *linfo, int count);
+                struct skl_lib_info *linfo, int lib_count);
         int (*parse_fw)(struct sst_dsp *ctx);
         int (*set_state_D0)(struct sst_dsp *ctx, unsigned int core_id);
         int (*set_state_D3)(struct sst_dsp *ctx, unsigned int core_id);
@@ -172,6 +174,19 @@ struct skl_dsp_loader_ops {
                                  int stream_tag);
 };
 
+#define MAX_INSTANCE_BUFF 2
+
+struct uuid_module {
+        uuid_le uuid;
+        int id;
+        int is_loadable;
+        int max_instance;
+        u64 pvt_id[MAX_INSTANCE_BUFF];
+        int *instance_id;
+
+        struct list_head list;
+};
+
 struct skl_load_module_info {
         u16 mod_id;
         const struct firmware *fw;
@@ -186,6 +201,7 @@ struct skl_module_table {
 void skl_cldma_process_intr(struct sst_dsp *ctx);
 void skl_cldma_int_disable(struct sst_dsp *ctx);
 int skl_cldma_prepare(struct sst_dsp *ctx);
+int skl_cldma_wait_interruptible(struct sst_dsp *ctx);
 
 void skl_dsp_set_state_locked(struct sst_dsp *ctx, int state);
 struct sst_dsp *skl_dsp_ctx_init(struct device *dev,
@@ -214,6 +230,9 @@ int skl_dsp_boot(struct sst_dsp *ctx);
 int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
                 struct skl_sst **dsp);
+int kbl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
+                const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
+                struct skl_sst **dsp);
 int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
                 struct skl_sst **dsp);
@@ -222,17 +241,22 @@ int bxt_sst_init_fw(struct device *dev, struct skl_sst *ctx);
 void skl_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 
-int snd_skl_get_module_info(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
 int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
                                 unsigned int offset, int index);
-int skl_get_pvt_id(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
-int skl_put_pvt_id(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
+int skl_get_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int instance_id);
+int skl_put_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int *pvt_id);
 int skl_get_pvt_instance_id_map(struct skl_sst *ctx,
                                 int module_id, int instance_id);
 void skl_freeup_uuid_list(struct skl_sst *ctx);
 
 int skl_dsp_strip_extended_manifest(struct firmware *fw);
+void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable);
+int skl_sst_ctx_init(struct device *dev, int irq, const char *fw_name,
+                struct skl_dsp_loader_ops dsp_ops, struct skl_sst **dsp,
+                struct sst_dsp_device *skl_dev);
+int skl_prepare_lib_load(struct skl_sst *skl, struct skl_lib_info *linfo,
+                        struct firmware *stripped_fw,
+                        unsigned int hdr_offset, int index);
+void skl_release_library(struct skl_lib_info *linfo, int lib_count);
+
 #endif /*__SKL_SST_DSP_H__*/
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index e1391dfbc9e9..58c525096a7c 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -34,6 +34,11 @@
 #define IPC_GLB_REPLY_STATUS_MASK       ((0x1 << IPC_GLB_REPLY_STATUS_SHIFT) - 1)
 #define IPC_GLB_REPLY_STATUS(x)         ((x) << IPC_GLB_REPLY_STATUS_SHIFT)
 
+#define IPC_GLB_REPLY_TYPE_SHIFT        29
+#define IPC_GLB_REPLY_TYPE_MASK         0x1F
+#define IPC_GLB_REPLY_TYPE(x)           (((x) >> IPC_GLB_REPLY_TYPE_SHIFT) \
+                                        & IPC_GLB_RPLY_TYPE_MASK)
+
 #define IPC_TIMEOUT_MSECS               3000
 
 #define IPC_EMPTY_LIST_SIZE             8
@@ -387,12 +392,27 @@ static int skl_ipc_process_notification(struct sst_generic_ipc *ipc,
         return 0;
 }
 
+static int skl_ipc_set_reply_error_code(u32 reply)
+{
+        switch (reply) {
+        case IPC_GLB_REPLY_OUT_OF_MEMORY:
+                return -ENOMEM;
+
+        case IPC_GLB_REPLY_BUSY:
+                return -EBUSY;
+
+        default:
+                return -EINVAL;
+        }
+}
+
 static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                 struct skl_ipc_header header)
 {
         struct ipc_message *msg;
         u32 reply = header.primary & IPC_GLB_REPLY_STATUS_MASK;
         u64 *ipc_header = (u64 *)(&header);
+        struct skl_sst *skl = container_of(ipc, struct skl_sst, ipc);
 
         msg = skl_ipc_reply_get_msg(ipc, *ipc_header);
         if (msg == NULL) {
@@ -401,33 +421,39 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
         }
 
         /* first process the header */
-        switch (reply) {
-        case IPC_GLB_REPLY_SUCCESS:
+        if (reply == IPC_GLB_REPLY_SUCCESS) {
                 dev_dbg(ipc->dev, "ipc FW reply %x: success\n", header.primary);
                 /* copy the rx data from the mailbox */
                 sst_dsp_inbox_read(ipc->dsp, msg->rx_data, msg->rx_size);
-                break;
-
-        case IPC_GLB_REPLY_OUT_OF_MEMORY:
-                dev_err(ipc->dev, "ipc fw reply: %x: no memory\n", header.primary);
-                msg->errno = -ENOMEM;
-                break;
-
-        case IPC_GLB_REPLY_BUSY:
-                dev_err(ipc->dev, "ipc fw reply: %x: Busy\n", header.primary);
-                msg->errno = -EBUSY;
-                break;
+                switch (IPC_GLB_NOTIFY_MSG_TYPE(header.primary)) {
+                case IPC_GLB_LOAD_MULTIPLE_MODS:
+                case IPC_GLB_LOAD_LIBRARY:
+                        skl->mod_load_complete = true;
+                        skl->mod_load_status = true;
+                        wake_up(&skl->mod_load_wait);
+                        break;
 
-        default:
-                dev_err(ipc->dev, "Unknown ipc reply: 0x%x\n", reply);
-                msg->errno = -EINVAL;
-                break;
-        }
+                default:
+                        break;
 
-        if (reply != IPC_GLB_REPLY_SUCCESS) {
+                }
+        } else {
+                msg->errno = skl_ipc_set_reply_error_code(reply);
                 dev_err(ipc->dev, "ipc FW reply: reply=%d\n", reply);
                 dev_err(ipc->dev, "FW Error Code: %u\n",
                         ipc->dsp->fw_ops.get_fw_errcode(ipc->dsp));
+                switch (IPC_GLB_NOTIFY_MSG_TYPE(header.primary)) {
+                case IPC_GLB_LOAD_MULTIPLE_MODS:
+                case IPC_GLB_LOAD_LIBRARY:
+                        skl->mod_load_complete = true;
+                        skl->mod_load_status = false;
+                        wake_up(&skl->mod_load_wait);
+                        break;
+
+                default:
+                        break;
+
+                }
         }
 
         list_del(&msg->list);
@@ -811,8 +837,8 @@ int skl_ipc_load_modules(struct sst_generic_ipc *ipc,
         header.primary |= IPC_GLB_TYPE(IPC_GLB_LOAD_MULTIPLE_MODS);
         header.primary |= IPC_LOAD_MODULE_CNT(module_cnt);
 
-        ret = sst_ipc_tx_message_wait(ipc, *ipc_header, data,
-                                (sizeof(u16) * module_cnt), NULL, 0);
+        ret = sst_ipc_tx_message_nowait(ipc, *ipc_header, data,
+                                (sizeof(u16) * module_cnt));
         if (ret < 0)
                 dev_err(ipc->dev, "ipc: load modules failed :%d\n", ret);
 
@@ -947,7 +973,7 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
 EXPORT_SYMBOL_GPL(skl_ipc_get_large_config);
 
 int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
-                                u8 dma_id, u8 table_id)
+                                u8 dma_id, u8 table_id, bool wait)
 {
         struct skl_ipc_header header = {0};
         u64 *ipc_header = (u64 *)(&header);
@@ -959,7 +985,11 @@ int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
         header.primary |= IPC_MOD_INSTANCE_ID(table_id);
         header.primary |= IPC_MOD_ID(dma_id);
 
-        ret = sst_ipc_tx_message_wait(ipc, *ipc_header, NULL, 0, NULL, 0);
+        if (wait)
+                ret = sst_ipc_tx_message_wait(ipc, *ipc_header,
+                                        NULL, 0, NULL, 0);
+        else
+                ret = sst_ipc_tx_message_nowait(ipc, *ipc_header, NULL, 0);
 
         if (ret < 0)
                 dev_err(ipc->dev, "ipc: load lib failed\n");
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.h b/sound/soc/intel/skylake/skl-sst-ipc.h
index 9660ace379ab..e057da2713c6 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.h
+++ b/sound/soc/intel/skylake/skl-sst-ipc.h
@@ -69,6 +69,14 @@ struct skl_d0i3_data {
         struct delayed_work work;
 };
 
+#define SKL_LIB_NAME_LENGTH 128
+#define SKL_MAX_LIB 16
+
+struct skl_lib_info {
+        char name[SKL_LIB_NAME_LENGTH];
+        const struct firmware *fw;
+};
+
 struct skl_sst {
         struct device *dev;
         struct sst_dsp *dsp;
@@ -77,6 +85,11 @@ struct skl_sst {
         wait_queue_head_t boot_wait;
         bool boot_complete;
 
+        /* module load */
+        wait_queue_head_t mod_load_wait;
+        bool mod_load_complete;
+        bool mod_load_status;
+
         /* IPC messaging */
         struct sst_generic_ipc ipc;
 
@@ -105,6 +118,8 @@ struct skl_sst {
         void (*update_d0i3c)(struct device *dev, bool enable);
 
         struct skl_d0i3_data d0i3;
+
+        const struct skl_dsp_ops *dsp_ops;
 };
 
 struct skl_ipc_init_instance_msg {
@@ -182,7 +197,7 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
                 struct skl_ipc_large_config_msg *msg, u32 *param);
 
 int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
-                        u8 dma_id, u8 table_id);
+                        u8 dma_id, u8 table_id, bool wait);
 
 int skl_ipc_set_d0ix(struct sst_generic_ipc *ipc,
                 struct skl_ipc_d0ix_msg *msg);
diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
index ea162fbf68e5..81ee251881b4 100644
--- a/sound/soc/intel/skylake/skl-sst-utils.c
+++ b/sound/soc/intel/skylake/skl-sst-utils.c
@@ -94,19 +94,6 @@ struct adsp_fw_hdr {
         u32 load_offset;
 } __packed;
 
-#define MAX_INSTANCE_BUFF 2
-
-struct uuid_module {
-        uuid_le uuid;
-        int id;
-        int is_loadable;
-        int max_instance;
-        u64 pvt_id[MAX_INSTANCE_BUFF];
-        int *instance_id;
-
-        struct list_head list;
-};
-
 struct skl_ext_manifest_hdr {
         u32 id;
         u32 len;
@@ -115,32 +102,6 @@ struct skl_ext_manifest_hdr {
         u32 entries;
 };
 
-int snd_skl_get_module_info(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig)
-{
-        struct uuid_module *module;
-        uuid_le *uuid_mod;
-
-        uuid_mod = (uuid_le *)mconfig->guid;
-
-        if (list_empty(&ctx->uuid_list)) {
-                dev_err(ctx->dev, "Module list is empty\n");
-                return -EINVAL;
-        }
-
-        list_for_each_entry(module, &ctx->uuid_list, list) {
-                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
-                        mconfig->id.module_id = module->id;
-                        mconfig->is_loadable = module->is_loadable;
-
-                        return 0;
-                }
-        }
-
-        return -EINVAL;
-}
-EXPORT_SYMBOL_GPL(snd_skl_get_module_info);
-
 static int skl_get_pvtid_map(struct uuid_module *module, int instance_id)
 {
         int pvt_id;
@@ -222,21 +183,18 @@ static inline int skl_pvtid_128(struct uuid_module *module)
  * This generates a 128 bit private unique id for a module TYPE so that
  * module instance is unique
  */
-int skl_get_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+int skl_get_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int instance_id)
 {
         struct uuid_module *module;
-        uuid_le *uuid_mod;
         int pvt_id;
 
-        uuid_mod = (uuid_le *)mconfig->guid;
-
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
 
                         pvt_id = skl_pvtid_128(module);
                         if (pvt_id >= 0) {
-                                module->instance_id[pvt_id] =
-                                                mconfig->id.instance_id;
+                                module->instance_id[pvt_id] = instance_id;
+
                                 return pvt_id;
                         }
                 }
@@ -254,23 +212,21 @@ EXPORT_SYMBOL_GPL(skl_get_pvt_id);
  *
  * This frees a 128 bit private unique id previously generated
  */
-int skl_put_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+int skl_put_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int *pvt_id)
 {
         int i;
-        uuid_le *uuid_mod;
         struct uuid_module *module;
 
-        uuid_mod = (uuid_le *)mconfig->guid;
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
 
-                        if (mconfig->id.pvt_id != 0)
-                                i = (mconfig->id.pvt_id) / 64;
+                        if (*pvt_id != 0)
+                                i = (*pvt_id) / 64;
                         else
                                 i = 0;
 
-                        module->pvt_id[i] &= ~(1 << (mconfig->id.pvt_id));
-                        mconfig->id.pvt_id = -1;
+                        module->pvt_id[i] &= ~(1 << (*pvt_id));
+                        *pvt_id = -1;
                         return 0;
                 }
         }
@@ -405,3 +361,83 @@ int skl_dsp_strip_extended_manifest(struct firmware *fw)
 
         return 0;
 }
+
+int skl_sst_ctx_init(struct device *dev, int irq, const char *fw_name,
+        struct skl_dsp_loader_ops dsp_ops, struct skl_sst **dsp,
+        struct sst_dsp_device *skl_dev)
+{
+        struct skl_sst *skl;
+        struct sst_dsp *sst;
+        int ret;
+
+        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
+        if (skl == NULL)
+                return -ENOMEM;
+
+        skl->dev = dev;
+        skl_dev->thread_context = skl;
+        INIT_LIST_HEAD(&skl->uuid_list);
+        skl->dsp = skl_dsp_ctx_init(dev, skl_dev, irq);
+        if (!skl->dsp) {
+                dev_err(skl->dev, "%s: no device\n", __func__);
+                return -ENODEV;
+        }
+
+        sst = skl->dsp;
+        sst->fw_name = fw_name;
+        sst->dsp_ops = dsp_ops;
+        init_waitqueue_head(&skl->mod_load_wait);
+        INIT_LIST_HEAD(&sst->module_list);
+        ret = skl_ipc_init(dev, skl);
+        if (ret)
+                return ret;
+
+        skl->is_first_boot = true;
+        if (dsp)
+                *dsp = skl;
+
+        return ret;
+}
+
+int skl_prepare_lib_load(struct skl_sst *skl, struct skl_lib_info *linfo,
+                struct firmware *stripped_fw,
+                unsigned int hdr_offset, int index)
+{
+        int ret;
+        struct sst_dsp *dsp = skl->dsp;
+
+        if (linfo->fw == NULL) {
+                ret = request_firmware(&linfo->fw, linfo->name,
+                                        skl->dev);
+                if (ret < 0) {
+                        dev_err(skl->dev, "Request lib %s failed:%d\n",
+                                linfo->name, ret);
+                        return ret;
+                }
+        }
+
+        if (skl->is_first_boot) {
+                ret = snd_skl_parse_uuids(dsp, linfo->fw, hdr_offset, index);
+                if (ret < 0)
+                        return ret;
+        }
+
+        stripped_fw->data = linfo->fw->data;
+        stripped_fw->size = linfo->fw->size;
+        skl_dsp_strip_extended_manifest(stripped_fw);
+
+        return 0;
+}
+
+void skl_release_library(struct skl_lib_info *linfo, int lib_count)
+{
+        int i;
+
+        /* library indices start from 1 to N. 0 represents base FW */
+        for (i = 1; i < lib_count; i++) {
+                if (linfo[i].fw) {
+                        release_firmware(linfo[i].fw);
+                        linfo[i].fw = NULL;
+                }
+        }
+}
diff --git a/sound/soc/intel/skylake/skl-sst.c b/sound/soc/intel/skylake/skl-sst.c
index b30bd384c8d3..155e456b7a3a 100644
--- a/sound/soc/intel/skylake/skl-sst.c
+++ b/sound/soc/intel/skylake/skl-sst.c
@@ -52,7 +52,8 @@ static int skl_transfer_firmware(struct sst_dsp *ctx,
 {
         int ret = 0;
 
-        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, basefw, base_fw_size);
+        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, basefw, base_fw_size,
+                                                                true);
         if (ret < 0)
                 return ret;
 
@@ -178,6 +179,18 @@ static int skl_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
                         dev_err(ctx->dev, "unable to load firmware\n");
                         return ret;
                 }
+
+                /* load libs as they are also lost on D3 */
+                if (skl->lib_count > 1) {
+                        ret = ctx->fw_ops.load_library(ctx, skl->lib_info,
+                                                        skl->lib_count);
+                        if (ret < 0) {
+                                dev_err(ctx->dev, "reload libs failed: %d\n",
+                                                ret);
+                                return ret;
+                        }
+
+                }
         }
 
         /*
@@ -203,7 +216,7 @@ static int skl_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
 
         skl->cores.state[core_id] = SKL_DSP_RUNNING;
 
-        return ret;
+        return 0;
 }
 
 static int skl_set_dsp_D3(struct sst_dsp *ctx, unsigned int core_id)
@@ -323,27 +336,85 @@ static struct skl_module_table *skl_module_get_from_id(
         return NULL;
 }
 
-static int skl_transfer_module(struct sst_dsp *ctx,
-                        struct skl_load_module_info *module)
+static int skl_transfer_module(struct sst_dsp *ctx, const void *data,
+                        u32 size, u16 mod_id, u8 table_id, bool is_module)
 {
-        int ret;
+        int ret, bytes_left, curr_pos;
         struct skl_sst *skl = ctx->thread_context;
+        skl->mod_load_complete = false;
 
-        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, module->fw->data,
-                                                        module->fw->size);
-        if (ret < 0)
-                return ret;
+        bytes_left = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, data, size, false);
+        if (bytes_left < 0)
+                return bytes_left;
 
-        ret = skl_ipc_load_modules(&skl->ipc, SKL_NUM_MODULES,
-                                                (void *)&module->mod_id);
-        if (ret < 0)
-                dev_err(ctx->dev, "Failed to Load module: %d\n", ret);
+        /* check is_module flag to load module or library */
+        if (is_module)
+                ret = skl_ipc_load_modules(&skl->ipc, SKL_NUM_MODULES, &mod_id);
+        else
+                ret = skl_sst_ipc_load_library(&skl->ipc, 0, table_id, false);
+
+        if (ret < 0) {
+                dev_err(ctx->dev, "Failed to Load %s with err %d\n",
+                                is_module ? "module" : "lib", ret);
+                goto out;
+        }
+
+        /*
+         * if bytes_left > 0 then wait for BDL complete interrupt and
+         * copy the next chunk till bytes_left is 0. if bytes_left is
+         * is zero, then wait for load module IPC reply
+         */
+        while (bytes_left > 0) {
+                curr_pos = size - bytes_left;
+
+                ret = skl_cldma_wait_interruptible(ctx);
+                if (ret < 0)
+                        goto out;
+
+                bytes_left = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx,
+                                                        data + curr_pos,
+                                                        bytes_left, false);
+        }
 
+        ret = wait_event_timeout(skl->mod_load_wait, skl->mod_load_complete,
+                                msecs_to_jiffies(SKL_IPC_BOOT_MSECS));
+        if (ret == 0 || !skl->mod_load_status) {
+                dev_err(ctx->dev, "Module Load failed\n");
+                ret = -EIO;
+        }
+
+out:
         ctx->cl_dev.ops.cl_stop_dma(ctx);
 
         return ret;
 }
 
+static int
+kbl_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
+{
+        struct skl_sst *skl = ctx->thread_context;
+        struct firmware stripped_fw;
+        int ret, i;
+
+        /* library indices start from 1 to N. 0 represents base FW */
+        for (i = 1; i < lib_count; i++) {
+                ret = skl_prepare_lib_load(skl, &skl->lib_info[i], &stripped_fw,
+                                        SKL_ADSP_FW_BIN_HDR_OFFSET, i);
+                if (ret < 0)
+                        goto load_library_failed;
+                ret = skl_transfer_module(ctx, stripped_fw.data,
+                                stripped_fw.size, 0, i, false);
+                if (ret < 0)
+                        goto load_library_failed;
+        }
+
+        return 0;
+
+load_library_failed:
+        skl_release_library(linfo, lib_count);
+        return ret;
+}
+
 static int skl_load_module(struct sst_dsp *ctx, u16 mod_id, u8 *guid)
 {
         struct skl_module_table *module_entry = NULL;
@@ -365,7 +436,9 @@ static int skl_load_module(struct sst_dsp *ctx, u16 mod_id, u8 *guid)
         }
 
         if (!module_entry->usage_cnt) {
-                ret = skl_transfer_module(ctx, module_entry->mod_info);
+                ret = skl_transfer_module(ctx, module_entry->mod_info->fw->data,
+                                module_entry->mod_info->fw->size,
+                                mod_id, 0, true);
                 if (ret < 0) {
                         dev_err(ctx->dev, "Failed to Load module\n");
                         return ret;
@@ -388,6 +461,11 @@ static int skl_unload_module(struct sst_dsp *ctx, u16 mod_id)
                 dev_err(ctx->dev, "Module bad usage cnt!:%d\n", usage_cnt);
                 return -EIO;
         }
+
+        /* if module is used by others return, no need to unload */
+        if (usage_cnt > 0)
+                return 0;
+
         ret = skl_ipc_unload_modules(&skl->ipc,
                         SKL_NUM_MODULES, &mod_id);
         if (ret < 0) {
@@ -434,6 +512,16 @@ static struct skl_dsp_fw_ops skl_fw_ops = {
         .unload_mod = skl_unload_module,
 };
 
+static struct skl_dsp_fw_ops kbl_fw_ops = {
+        .set_state_D0 = skl_set_dsp_D0,
+        .set_state_D3 = skl_set_dsp_D3,
+        .load_fw = skl_load_base_firmware,
+        .get_fw_errcode = skl_get_errorcode,
+        .load_library = kbl_load_library,
+        .load_mod = skl_load_module,
+        .unload_mod = skl_unload_module,
+};
+
 static struct sst_ops skl_ops = {
         .irq_handler = skl_dsp_sst_interrupt,
         .write = sst_shim32_write,
@@ -455,45 +543,47 @@ int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         struct sst_dsp *sst;
         int ret;
 
-        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
-        if (skl == NULL)
-                return -ENOMEM;
-
-        skl->dev = dev;
-        skl_dev.thread_context = skl;
-        INIT_LIST_HEAD(&skl->uuid_list);
-
-        skl->dsp = skl_dsp_ctx_init(dev, &skl_dev, irq);
-        if (!skl->dsp) {
-                dev_err(skl->dev, "%s: no device\n", __func__);
-                return -ENODEV;
+        ret = skl_sst_ctx_init(dev, irq, fw_name, dsp_ops, dsp, &skl_dev);
+        if (ret < 0) {
+                dev_err(dev, "%s: no device\n", __func__);
+                return ret;
         }
 
+        skl = *dsp;
         sst = skl->dsp;
-
-        sst->fw_name = fw_name;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
         sst_dsp_mailbox_init(sst, (SKL_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, SKL_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
 
-        INIT_LIST_HEAD(&sst->module_list);
-        sst->dsp_ops = dsp_ops;
         sst->fw_ops = skl_fw_ops;
 
-        ret = skl_ipc_init(dev, skl);
-        if (ret)
+        skl->cores.count = 2;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+
+int kbl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
+                const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
+                struct skl_sst **dsp)
+{
+        struct sst_dsp *sst;
+        int ret;
+
+        ret = skl_sst_dsp_init(dev, mmio_base, irq, fw_name, dsp_ops, dsp);
+        if (ret < 0) {
+                dev_err(dev, "%s: Init failed %d\n", __func__, ret);
                 return ret;
+        }
 
-        skl->cores.count = 2;
-        skl->is_first_boot = true;
+        sst = (*dsp)->dsp;
+        sst->fw_ops = kbl_fw_ops;
 
-        if (dsp)
-                *dsp = skl;
+        return 0;
 
-        return ret;
 }
-EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+EXPORT_SYMBOL_GPL(kbl_sst_dsp_init);
 
 int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx)
 {
@@ -507,6 +597,15 @@ int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx)
         }
 
         skl_dsp_init_core_state(sst);
+
+        if (ctx->lib_count > 1) {
+                ret = sst->fw_ops.load_library(sst, ctx->lib_info,
+                                                ctx->lib_count);
+                if (ret < 0) {
+                        dev_err(dev, "Load Library failed : %x\n", ret);
+                        return ret;
+                }
+        }
         ctx->is_first_boot = false;
 
         return 0;
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 2dbfb1b24ef4..3a99712e44a8 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -299,8 +299,6 @@ static void skl_tplg_update_buffer_size(struct skl_sst *ctx,
 {
         int multiplier = 1;
         struct skl_module_fmt *in_fmt, *out_fmt;
-        int in_rate, out_rate;
-
 
         /* Since fixups is applied to pin 0 only, ibs, obs needs
          * change for pin 0 only
@@ -311,22 +309,12 @@ static void skl_tplg_update_buffer_size(struct skl_sst *ctx,
         if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT)
                 multiplier = 5;
 
-        if (in_fmt->s_freq % 1000)
-                in_rate = (in_fmt->s_freq / 1000) + 1;
-        else
-                in_rate = (in_fmt->s_freq / 1000);
-
-        mcfg->ibs = in_rate * (mcfg->in_fmt->channels) *
-                        (mcfg->in_fmt->bit_depth >> 3) *
+        mcfg->ibs = DIV_ROUND_UP(in_fmt->s_freq, 1000) *
+                        in_fmt->channels * (in_fmt->bit_depth >> 3) *
                         multiplier;
 
-        if (mcfg->out_fmt->s_freq % 1000)
-                out_rate = (mcfg->out_fmt->s_freq / 1000) + 1;
-        else
-                out_rate = (mcfg->out_fmt->s_freq / 1000);
-
-        mcfg->obs = out_rate * (mcfg->out_fmt->channels) *
-                        (mcfg->out_fmt->bit_depth >> 3) *
+        mcfg->obs = DIV_ROUND_UP(out_fmt->s_freq, 1000) *
+                        out_fmt->channels * (out_fmt->bit_depth >> 3) *
                         multiplier;
 }
 
@@ -551,6 +539,7 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
         int ret = 0;
 
         list_for_each_entry(w_module, &pipe->w_list, node) {
+                uuid_le *uuid_mod;
                 w = w_module->w;
                 mconfig = w->priv;
 
@@ -588,13 +577,15 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                  * FE/BE params
                  */
                 skl_tplg_update_module_params(w, ctx);
-                mconfig->id.pvt_id = skl_get_pvt_id(ctx, mconfig);
+                uuid_mod = (uuid_le *)mconfig->guid;
+                mconfig->id.pvt_id = skl_get_pvt_id(ctx, uuid_mod,
+                                                mconfig->id.instance_id);
                 if (mconfig->id.pvt_id < 0)
                         return ret;
                 skl_tplg_set_module_init_data(w);
                 ret = skl_init_module(ctx, mconfig);
                 if (ret < 0) {
-                        skl_put_pvt_id(ctx, mconfig);
+                        skl_put_pvt_id(ctx, uuid_mod, &mconfig->id.pvt_id);
                         return ret;
                 }
                 skl_tplg_alloc_pipe_mcps(skl, mconfig);
@@ -614,7 +605,9 @@ static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
         struct skl_module_cfg *mconfig = NULL;
 
         list_for_each_entry(w_module, &pipe->w_list, node) {
+                uuid_le *uuid_mod;
                 mconfig  = w_module->w->priv;
+                uuid_mod = (uuid_le *)mconfig->guid;
 
                 if (mconfig->is_loadable && ctx->dsp->fw_ops.unload_mod &&
                         mconfig->m_state > SKL_MODULE_UNINIT) {
@@ -623,7 +616,7 @@ static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
                         if (ret < 0)
                                 return -EIO;
                 }
-                skl_put_pvt_id(ctx, mconfig);
+                skl_put_pvt_id(ctx, uuid_mod, &mconfig->id.pvt_id);
         }
 
         /* no modules to unload in this path, so return */
@@ -645,8 +638,9 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
         struct skl_module_cfg *mconfig = w->priv;
         struct skl_pipe_module *w_module;
         struct skl_pipe *s_pipe = mconfig->pipe;
-        struct skl_module_cfg *src_module = NULL, *dst_module;
+        struct skl_module_cfg *src_module = NULL, *dst_module, *module;
         struct skl_sst *ctx = skl->skl_sst;
+        struct skl_module_deferred_bind *modules;
 
         /* check resource available */
         if (!skl_is_pipe_mcps_avail(skl, mconfig))
@@ -687,29 +681,48 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
                 src_module = dst_module;
         }
 
+        /*
+         * When the destination module is initialized, check for these modules
+         * in deferred bind list. If found, bind them.
+         */
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                if (list_empty(&skl->bind_list))
+                        break;
+
+                list_for_each_entry(modules, &skl->bind_list, node) {
+                        module = w_module->w->priv;
+                        if (modules->dst == module)
+                                skl_bind_modules(ctx, modules->src,
+                                                        modules->dst);
+                }
+        }
+
         return 0;
 }
 
-static int skl_fill_sink_instance_id(struct skl_sst *ctx,
-                                struct skl_algo_data *alg_data)
+static int skl_fill_sink_instance_id(struct skl_sst *ctx, u32 *params,
+                                int size, struct skl_module_cfg *mcfg)
 {
-        struct skl_kpb_params *params = (struct skl_kpb_params *)alg_data->params;
-        struct skl_mod_inst_map *inst;
         int i, pvt_id;
 
-        inst = params->map;
+        if (mcfg->m_type == SKL_MODULE_TYPE_KPB) {
+                struct skl_kpb_params *kpb_params =
+                                (struct skl_kpb_params *)params;
+                struct skl_mod_inst_map *inst = kpb_params->map;
 
-        for (i = 0; i < params->num_modules; i++) {
-                pvt_id = skl_get_pvt_instance_id_map(ctx,
-                                        inst->mod_id, inst->inst_id);
-                if (pvt_id < 0)
-                        return -EINVAL;
-                inst->inst_id = pvt_id;
-                inst++;
+                for (i = 0; i < kpb_params->num_modules; i++) {
+                        pvt_id = skl_get_pvt_instance_id_map(ctx, inst->mod_id,
+                                                                inst->inst_id);
+                        if (pvt_id < 0)
+                                return -EINVAL;
+
+                        inst->inst_id = pvt_id;
+                        inst++;
+                }
         }
+
         return 0;
 }
-
 /*
  * Some modules require params to be set after the module is bound to
  * all pins connected.
@@ -726,6 +739,7 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
         struct soc_bytes_ext *sb;
         struct skl_algo_data *bc;
         struct skl_specific_cfg *sp_cfg;
+        u32 *params;
 
         /*
          * check all out/in pins are in bind state.
@@ -758,11 +772,18 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
                         bc = (struct skl_algo_data *)sb->dobj.private;
 
                         if (bc->set_params == SKL_PARAM_BIND) {
-                                if (mconfig->m_type == SKL_MODULE_TYPE_KPB)
-                                        skl_fill_sink_instance_id(ctx, bc);
-                                ret = skl_set_module_params(ctx,
-                                                (u32 *)bc->params, bc->max,
-                                                bc->param_id, mconfig);
+                                params = kzalloc(bc->max, GFP_KERNEL);
+                                if (!params)
+                                        return -ENOMEM;
+
+                                memcpy(params, bc->params, bc->max);
+                                skl_fill_sink_instance_id(ctx, params, bc->max,
+                                                                mconfig);
+
+                                ret = skl_set_module_params(ctx, params,
+                                                bc->max, bc->param_id, mconfig);
+                                kfree(params);
+
                                 if (ret < 0)
                                         return ret;
                         }
@@ -772,6 +793,44 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+
+static int skl_tplg_module_add_deferred_bind(struct skl *skl,
+        struct skl_module_cfg *src, struct skl_module_cfg *dst)
+{
+        struct skl_module_deferred_bind *m_list, *modules;
+        int i;
+
+        /* only supported for module with static pin connection */
+        for (i = 0; i < dst->max_in_queue; i++) {
+                struct skl_module_pin *pin = &dst->m_in_pin[i];
+
+                if (pin->is_dynamic)
+                        continue;
+
+                if ((pin->id.module_id  == src->id.module_id) &&
+                        (pin->id.instance_id  == src->id.instance_id)) {
+
+                        if (!list_empty(&skl->bind_list)) {
+                                list_for_each_entry(modules, &skl->bind_list, node) {
+                                        if (modules->src == src && modules->dst == dst)
+                                                return 0;
+                                }
+                        }
+
+                        m_list = kzalloc(sizeof(*m_list), GFP_KERNEL);
+                        if (!m_list)
+                                return -ENOMEM;
+
+                        m_list->src = src;
+                        m_list->dst = dst;
+
+                        list_add(&m_list->node, &skl->bind_list);
+                }
+        }
+
+        return 0;
+}
+
 static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                                 struct skl *skl,
                                 struct snd_soc_dapm_widget *src_w,
@@ -806,6 +865,28 @@ static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                         sink = p->sink;
                         sink_mconfig = sink->priv;
 
+                        /*
+                         * Modules other than PGA leaf can be connected
+                         * directly or via switch to a module in another
+                         * pipeline. EX: reference path
+                         * when the path is enabled, the dst module that needs
+                         * to be bound may not be initialized. if the module is
+                         * not initialized, add these modules in the deferred
+                         * bind list and when the dst module is initialised,
+                         * bind this module to the dst_module in deferred list.
+                         */
+                        if (((src_mconfig->m_state == SKL_MODULE_INIT_DONE)
+                                && (sink_mconfig->m_state == SKL_MODULE_UNINIT))) {
+
+                                ret = skl_tplg_module_add_deferred_bind(skl,
+                                                src_mconfig, sink_mconfig);
+
+                                if (ret < 0)
+                                        return ret;
+
+                        }
+
+
                         if (src_mconfig->m_state == SKL_MODULE_UNINIT ||
                                 sink_mconfig->m_state == SKL_MODULE_UNINIT)
                                 continue;
@@ -985,15 +1066,6 @@ static int skl_tplg_mixer_dapm_pre_pmd_event(struct snd_soc_dapm_widget *w,
                         src_mconfig = sink_mconfig->m_in_pin[i].tgt_mcfg;
                         if (!src_mconfig)
                                 continue;
-                        /*
-                         * If path_found == 1, that means pmd for source
-                         * pipe has not occurred, source is connected to
-                         * some other sink. so its responsibility of sink
-                         * to unbind itself from source.
-                         */
-                        ret = skl_stop_pipe(ctx, src_mconfig->pipe);
-                        if (ret < 0)
-                                return ret;
 
                         ret = skl_unbind_modules(ctx,
                                                 src_mconfig, sink_mconfig);
@@ -1019,6 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
         struct skl_module_cfg *src_module = NULL, *dst_module;
         struct skl_sst *ctx = skl->skl_sst;
         struct skl_pipe *s_pipe = mconfig->pipe;
+        struct skl_module_deferred_bind *modules, *tmp;
 
         if (s_pipe->state == SKL_PIPE_INVALID)
                 return -EINVAL;
@@ -1027,6 +1100,35 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
         skl_tplg_free_pipe_mem(skl, mconfig);
 
         list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                if (list_empty(&skl->bind_list))
+                        break;
+
+                src_module = w_module->w->priv;
+
+                list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
+                        /*
+                         * When the destination module is deleted, Unbind the
+                         * modules from deferred bind list.
+                         */
+                        if (modules->dst == src_module) {
+                                skl_unbind_modules(ctx, modules->src,
+                                                modules->dst);
+                        }
+
+                        /*
+                         * When the source module is deleted, remove this entry
+                         * from the deferred bind list.
+                         */
+                        if (modules->src == src_module) {
+                                list_del(&modules->node);
+                                modules->src = NULL;
+                                modules->dst = NULL;
+                                kfree(modules);
+                        }
+                }
+        }
+
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
                 dst_module = w_module->w->priv;
 
                 if (mconfig->m_state >= SKL_MODULE_INIT_DONE)
@@ -1042,6 +1144,11 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
 
         skl_delete_pipe(ctx, mconfig->pipe);
 
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                src_module = w_module->w->priv;
+                src_module->m_state = SKL_MODULE_UNINIT;
+        }
+
         return skl_tplg_unload_pipe_modules(ctx, s_pipe);
 }
 
@@ -1083,36 +1190,6 @@ static int skl_tplg_pga_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
 }
 
 /*
- * In modelling, we assume there will be ONLY one mixer in a pipeline.  If
- * mixer is not required then it is treated as static mixer aka vmixer with
- * a hard path to source module
- * So we don't need to check if source is started or not as hard path puts
- * dependency on each other
- */
-static int skl_tplg_vmixer_event(struct snd_soc_dapm_widget *w,
-                                struct snd_kcontrol *k, int event)
-{
-        struct snd_soc_dapm_context *dapm = w->dapm;
-        struct skl *skl = get_skl_ctx(dapm->dev);
-
-        switch (event) {
-        case SND_SOC_DAPM_PRE_PMU:
-                return skl_tplg_mixer_dapm_pre_pmu_event(w, skl);
-
-        case SND_SOC_DAPM_POST_PMU:
-                return skl_tplg_mixer_dapm_post_pmu_event(w, skl);
-
-        case SND_SOC_DAPM_PRE_PMD:
-                return skl_tplg_mixer_dapm_pre_pmd_event(w, skl);
-
-        case SND_SOC_DAPM_POST_PMD:
-                return skl_tplg_mixer_dapm_post_pmd_event(w, skl);
-        }
-
-        return 0;
-}
-
-/*
  * In modelling, we assume there will be ONLY one mixer in a pipeline. If a
  * second one is required that is created as another pipe entity.
  * The mixer is responsible for pipe management and represent a pipeline
@@ -1252,10 +1329,12 @@ static void skl_tplg_fill_dma_id(struct skl_module_cfg *mcfg,
                 case SKL_DEVICE_HDALINK:
                         pipe->p_params->link_dma_id = params->link_dma_id;
                         pipe->p_params->link_index = params->link_index;
+                        pipe->p_params->link_bps = params->link_bps;
                         break;
 
                 case SKL_DEVICE_HDAHOST:
                         pipe->p_params->host_dma_id = params->host_dma_id;
+                        pipe->p_params->host_bps = params->host_bps;
                         break;
 
                 default:
@@ -1578,7 +1657,7 @@ int skl_tplg_be_update_params(struct snd_soc_dai *dai,
 
 static const struct snd_soc_tplg_widget_events skl_tplg_widget_ops[] = {
         {SKL_MIXER_EVENT, skl_tplg_mixer_event},
-        {SKL_VMIXER_EVENT, skl_tplg_vmixer_event},
+        {SKL_VMIXER_EVENT, skl_tplg_mixer_event},
         {SKL_PGA_EVENT, skl_tplg_pga_event},
 };
 
@@ -1632,7 +1711,7 @@ static int skl_tplg_add_pipe(struct device *dev,
         list_for_each_entry(ppl, &skl->ppl_list, node) {
                 if (ppl->pipe->ppl_id == tkn_elem->value) {
                         mconfig->pipe = ppl->pipe;
-                        return EEXIST;
+                        return -EEXIST;
                 }
         }
 
@@ -1924,11 +2003,13 @@ static int skl_tplg_get_token(struct device *dev,
                 ret = skl_tplg_add_pipe(dev,
                                 mconfig, skl, tkn_elem);
 
-                if (ret < 0)
+                if (ret < 0) {
+                        if (ret == -EEXIST) {
+                                is_pipe_exists = 1;
+                                break;
+                        }
                         return is_pipe_exists;
-
-                if (ret == EEXIST)
-                        is_pipe_exists = 1;
+                }
 
                 break;
 
diff --git a/sound/soc/intel/skylake/skl-topology.h b/sound/soc/intel/skylake/skl-topology.h
index fefab0e99a3b..cc64d6bdb4f6 100644
--- a/sound/soc/intel/skylake/skl-topology.h
+++ b/sound/soc/intel/skylake/skl-topology.h
@@ -257,6 +257,8 @@ struct skl_pipe_params {
         snd_pcm_format_t format;
         int link_index;
         int stream;
+        unsigned int host_bps;
+        unsigned int link_bps;
 };
 
 struct skl_pipe {
@@ -334,17 +336,10 @@ struct skl_pipeline {
         struct list_head node;
 };
 
-#define SKL_LIB_NAME_LENGTH 128
-#define SKL_MAX_LIB 16
-
-struct skl_lib_info {
-        char name[SKL_LIB_NAME_LENGTH];
-        const struct firmware *fw;
-};
-
-struct skl_manifest {
-        u32 lib_count;
-        struct skl_lib_info lib[SKL_MAX_LIB];
+struct skl_module_deferred_bind {
+        struct skl_module_cfg *src;
+        struct skl_module_cfg *dst;
+        struct list_head node;
 };
 
 static inline struct skl *get_skl_ctx(struct device *dev)
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 0c57d4eaae3a..6df3b317a476 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -512,7 +512,7 @@ static int probe_codec(struct hdac_ext_bus *ebus, int addr)
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         unsigned int cmd = (addr << 28) | (AC_NODE_ROOT << 20) |
                 (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID;
-        unsigned int res;
+        unsigned int res = -1;
 
         mutex_lock(&bus->cmd_mutex);
         snd_hdac_bus_send_cmd(bus, cmd);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index 8e2878012d53..a454f6035f3e 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -56,6 +56,7 @@ struct skl {
 
         struct skl_dsp_resource resource;
         struct list_head ppl_list;
+        struct list_head bind_list;
 
         const char *fw_name;
         char tplg_name[64];
diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index d7013bde6f45..5c68797f36c4 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -22,6 +22,16 @@ config SND_SOC_MT2701_CS42448
           Select Y if you have such device.
           If unsure select "N".
 
+config SND_SOC_MT2701_WM8960
+        tristate "ASoc Audio driver for MT2701 with WM8960 codec"
+        depends on SND_SOC_MT2701 && I2C
+        select SND_SOC_WM8960
+        help
+          This adds ASoC driver for Mediatek MT2701 boards
+          with the WM8960 codecs.
+          Select Y if you have such device.
+          If unsure select "N".
+
 config SND_SOC_MT8173
         tristate "ASoC support for Mediatek MT8173 chip"
         depends on ARCH_MEDIATEK
diff --git a/sound/soc/mediatek/mt2701/Makefile b/sound/soc/mediatek/mt2701/Makefile
index 31c3d04d4942..c91deb6aca21 100644
--- a/sound/soc/mediatek/mt2701/Makefile
+++ b/sound/soc/mediatek/mt2701/Makefile
@@ -17,3 +17,4 @@ obj-$(CONFIG_SND_SOC_MT2701) += snd-soc-mt2701-afe.o
 
 # machine driver
 obj-$(CONFIG_SND_SOC_MT2701_CS42448) += mt2701-cs42448.o
+obj-$(CONFIG_SND_SOC_MT2701_WM8960) += mt2701-wm8960.o
diff --git a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
index c7fa3e663463..bc5d4db94de6 100644
--- a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
+++ b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
@@ -604,6 +604,22 @@ static struct snd_soc_dai_ops mt2701_btmrg_ops = {
 static struct snd_soc_dai_driver mt2701_afe_pcm_dais[] = {
         /* FE DAIs: memory intefaces to CPU */
         {
+                .name = "PCMO0",
+                .id = MT2701_MEMIF_DL1,
+                .suspend = mtk_afe_dai_suspend,
+                .resume = mtk_afe_dai_resume,
+                .playback = {
+                        .stream_name = "DL1",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = SNDRV_PCM_RATE_8000_192000,
+                        .formats = (SNDRV_PCM_FMTBIT_S16_LE
+                                | SNDRV_PCM_FMTBIT_S24_LE
+                                | SNDRV_PCM_FMTBIT_S32_LE)
+                },
+                .ops = &mt2701_single_memif_dai_ops,
+        },
+        {
                 .name = "PCM_multi",
                 .id = MT2701_MEMIF_DLM,
                 .suspend = mtk_afe_dai_suspend,
diff --git a/sound/soc/mediatek/mt2701/mt2701-cs42448.c b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
index 1e7e8d43fd8a..aa5b31b121e3 100644
--- a/sound/soc/mediatek/mt2701/mt2701-cs42448.c
+++ b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
@@ -129,7 +129,7 @@ static int mt2701_cs42448_fe_ops_startup(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_soc_ops mt2701_cs42448_48k_fe_ops = {
+static const struct snd_soc_ops mt2701_cs42448_48k_fe_ops = {
         .startup = mt2701_cs42448_fe_ops_startup,
 };
 
diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
new file mode 100644
index 000000000000..a08ce2323bdc
--- /dev/null
+++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
@@ -0,0 +1,176 @@
+/*
+ * mt2701-wm8960.c  --  MT2701 WM8960 ALSA SoC machine driver
+ *
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Ryder Lee <ryder.lee@mediatek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <sound/soc.h>
+
+#include "mt2701-afe-common.h"
+
+static const struct snd_soc_dapm_widget mt2701_wm8960_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone", NULL),
+        SND_SOC_DAPM_MIC("AMIC", NULL),
+};
+
+static const struct snd_kcontrol_new mt2701_wm8960_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone"),
+        SOC_DAPM_PIN_SWITCH("AMIC"),
+};
+
+static int mt2701_wm8960_be_ops_hw_params(struct snd_pcm_substream *substream,
+                                          struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+        unsigned int mclk_rate;
+        unsigned int rate = params_rate(params);
+        unsigned int div_mclk_over_bck = rate > 192000 ? 2 : 4;
+        unsigned int div_bck_over_lrck = 64;
+
+        mclk_rate = rate * div_bck_over_lrck * div_mclk_over_bck;
+
+        snd_soc_dai_set_sysclk(cpu_dai, 0, mclk_rate, SND_SOC_CLOCK_OUT);
+        snd_soc_dai_set_sysclk(codec_dai, 0, mclk_rate, SND_SOC_CLOCK_IN);
+
+        return 0;
+}
+
+static struct snd_soc_ops mt2701_wm8960_be_ops = {
+        .hw_params = mt2701_wm8960_be_ops_hw_params
+};
+
+static struct snd_soc_dai_link mt2701_wm8960_dai_links[] = {
+        /* FE */
+        {
+                .name = "wm8960-playback",
+                .stream_name = "wm8960-playback",
+                .cpu_dai_name = "PCMO0",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .trigger = {SND_SOC_DPCM_TRIGGER_POST,
+                            SND_SOC_DPCM_TRIGGER_POST},
+                .dynamic = 1,
+                .dpcm_playback = 1,
+        },
+        {
+                .name = "wm8960-capture",
+                .stream_name = "wm8960-capture",
+                .cpu_dai_name = "PCM0",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .trigger = {SND_SOC_DPCM_TRIGGER_POST,
+                            SND_SOC_DPCM_TRIGGER_POST},
+                .dynamic = 1,
+                .dpcm_capture = 1,
+        },
+        /* BE */
+        {
+                .name = "wm8960-codec",
+                .cpu_dai_name = "I2S0",
+                .no_pcm = 1,
+                .codec_dai_name = "wm8960-hifi",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBS_CFS
+                        | SND_SOC_DAIFMT_GATED,
+                .ops = &mt2701_wm8960_be_ops,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+};
+
+static struct snd_soc_card mt2701_wm8960_card = {
+        .name = "mt2701-wm8960",
+        .owner = THIS_MODULE,
+        .dai_link = mt2701_wm8960_dai_links,
+        .num_links = ARRAY_SIZE(mt2701_wm8960_dai_links),
+        .controls = mt2701_wm8960_controls,
+        .num_controls = ARRAY_SIZE(mt2701_wm8960_controls),
+        .dapm_widgets = mt2701_wm8960_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(mt2701_wm8960_widgets),
+};
+
+static int mt2701_wm8960_machine_probe(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = &mt2701_wm8960_card;
+        struct device_node *platform_node, *codec_node;
+        int ret, i;
+
+        platform_node = of_parse_phandle(pdev->dev.of_node,
+                                         "mediatek,platform", 0);
+        if (!platform_node) {
+                dev_err(&pdev->dev, "Property 'platform' missing or invalid\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < card->num_links; i++) {
+                if (mt2701_wm8960_dai_links[i].platform_name)
+                        continue;
+                mt2701_wm8960_dai_links[i].platform_of_node = platform_node;
+        }
+
+        card->dev = &pdev->dev;
+
+        codec_node = of_parse_phandle(pdev->dev.of_node,
+                                      "mediatek,audio-codec", 0);
+        if (!codec_node) {
+                dev_err(&pdev->dev,
+                        "Property 'audio-codec' missing or invalid\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < card->num_links; i++) {
+                if (mt2701_wm8960_dai_links[i].codec_name)
+                        continue;
+                mt2701_wm8960_dai_links[i].codec_of_node = codec_node;
+        }
+
+        ret = snd_soc_of_parse_audio_routing(card, "audio-routing");
+        if (ret) {
+                dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret);
+                return ret;
+        }
+
+        ret = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret)
+                dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+                        __func__, ret);
+
+        return ret;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id mt2701_wm8960_machine_dt_match[] = {
+        {.compatible = "mediatek,mt2701-wm8960-machine",},
+        {}
+};
+#endif
+
+static struct platform_driver mt2701_wm8960_machine = {
+        .driver = {
+                .name = "mt2701-wm8960",
+                .owner = THIS_MODULE,
+#ifdef CONFIG_OF
+                .of_match_table = mt2701_wm8960_machine_dt_match,
+#endif
+        },
+        .probe = mt2701_wm8960_machine_probe,
+};
+
+module_platform_driver(mt2701_wm8960_machine);
+
+/* Module information */
+MODULE_DESCRIPTION("MT2701 WM8960 ALSA SoC machine driver");
+MODULE_AUTHOR("Ryder Lee <ryder.lee@mediatek.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("mt2701 wm8960 soc card");
+
diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c
index 46c8e6ae00b4..e0c2b23ec711 100644
--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c
+++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c
@@ -67,7 +67,7 @@ static int mt8173_max98090_hw_params(struct snd_pcm_substream *substream,
                                       SND_SOC_CLOCK_IN);
 }
 
-static struct snd_soc_ops mt8173_max98090_ops = {
+static const struct snd_soc_ops mt8173_max98090_ops = {
         .hw_params = mt8173_max98090_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
index 467f7049a288..5e383eb456a4 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
@@ -75,7 +75,7 @@ static int mt8173_rt5650_rt5514_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_rt5514_ops = {
+static const struct snd_soc_ops mt8173_rt5650_rt5514_ops = {
         .hw_params = mt8173_rt5650_rt5514_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
index 1b8b2a778845..fed1f15a39c2 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
@@ -79,7 +79,7 @@ static int mt8173_rt5650_rt5676_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_rt5676_ops = {
+static const struct snd_soc_ops mt8173_rt5650_rt5676_ops = {
         .hw_params = mt8173_rt5650_rt5676_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
index ba65f4157a7e..a78470839b65 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
@@ -105,7 +105,7 @@ static int mt8173_rt5650_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_ops = {
+static const struct snd_soc_ops mt8173_rt5650_ops = {
         .hw_params = mt8173_rt5650_hw_params,
 };
 
diff --git a/sound/soc/omap/am3517evm.c b/sound/soc/omap/am3517evm.c
index 25a33e9d417a..d5651026ec10 100644
--- a/sound/soc/omap/am3517evm.c
+++ b/sound/soc/omap/am3517evm.c
@@ -49,7 +49,7 @@ static int am3517evm_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops am3517evm_ops = {
+static const struct snd_soc_ops am3517evm_ops = {
         .hw_params = am3517evm_hw_params,
 };
 
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index fdecb7043174..71e5f31fa306 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -124,7 +124,7 @@ static int n810_hw_params(struct snd_pcm_substream *substream,
         return err;
 }
 
-static struct snd_soc_ops n810_ops = {
+static const struct snd_soc_ops n810_ops = {
         .startup = n810_startup,
         .hw_params = n810_hw_params,
         .shutdown = n810_shutdown,
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index 89fe95e877db..614b18d2f631 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -70,7 +70,7 @@ static int omap_abe_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops omap_abe_ops = {
+static const struct snd_soc_ops omap_abe_ops = {
         .hw_params = omap_abe_hw_params,
 };
 
diff --git a/sound/soc/omap/omap-twl4030.c b/sound/soc/omap/omap-twl4030.c
index 743131473056..a24b0dedabb9 100644
--- a/sound/soc/omap/omap-twl4030.c
+++ b/sound/soc/omap/omap-twl4030.c
@@ -73,7 +73,7 @@ static int omap_twl4030_hw_params(struct snd_pcm_substream *substream,
         return snd_soc_runtime_set_dai_fmt(rtd, fmt);
 }
 
-static struct snd_soc_ops omap_twl4030_ops = {
+static const struct snd_soc_ops omap_twl4030_ops = {
         .hw_params = omap_twl4030_hw_params,
 };
 
diff --git a/sound/soc/omap/omap3pandora.c b/sound/soc/omap/omap3pandora.c
index 732e749a1f8e..4e3de712159c 100644
--- a/sound/soc/omap/omap3pandora.c
+++ b/sound/soc/omap/omap3pandora.c
@@ -184,7 +184,7 @@ static int omap3pandora_in_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static struct snd_soc_ops omap3pandora_ops = {
+static const struct snd_soc_ops omap3pandora_ops = {
         .hw_params = omap3pandora_hw_params,
 };
 
diff --git a/sound/soc/omap/osk5912.c b/sound/soc/omap/osk5912.c
index aa4053bf6710..e4096779ca05 100644
--- a/sound/soc/omap/osk5912.c
+++ b/sound/soc/omap/osk5912.c
@@ -68,7 +68,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         return err;
 }
 
-static struct snd_soc_ops osk_ops = {
+static const struct snd_soc_ops osk_ops = {
         .startup = osk_startup,
         .hw_params = osk_hw_params,
         .shutdown = osk_shutdown,
diff --git a/sound/soc/omap/rx51.c b/sound/soc/omap/rx51.c
index a76845748a10..3aeb65feaea1 100644
--- a/sound/soc/omap/rx51.c
+++ b/sound/soc/omap/rx51.c
@@ -123,7 +123,7 @@ static int rx51_hw_params(struct snd_pcm_substream *substream,
                                       SND_SOC_CLOCK_IN);
 }
 
-static struct snd_soc_ops rx51_ops = {
+static const struct snd_soc_ops rx51_ops = {
         .startup = rx51_startup,
         .hw_params = rx51_hw_params,
 };
@@ -433,10 +433,9 @@ static int rx51_soc_probe(struct platform_device *pdev)
         }
 
         pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
-        if (pdata == NULL) {
-                dev_err(card->dev, "failed to create private data\n");
+        if (pdata == NULL)
                 return -ENOMEM;
-        }
+
         snd_soc_card_set_drvdata(card, pdata);
 
         pdata->tvout_selection_gpio = devm_gpiod_get(card->dev,
diff --git a/sound/soc/pxa/brownstone.c b/sound/soc/pxa/brownstone.c
index b6cb9950f05d..9a3f5b799720 100644
--- a/sound/soc/pxa/brownstone.c
+++ b/sound/soc/pxa/brownstone.c
@@ -74,7 +74,7 @@ static int brownstone_wm8994_hw_params(struct snd_pcm_substream *substream,
 }
 
 /* machine stream operations */
-static struct snd_soc_ops brownstone_ops = {
+static const struct snd_soc_ops brownstone_ops = {
         .hw_params = brownstone_wm8994_hw_params,
 };
 
diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
index 311774e9ca46..054e0d65db9d 100644
--- a/sound/soc/pxa/corgi.c
+++ b/sound/soc/pxa/corgi.c
@@ -154,7 +154,7 @@ static int corgi_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops corgi_ops = {
+static const struct snd_soc_ops corgi_ops = {
         .startup = corgi_startup,
         .hw_params = corgi_hw_params,
         .shutdown = corgi_shutdown,
diff --git a/sound/soc/pxa/e750_wm9705.c b/sound/soc/pxa/e750_wm9705.c
index fdcd94adee7c..82bcbbb1841b 100644
--- a/sound/soc/pxa/e750_wm9705.c
+++ b/sound/soc/pxa/e750_wm9705.c
@@ -81,7 +81,7 @@ static struct snd_soc_dai_link e750_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9705-aux",
+                .codec_dai_name = "wm9705-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9705-codec",
         },
diff --git a/sound/soc/pxa/e800_wm9712.c b/sound/soc/pxa/e800_wm9712.c
index 2df714f70ec0..1ed8aa2348f1 100644
--- a/sound/soc/pxa/e800_wm9712.c
+++ b/sound/soc/pxa/e800_wm9712.c
@@ -81,7 +81,7 @@ static struct snd_soc_dai_link e800_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9712-aux",
+                .codec_dai_name = "wm9712-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9712-codec",
         },
diff --git a/sound/soc/pxa/em-x270.c b/sound/soc/pxa/em-x270.c
index 6f2020f6c8d3..e046770ce70e 100644
--- a/sound/soc/pxa/em-x270.c
+++ b/sound/soc/pxa/em-x270.c
@@ -43,7 +43,7 @@ static struct snd_soc_dai_link em_x270_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9712-aux",
+                .codec_dai_name = "wm9712-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9712-codec",
         },
diff --git a/sound/soc/pxa/hx4700.c b/sound/soc/pxa/hx4700.c
index 85483049b916..a9ac881c2e14 100644
--- a/sound/soc/pxa/hx4700.c
+++ b/sound/soc/pxa/hx4700.c
@@ -79,7 +79,7 @@ static int hx4700_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops hx4700_ops = {
+static const struct snd_soc_ops hx4700_ops = {
         .hw_params = hx4700_hw_params,
 };
 
diff --git a/sound/soc/pxa/imote2.c b/sound/soc/pxa/imote2.c
index 9d0e40771ef5..78475376f971 100644
--- a/sound/soc/pxa/imote2.c
+++ b/sound/soc/pxa/imote2.c
@@ -42,7 +42,7 @@ static int imote2_asoc_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops imote2_asoc_ops = {
+static const struct snd_soc_ops imote2_asoc_ops = {
         .hw_params = imote2_asoc_hw_params,
 };
 
diff --git a/sound/soc/pxa/magician.c b/sound/soc/pxa/magician.c
index 2d4d4455fe87..2fc012b06c43 100644
--- a/sound/soc/pxa/magician.c
+++ b/sound/soc/pxa/magician.c
@@ -255,12 +255,12 @@ static int magician_capture_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops magician_capture_ops = {
+static const struct snd_soc_ops magician_capture_ops = {
         .startup = magician_startup,
         .hw_params = magician_capture_hw_params,
 };
 
-static struct snd_soc_ops magician_playback_ops = {
+static const struct snd_soc_ops magician_playback_ops = {
         .startup = magician_startup,
         .hw_params = magician_playback_hw_params,
 };
diff --git a/sound/soc/pxa/mioa701_wm9713.c b/sound/soc/pxa/mioa701_wm9713.c
index 8760a6687885..c4c6fbedc723 100644
--- a/sound/soc/pxa/mioa701_wm9713.c
+++ b/sound/soc/pxa/mioa701_wm9713.c
@@ -157,7 +157,7 @@ static struct snd_soc_dai_link mioa701_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9713-aux",
+                .codec_dai_name = "wm9713-aux",
                 .codec_name = "wm9713-codec",
                 .platform_name = "pxa-pcm-audio",
                 .ops = &mioa701_ops,
diff --git a/sound/soc/pxa/mmp-pcm.c b/sound/soc/pxa/mmp-pcm.c
index 96df9b2d8fc4..5b5f1a442891 100644
--- a/sound/soc/pxa/mmp-pcm.c
+++ b/sound/soc/pxa/mmp-pcm.c
@@ -166,7 +166,6 @@ static void mmp_pcm_free_dma_buffers(struct snd_pcm *pcm)
                 buf->area = NULL;
         }
 
-        return;
 }
 
 static int mmp_pcm_preallocate_dma_buffer(struct snd_pcm_substream *substream,
diff --git a/sound/soc/pxa/mmp-sspa.c b/sound/soc/pxa/mmp-sspa.c
index ca8b23f8c525..9cc35012e6e5 100644
--- a/sound/soc/pxa/mmp-sspa.c
+++ b/sound/soc/pxa/mmp-sspa.c
@@ -119,7 +119,6 @@ static void mmp_sspa_shutdown(struct snd_pcm_substream *substream,
         clk_disable(priv->sspa->clk);
         clk_disable(priv->sysclk);
 
-        return;
 }
 
 /*
diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
index a879aba0691f..b6693f32fc02 100644
--- a/sound/soc/pxa/poodle.c
+++ b/sound/soc/pxa/poodle.c
@@ -129,7 +129,7 @@ static int poodle_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops poodle_ops = {
+static const struct snd_soc_ops poodle_ops = {
         .startup = poodle_startup,
         .hw_params = poodle_hw_params,
         .shutdown = poodle_shutdown,
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index 3cad990dad2c..0291c7cb64eb 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -354,6 +354,7 @@ static int pxa_ssp_set_dai_pll(struct snd_soc_dai *cpu_dai, int pll_id,
                 if (ssp->type == PXA3xx_SSP) {
                         u32 val;
                         u64 tmp = 19968;
+
                         tmp *= 1000000;
                         do_div(tmp, freq_out);
                         val = tmp;
@@ -590,13 +591,13 @@ static int pxa_ssp_hw_params(struct snd_pcm_substream *substream,
 
                 if ((pxa_ssp_get_scr(ssp) == 4) && (width == 16)) {
                         /* This is a special case where the bitclk is 64fs
-                        * and we're not dealing with 2*32 bits of audio
-                        * samples.
-                        *
-                        * The SSP values used for that are all found out by
-                        * trying and failing a lot; some of the registers
-                        * needed for that mode are only available on PXA3xx.
-                        */
+                         * and we're not dealing with 2*32 bits of audio
+                         * samples.
+                         *
+                         * The SSP values used for that are all found out by
+                         * trying and failing a lot; some of the registers
+                         * needed for that mode are only available on PXA3xx.
+                         */
                         if (ssp->type != PXA3xx_SSP)
                                 return -EINVAL;
 
diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c
index 2e2fb1838ec2..f49bf02e5ec2 100644
--- a/sound/soc/pxa/pxa2xx-ac97.c
+++ b/sound/soc/pxa/pxa2xx-ac97.c
@@ -140,9 +140,8 @@ static int pxa2xx_ac97_mic_startup(struct snd_pcm_substream *substream,
 {
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 return -ENODEV;
-        else
-                snd_soc_dai_set_dma_data(cpu_dai, substream,
-                                         &pxa2xx_ac97_pcm_mic_mono_in);
+        snd_soc_dai_set_dma_data(cpu_dai, substream,
+                                 &pxa2xx_ac97_pcm_mic_mono_in);
 
         return 0;
 }
diff --git a/sound/soc/pxa/pxa2xx-i2s.c b/sound/soc/pxa/pxa2xx-i2s.c
index 0389cf7b4b1e..3fb60baf6eab 100644
--- a/sound/soc/pxa/pxa2xx-i2s.c
+++ b/sound/soc/pxa/pxa2xx-i2s.c
@@ -46,10 +46,10 @@
 #define SACR0_STRF      (1 << 5)        /* FIFO Select for EFWR Special Function */
 #define SACR0_EFWR      (1 << 4)        /* Enable EFWR Function  */
 #define SACR0_RST       (1 << 3)        /* FIFO, i2s Register Reset */
-#define SACR0_BCKD      (1 << 2)        /* Bit Clock Direction */
+#define SACR0_BCKD      (1 << 2)        /* Bit Clock Direction */
 #define SACR0_ENB       (1 << 0)        /* Enable I2S Link */
 #define SACR1_ENLBF     (1 << 5)        /* Enable Loopback */
-#define SACR1_DRPL      (1 << 4)        /* Disable Replaying Function */
+#define SACR1_DRPL      (1 << 4)        /* Disable Replaying Function */
 #define SACR1_DREC      (1 << 3)        /* Disable Recording Function */
 #define SACR1_AMSL      (1 << 0)        /* Specify Alternate Mode */
 
@@ -60,7 +60,7 @@
 #define SASR0_TFS       (1 << 3)        /* Tx FIFO Service Request */
 #define SASR0_BSY       (1 << 2)        /* I2S Busy */
 #define SASR0_RNE       (1 << 1)        /* Rx FIFO Not Empty */
-#define SASR0_TNF       (1 << 0)        /* Tx FIFO Not Empty */
+#define SASR0_TNF       (1 << 0)        /* Tx FIFO Not Empty */
 
 #define SAICR_ROR       (1 << 6)        /* Clear Rx FIFO Overrun Interrupt */
 #define SAICR_TUR       (1 << 5)        /* Clear Tx FIFO Underrun Interrupt */
@@ -119,7 +119,7 @@ static int pxa_i2s_wait(void)
         int i;
 
         /* flush the Rx FIFO */
-        for(i = 0; i < 16; i++)
+        for (i = 0; i < 16; i++)
                 SADR;
         return 0;
 }
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 410d48b93031..b51d7a0755d5 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -85,7 +85,7 @@ static int pxa2xx_soc_pcm_new(struct snd_soc_pcm_runtime *rtd)
 }
 
 static struct snd_soc_platform_driver pxa2xx_soc_platform = {
-        .ops    = &pxa2xx_pcm_ops,
+        .ops            = &pxa2xx_pcm_ops,
         .pcm_new        = pxa2xx_soc_pcm_new,
         .pcm_free       = pxa2xx_pcm_free_dma_buffers,
 };
diff --git a/sound/soc/pxa/raumfeld.c b/sound/soc/pxa/raumfeld.c
index 552b763005ed..111a907c4eb9 100644
--- a/sound/soc/pxa/raumfeld.c
+++ b/sound/soc/pxa/raumfeld.c
@@ -132,7 +132,7 @@ static int raumfeld_cs4270_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops raumfeld_cs4270_ops = {
+static const struct snd_soc_ops raumfeld_cs4270_ops = {
         .startup = raumfeld_cs4270_startup,
         .shutdown = raumfeld_cs4270_shutdown,
         .hw_params = raumfeld_cs4270_hw_params,
@@ -228,14 +228,12 @@ static struct snd_soc_ops raumfeld_ak4104_ops = {
         .codec_name     = "spi0.0",                     \
 }
 
-static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] =
-{
+static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] = {
         DAI_LINK_CS4270,
         DAI_LINK_AK4104,
 };
 
-static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] =
-{
+static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] = {
         DAI_LINK_CS4270,
 };
 
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index 07d77cddac60..1671da648e95 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -156,7 +156,7 @@ static int spitz_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops spitz_ops = {
+static const struct snd_soc_ops spitz_ops = {
         .startup = spitz_startup,
         .hw_params = spitz_hw_params,
 };
@@ -230,8 +230,8 @@ static const struct snd_soc_dapm_route spitz_audio_map[] = {
         {"Headset Jack", NULL, "ROUT1"},
 
         /* ext speaker connected to LOUT2, ROUT2  */
-        {"Ext Spk", NULL , "ROUT2"},
-        {"Ext Spk", NULL , "LOUT2"},
+        {"Ext Spk", NULL, "ROUT2"},
+        {"Ext Spk", NULL, "LOUT2"},
 
         /* mic is connected to input 1 - with bias */
         {"LINPUT1", NULL, "Mic Bias"},
diff --git a/sound/soc/pxa/tosa.c b/sound/soc/pxa/tosa.c
index e022b2a777f6..ae9c12e1ea2a 100644
--- a/sound/soc/pxa/tosa.c
+++ b/sound/soc/pxa/tosa.c
@@ -85,7 +85,7 @@ static int tosa_startup(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_soc_ops tosa_ops = {
+static const struct snd_soc_ops tosa_ops = {
         .startup = tosa_startup,
 };
 
@@ -133,7 +133,7 @@ static int tosa_set_spk(struct snd_kcontrol *kcontrol,
 static int tosa_hp_event(struct snd_soc_dapm_widget *w,
         struct snd_kcontrol *k, int event)
 {
-        gpio_set_value(TOSA_GPIO_L_MUTE, SND_SOC_DAPM_EVENT_ON(event) ? 1 :0);
+        gpio_set_value(TOSA_GPIO_L_MUTE, SND_SOC_DAPM_EVENT_ON(event) ? 1 : 0);
         return 0;
 }
 
diff --git a/sound/soc/pxa/z2.c b/sound/soc/pxa/z2.c
index 990b1aa6d7f6..5b0eccd2b4dd 100644
--- a/sound/soc/pxa/z2.c
+++ b/sound/soc/pxa/z2.c
@@ -119,8 +119,8 @@ static const struct snd_soc_dapm_route z2_audio_map[] = {
         {"Headphone Jack", NULL, "ROUT1"},
 
         /* ext speaker connected to LOUT2, ROUT2  */
-        {"Ext Spk", NULL , "ROUT2"},
-        {"Ext Spk", NULL , "LOUT2"},
+        {"Ext Spk", NULL, "ROUT2"},
+        {"Ext Spk", NULL, "LOUT2"},
 
         /* mic is connected to R input 2 - with bias */
         {"RINPUT2", NULL, "Mic Bias"},
@@ -152,7 +152,7 @@ err:
         return ret;
 }
 
-static struct snd_soc_ops z2_ops = {
+static const struct snd_soc_ops z2_ops = {
         .hw_params = z2_hw_params,
 };
 
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index 6fbcdf02c88d..ba468e560dd2 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -132,7 +132,7 @@ static int zylonite_voice_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops zylonite_voice_ops = {
+static const struct snd_soc_ops zylonite_voice_ops = {
         .hw_params = zylonite_voice_hw_params,
 };
 
diff --git a/sound/soc/qcom/lpass-apq8016.c b/sound/soc/qcom/lpass-apq8016.c
index 8aed72be3224..8a74844d99e2 100644
--- a/sound/soc/qcom/lpass-apq8016.c
+++ b/sound/soc/qcom/lpass-apq8016.c
@@ -231,6 +231,18 @@ static struct lpass_variant apq8016_data = {
         .wrdma_channels         = 2,
         .dai_driver             = apq8016_lpass_cpu_dai_driver,
         .num_dai                = ARRAY_SIZE(apq8016_lpass_cpu_dai_driver),
+        .dai_osr_clk_names      = (const char *[]) {
+                                "mi2s-osr-clk0",
+                                "mi2s-osr-clk1",
+                                "mi2s-osr-clk2",
+                                "mi2s-osr-clk3",
+                                },
+        .dai_bit_clk_names      = (const char *[]) {
+                                "mi2s-bit-clk0",
+                                "mi2s-bit-clk1",
+                                "mi2s-bit-clk2",
+                                "mi2s-bit-clk3",
+                                },
         .init                   = apq8016_lpass_init,
         .exit                   = apq8016_lpass_exit,
         .alloc_dma_channel      = apq8016_lpass_alloc_dma_channel,
diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
index 5202a584e0c6..292b103abada 100644
--- a/sound/soc/qcom/lpass-cpu.c
+++ b/sound/soc/qcom/lpass-cpu.c
@@ -429,7 +429,6 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
         struct lpass_variant *variant;
         struct device *dev = &pdev->dev;
         const struct of_device_id *match;
-        char clk_name[16];
         int ret, i, dai_id;
 
         dsp_of_node = of_parse_phandle(pdev->dev.of_node, "qcom,adsp", 0);
@@ -477,31 +476,24 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
 
         for (i = 0; i < variant->num_dai; i++) {
                 dai_id = variant->dai_driver[i].id;
-                if (variant->num_dai > 1)
-                        sprintf(clk_name, "mi2s-osr-clk%d", i);
-                else
-                        sprintf(clk_name, "mi2s-osr-clk");
-
                 drvdata->mi2s_osr_clk[dai_id] = devm_clk_get(&pdev->dev,
-                                                                clk_name);
+                                             variant->dai_osr_clk_names[i]);
                 if (IS_ERR(drvdata->mi2s_osr_clk[dai_id])) {
                         dev_warn(&pdev->dev,
-                                "error getting optional mi2s-osr-clk: %ld\n",
+                                "%s() error getting optional %s: %ld\n",
+                                __func__,
+                                variant->dai_osr_clk_names[i],
                                 PTR_ERR(drvdata->mi2s_osr_clk[dai_id]));
 
                         drvdata->mi2s_osr_clk[dai_id] = NULL;
                 }
 
-                if (variant->num_dai > 1)
-                        sprintf(clk_name, "mi2s-bit-clk%d", i);
-                else
-                        sprintf(clk_name, "mi2s-bit-clk");
-
                 drvdata->mi2s_bit_clk[dai_id] = devm_clk_get(&pdev->dev,
-                                                            clk_name);
+                                                variant->dai_bit_clk_names[i]);
                 if (IS_ERR(drvdata->mi2s_bit_clk[dai_id])) {
                         dev_err(&pdev->dev,
-                                "error getting mi2s-bit-clk: %ld\n",
+                                "error getting %s: %ld\n",
+                                variant->dai_bit_clk_names[i],
                                 PTR_ERR(drvdata->mi2s_bit_clk[dai_id]));
                         return PTR_ERR(drvdata->mi2s_bit_clk[dai_id]);
                 }
diff --git a/sound/soc/qcom/lpass-ipq806x.c b/sound/soc/qcom/lpass-ipq806x.c
index 608c1a92af8a..ca1e1f2d2787 100644
--- a/sound/soc/qcom/lpass-ipq806x.c
+++ b/sound/soc/qcom/lpass-ipq806x.c
@@ -92,6 +92,12 @@ static struct lpass_variant ipq806x_data = {
         .wrdma_channels         = 4,
         .dai_driver             = &ipq806x_lpass_cpu_dai_driver,
         .num_dai                = 1,
+        .dai_osr_clk_names      = (const char *[]) {
+                                "mi2s-osr-clk",
+                                },
+        .dai_bit_clk_names      = (const char *[]) {
+                                "mi2s-bit-clk",
+                                },
         .alloc_dma_channel      = ipq806x_lpass_alloc_dma_channel,
         .free_dma_channel       = ipq806x_lpass_free_dma_channel,
 };
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index 9b031352ea3c..b848db2d6c3d 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -91,6 +91,8 @@ struct lpass_variant {
         /* SOC specific dais */
         struct snd_soc_dai_driver *dai_driver;
         int num_dai;
+        const char * const *dai_osr_clk_names;
+        const char * const *dai_bit_clk_names;
 };
 
 /* register the platform driver from the CPU DAI driver */
diff --git a/sound/soc/rockchip/rk3288_hdmi_analog.c b/sound/soc/rockchip/rk3288_hdmi_analog.c
index b60abf322ce1..dbc53e48c52c 100644
--- a/sound/soc/rockchip/rk3288_hdmi_analog.c
+++ b/sound/soc/rockchip/rk3288_hdmi_analog.c
@@ -93,6 +93,9 @@ static int rk_hw_params(struct snd_pcm_substream *substream,
         case 96000:
                 mclk = 12288000;
                 break;
+        case 192000:
+                mclk = 24576000;
+                break;
         case 11025:
         case 22050:
         case 44100:
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index f1f1d7959a1b..0520f5afd7cc 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -185,6 +185,14 @@ config SND_SOC_SNOW
           Say Y if you want to add audio support for various Snow
           boards based on Exynos5 series of SoCs.
 
+config SND_SOC_ODROID
+        tristate "Audio support for Odroid XU3/XU4"
+        depends on SND_SOC_SAMSUNG && I2C
+        select SND_SOC_MAX98090
+        select SND_SAMSUNG_I2S
+        help
+          Say Y here to enable audio support for the Odroid XU3/XU4.
+
 config SND_SOC_ARNDALE_RT5631_ALC5631
         tristate "Audio support for RT5631(ALC5631) on Arndale Board"
         depends on I2C
diff --git a/sound/soc/samsung/Makefile b/sound/soc/samsung/Makefile
index b5df5e2e3d94..b6c2ee358333 100644
--- a/sound/soc/samsung/Makefile
+++ b/sound/soc/samsung/Makefile
@@ -40,6 +40,7 @@ snd-soc-tobermory-objs := tobermory.o
 snd-soc-lowland-objs := lowland.o
 snd-soc-littlemill-objs := littlemill.o
 snd-soc-bells-objs := bells.o
+snd-soc-odroid-objs := odroid.o
 snd-soc-arndale-rt5631-objs := arndale_rt5631.o
 snd-soc-tm2-wm5110-objs := tm2_wm5110.o
 
@@ -62,5 +63,6 @@ obj-$(CONFIG_SND_SOC_TOBERMORY) += snd-soc-tobermory.o
 obj-$(CONFIG_SND_SOC_LOWLAND) += snd-soc-lowland.o
 obj-$(CONFIG_SND_SOC_LITTLEMILL) += snd-soc-littlemill.o
 obj-$(CONFIG_SND_SOC_BELLS) += snd-soc-bells.o
+obj-$(CONFIG_SND_SOC_ODROID) += snd-soc-odroid.o
 obj-$(CONFIG_SND_SOC_ARNDALE_RT5631_ALC5631) += snd-soc-arndale-rt5631.o
 obj-$(CONFIG_SND_SOC_SAMSUNG_TM2_WM5110) += snd-soc-tm2-wm5110.o
diff --git a/sound/soc/samsung/bells.c b/sound/soc/samsung/bells.c
index 3dd246fa0059..34deba461ae1 100644
--- a/sound/soc/samsung/bells.c
+++ b/sound/soc/samsung/bells.c
@@ -446,7 +446,6 @@ static struct snd_soc_card bells_cards[] = {
         },
 };
 
-
 static int bells_probe(struct platform_device *pdev)
 {
         int ret;
diff --git a/sound/soc/samsung/i2s-regs.h b/sound/soc/samsung/i2s-regs.h
index 9170c311d66e..fe6914005494 100644
--- a/sound/soc/samsung/i2s-regs.h
+++ b/sound/soc/samsung/i2s-regs.h
@@ -160,5 +160,3 @@
 #define I2SSIZE_SHIFT           (16)
 
 #endif /* __SND_SOC_SAMSUNG_I2S_REGS_H */
-
-
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index 52a47ed292a4..af3ba4d4ccc5 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -1242,7 +1242,6 @@ static int samsung_i2s_probe(struct platform_device *pdev)
                 i2s_dai_data = (struct samsung_i2s_dai_data *)
                                 platform_get_device_id(pdev)->driver_data;
 
-
         pri_dai = i2s_alloc_dai(pdev, false);
         if (!pri_dai) {
                 dev_err(&pdev->dev, "Unable to alloc I2S_pri\n");
diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
new file mode 100644
index 000000000000..0c0b00e40646
--- /dev/null
+++ b/sound/soc/samsung/odroid.c
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2017 Samsung Electronics Co., Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/module.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include "i2s.h"
+#include "i2s-regs.h"
+
+struct odroid_priv {
+        struct snd_soc_card card;
+        struct snd_soc_dai_link dai_link;
+
+        struct clk *pll;
+        struct clk *rclk;
+};
+
+static int odroid_card_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        snd_pcm_hw_constraint_single(runtime, SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+        return 0;
+}
+
+static int odroid_card_hw_params(struct snd_pcm_substream *substream,
+                                      struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct odroid_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+        unsigned int pll_freq, rclk_freq;
+        int ret;
+
+        switch (params_rate(params)) {
+        case 32000:
+        case 64000:
+                pll_freq = 131072000U;
+                break;
+        case 44100:
+        case 88200:
+        case 176400:
+                pll_freq = 180633600U;
+                break;
+        case 48000:
+        case 96000:
+        case 192000:
+                pll_freq = 196608000U;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        ret = clk_set_rate(priv->pll, pll_freq + 1);
+        if (ret < 0)
+                return ret;
+
+        rclk_freq = params_rate(params) * 256 * 4;
+
+        ret = clk_set_rate(priv->rclk, rclk_freq);
+        if (ret < 0)
+                return ret;
+
+        if (rtd->num_codecs > 1) {
+                struct snd_soc_dai *codec_dai = rtd->codec_dais[1];
+
+                ret = snd_soc_dai_set_sysclk(codec_dai, 0, rclk_freq,
+                                             SND_SOC_CLOCK_IN);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_ops odroid_card_ops = {
+        .startup = odroid_card_startup,
+        .hw_params = odroid_card_hw_params,
+};
+
+static void odroid_put_codec_of_nodes(struct snd_soc_dai_link *link)
+{
+        struct snd_soc_dai_link_component *component = link->codecs;
+        int i;
+
+        for (i = 0; i < link->num_codecs; i++, component++) {
+                if (!component->of_node)
+                        break;
+                of_node_put(component->of_node);
+        }
+}
+
+static int odroid_audio_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device_node *cpu, *codec;
+        struct odroid_priv *priv;
+        struct snd_soc_dai_link *link;
+        struct snd_soc_card *card;
+        int ret;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        card = &priv->card;
+        card->dev = dev;
+
+        card->owner = THIS_MODULE;
+        card->fully_routed = true;
+
+        snd_soc_card_set_drvdata(card, priv);
+
+        priv->pll = devm_clk_get(dev, "epll");
+        if (IS_ERR(priv->pll))
+                return PTR_ERR(priv->pll);
+
+        priv->rclk = devm_clk_get(dev, "i2s_rclk");
+        if (IS_ERR(priv->rclk))
+                return PTR_ERR(priv->rclk);
+
+        ret = snd_soc_of_parse_card_name(card, "model");
+        if (ret < 0)
+                return ret;
+
+        if (of_property_read_bool(dev->of_node, "samsung,audio-widgets")) {
+                ret = snd_soc_of_parse_audio_simple_widgets(card,
+                                                "samsung,audio-widgets");
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (of_property_read_bool(dev->of_node, "samsung,audio-routing")) {
+                ret = snd_soc_of_parse_audio_routing(card,
+                                                "samsung,audio-routing");
+                if (ret < 0)
+                        return ret;
+        }
+
+        link = &priv->dai_link;
+
+        link->ops = &odroid_card_ops;
+        link->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS;
+
+        card->dai_link = &priv->dai_link;
+        card->num_links = 1;
+
+        cpu = of_get_child_by_name(dev->of_node, "cpu");
+        codec = of_get_child_by_name(dev->of_node, "codec");
+
+        link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+        if (!link->cpu_of_node) {
+                dev_err(dev, "Failed parsing cpu/sound-dai property\n");
+                return -EINVAL;
+        }
+
+        ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
+        if (ret < 0)
+                goto err_put_codec_n;
+
+        link->platform_of_node = link->cpu_of_node;
+
+        link->name = "Primary";
+        link->stream_name = link->name;
+
+        ret = devm_snd_soc_register_card(dev, card);
+        if (ret < 0) {
+                dev_err(dev, "snd_soc_register_card() failed: %d\n", ret);
+                goto err_put_i2s_n;
+        }
+
+        return 0;
+
+err_put_i2s_n:
+        of_node_put(link->cpu_of_node);
+err_put_codec_n:
+        odroid_put_codec_of_nodes(link);
+        return ret;
+}
+
+static int odroid_audio_remove(struct platform_device *pdev)
+{
+        struct odroid_priv *priv = platform_get_drvdata(pdev);
+
+        of_node_put(priv->dai_link.cpu_of_node);
+        odroid_put_codec_of_nodes(&priv->dai_link);
+
+        return 0;
+}
+
+static const struct of_device_id odroid_audio_of_match[] = {
+        { .compatible   = "samsung,odroid-xu3-audio" },
+        { .compatible   = "samsung,odroid-xu4-audio"},
+        { },
+};
+MODULE_DEVICE_TABLE(of, odroid_audio_of_match);
+
+static struct platform_driver odroid_audio_driver = {
+        .driver = {
+                .name           = "odroid-audio",
+                .of_match_table = odroid_audio_of_match,
+                .pm             = &snd_soc_pm_ops,
+        },
+        .probe  = odroid_audio_probe,
+        .remove = odroid_audio_remove,
+};
+module_platform_driver(odroid_audio_driver);
+
+MODULE_AUTHOR("Sylwester Nawrocki <s.nawrocki@samsung.com>");
+MODULE_DESCRIPTION("Odroid XU3/XU4 audio support");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
index 644f186fd35c..8f42deaa184b 100644
--- a/sound/soc/samsung/s3c-i2s-v2.c
+++ b/sound/soc/samsung/s3c-i2s-v2.c
@@ -72,7 +72,6 @@ static inline void dbg_showcon(const char *fn, u32 con)
 }
 #endif
 
-
 /* Turn on or off the transmission path. */
 static void s3c2412_snd_txctrl(struct s3c_i2sv2_info *i2s, int on)
 {
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 85a33ac0a5c4..66203d107a11 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -43,6 +43,7 @@ struct rsnd_adg {
 };
 
 #define LRCLK_ASYNC     (1 << 0)
+#define AUDIO_OUT_48    (1 << 1)
 #define adg_mode_flags(adg)     (adg->flags)
 
 #define for_each_rsnd_clk(pos, adg, i)          \
@@ -364,7 +365,10 @@ found_clock:
 
         rsnd_adg_set_ssi_clk(ssi_mod, data);
 
-        if (!(adg_mode_flags(adg) & LRCLK_ASYNC)) {
+        if (adg_mode_flags(adg) & LRCLK_ASYNC) {
+                if (adg_mode_flags(adg) & AUDIO_OUT_48)
+                        ckr = 0x80000000;
+        } else {
                 if (0 == (rate % 8000))
                         ckr = 0x80000000;
         }
@@ -427,11 +431,14 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
         struct clk *clk;
         struct device *dev = rsnd_priv_to_dev(priv);
         struct device_node *np = dev->of_node;
+        struct property *prop;
         u32 ckr, rbgx, rbga, rbgb;
-        u32 rate, req_rate = 0, div;
+        u32 rate, div;
+#define REQ_SIZE 2
+        u32 req_rate[REQ_SIZE] = {};
         uint32_t count = 0;
         unsigned long req_48kHz_rate, req_441kHz_rate;
-        int i;
+        int i, req_size;
         const char *parent_clk_name = NULL;
         static const char * const clkout_name[] = {
                 [CLKOUT]  = "audio_clkout",
@@ -446,19 +453,32 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                 [CLKI] = 0x2,
         };
 
-        of_property_read_u32(np, "#clock-cells", &count);
+        ckr = 0;
+        rbga = 2; /* default 1/6 */
+        rbgb = 2; /* default 1/6 */
 
         /*
          * ADG supports BRRA/BRRB output only
          * this means all clkout0/1/2/3 will be same rate
          */
-        of_property_read_u32(np, "clock-frequency", &req_rate);
+        prop = of_find_property(np, "clock-frequency", NULL);
+        if (!prop)
+                goto rsnd_adg_get_clkout_end;
+
+        req_size = prop->length / sizeof(u32);
+
+        of_property_read_u32_array(np, "clock-frequency", req_rate, req_size);
         req_48kHz_rate = 0;
         req_441kHz_rate = 0;
-        if (0 == (req_rate % 44100))
-                req_441kHz_rate = req_rate;
-        if (0 == (req_rate % 48000))
-                req_48kHz_rate = req_rate;
+        for (i = 0; i < req_size; i++) {
+                if (0 == (req_rate[i] % 44100))
+                        req_441kHz_rate = req_rate[i];
+                if (0 == (req_rate[i] % 48000))
+                        req_48kHz_rate = req_rate[i];
+        }
+
+        if (req_rate[0] % 48000 == 0)
+                adg->flags = AUDIO_OUT_48;
 
         /*
          * This driver is assuming that AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC
@@ -469,9 +489,6 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
          *      rsnd_adg_ssi_clk_try_start()
          *      rsnd_ssi_master_clk_start()
          */
-        ckr = 0;
-        rbga = 2; /* default 1/6 */
-        rbgb = 2; /* default 1/6 */
         adg->rbga_rate_for_441khz       = 0;
         adg->rbgb_rate_for_48khz        = 0;
         for_each_rsnd_clk(clk, adg, i) {
@@ -505,10 +522,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbgb = rbgx;
                                 adg->rbgb_rate_for_48khz = rate / div;
                                 ckr |= brg_table[i] << 16;
-                                if (req_48kHz_rate) {
+                                if (req_48kHz_rate)
                                         parent_clk_name = __clk_get_name(clk);
-                                        ckr |= 0x80000000;
-                                }
                         }
                 }
         }
@@ -518,12 +533,13 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
          * this means all clkout0/1/2/3 will be * same rate
          */
 
+        of_property_read_u32(np, "#clock-cells", &count);
         /*
          * for clkout
          */
         if (!count) {
                 clk = clk_register_fixed_rate(dev, clkout_name[CLKOUT],
-                                              parent_clk_name, 0, req_rate);
+                                              parent_clk_name, 0, req_rate[0]);
                 if (!IS_ERR(clk)) {
                         adg->clkout[CLKOUT] = clk;
                         of_clk_add_provider(np, of_clk_src_simple_get, clk);
@@ -536,19 +552,18 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                 for (i = 0; i < CLKOUTMAX; i++) {
                         clk = clk_register_fixed_rate(dev, clkout_name[i],
                                                       parent_clk_name, 0,
-                                                      req_rate);
-                        if (!IS_ERR(clk)) {
-                                adg->onecell.clks       = adg->clkout;
-                                adg->onecell.clk_num    = CLKOUTMAX;
-
+                                                      req_rate[0]);
+                        adg->clkout[i] = ERR_PTR(-ENOENT);
+                        if (!IS_ERR(clk))
                                 adg->clkout[i] = clk;
-
-                                of_clk_add_provider(np, of_clk_src_onecell_get,
-                                                    &adg->onecell);
-                        }
                 }
+                adg->onecell.clks       = adg->clkout;
+                adg->onecell.clk_num    = CLKOUTMAX;
+                of_clk_add_provider(np, of_clk_src_onecell_get,
+                                    &adg->onecell);
         }
 
+rsnd_adg_get_clkout_end:
         adg->ckr = ckr;
         adg->rbga = rbga;
         adg->rbgb = rbgb;
@@ -564,6 +579,7 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
         struct rsnd_adg *adg;
         struct device *dev = rsnd_priv_to_dev(priv);
         struct device_node *np = dev->of_node;
+        int ret;
 
         adg = devm_kzalloc(dev, sizeof(*adg), GFP_KERNEL);
         if (!adg) {
@@ -571,8 +587,10 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
                 return -ENOMEM;
         }
 
-        rsnd_mod_init(priv, &adg->mod, &adg_ops,
+        ret = rsnd_mod_init(priv, &adg->mod, &adg_ops,
                       NULL, NULL, 0, 0);
+        if (ret)
+                return ret;
 
         rsnd_adg_get_clkin(priv, adg);
         rsnd_adg_get_clkout(priv, adg);
@@ -589,5 +607,10 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
 
 void rsnd_adg_remove(struct rsnd_priv *priv)
 {
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct device_node *np = dev->of_node;
+
+        of_clk_del_provider(np);
+
         rsnd_adg_clk_disable(priv);
 }
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 47b370cb2d3b..1744015408c3 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -96,7 +96,7 @@
 #include <linux/pm_runtime.h>
 #include "rsnd.h"
 
-#define RSND_RATES SNDRV_PCM_RATE_8000_96000
+#define RSND_RATES SNDRV_PCM_RATE_8000_192000
 #define RSND_FMTS (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE)
 
 static const struct of_device_id rsnd_of_match[] = {
@@ -110,7 +110,6 @@ MODULE_DEVICE_TABLE(of, rsnd_of_match);
 /*
  *      rsnd_mod functions
  */
-#ifdef DEBUG
 void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
 {
         if (mod->type != type) {
@@ -121,7 +120,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
                          rsnd_mod_name(mod), rsnd_mod_id(mod));
         }
 }
-#endif
 
 char *rsnd_mod_name(struct rsnd_mod *mod)
 {
@@ -674,12 +672,10 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         /* set clock inversion */
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_IF:
-                rdai->bit_clk_inv =  rdai->bit_clk_inv;
                 rdai->frm_clk_inv = !rdai->frm_clk_inv;
                 break;
         case SND_SOC_DAIFMT_IB_NF:
                 rdai->bit_clk_inv = !rdai->bit_clk_inv;
-                rdai->frm_clk_inv =  rdai->frm_clk_inv;
                 break;
         case SND_SOC_DAIFMT_IB_IF:
                 rdai->bit_clk_inv = !rdai->bit_clk_inv;
@@ -1002,13 +998,30 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl,
         return change;
 }
 
-static int __rsnd_kctrl_new(struct rsnd_mod *mod,
-                            struct rsnd_dai_stream *io,
-                            struct snd_soc_pcm_runtime *rtd,
-                            const unsigned char *name,
-                            struct rsnd_kctrl_cfg *cfg,
-                            void (*update)(struct rsnd_dai_stream *io,
-                                           struct rsnd_mod *mod))
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg)
+{
+        cfg->cfg.val = cfg->val;
+
+        return &cfg->cfg;
+}
+
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg)
+{
+        cfg->cfg.val = &cfg->val;
+
+        return &cfg->cfg;
+}
+
+int rsnd_kctrl_new(struct rsnd_mod *mod,
+                   struct rsnd_dai_stream *io,
+                   struct snd_soc_pcm_runtime *rtd,
+                   const unsigned char *name,
+                   void (*update)(struct rsnd_dai_stream *io,
+                                  struct rsnd_mod *mod),
+                   struct rsnd_kctrl_cfg *cfg,
+                   const char * const *texts,
+                   int size,
+                   u32 max)
 {
         struct snd_card *card = rtd->card->snd_card;
         struct snd_kcontrol *kctrl;
@@ -1023,6 +1036,9 @@ static int __rsnd_kctrl_new(struct rsnd_mod *mod,
         };
         int ret;
 
+        if (size > RSND_MAX_CHANNELS)
+                return -EINVAL;
+
         kctrl = snd_ctl_new1(&knew, mod);
         if (!kctrl)
                 return -ENOMEM;
@@ -1031,74 +1047,17 @@ static int __rsnd_kctrl_new(struct rsnd_mod *mod,
         if (ret < 0)
                 return ret;
 
-        cfg->update = update;
-        cfg->card = card;
-        cfg->kctrl = kctrl;
-        cfg->io = io;
+        cfg->texts      = texts;
+        cfg->max        = max;
+        cfg->size       = size;
+        cfg->update     = update;
+        cfg->card       = card;
+        cfg->kctrl      = kctrl;
+        cfg->io         = io;
 
         return 0;
 }
 
-void _rsnd_kctrl_remove(struct rsnd_kctrl_cfg *cfg)
-{
-        if (cfg->card && cfg->kctrl)
-                snd_ctl_remove(cfg->card, cfg->kctrl);
-
-        cfg->card = NULL;
-        cfg->kctrl = NULL;
-}
-
-int rsnd_kctrl_new_m(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_m *_cfg,
-                     int ch_size,
-                     u32 max)
-{
-        if (ch_size > RSND_MAX_CHANNELS)
-                return -EINVAL;
-
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = ch_size;
-        _cfg->cfg.val   = _cfg->val;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
-int rsnd_kctrl_new_s(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     u32 max)
-{
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = 1;
-        _cfg->cfg.val   = &_cfg->val;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
-int rsnd_kctrl_new_e(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     const char * const *texts,
-                     u32 max)
-{
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = 1;
-        _cfg->cfg.val   = &_cfg->val;
-        _cfg->cfg.texts = texts;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
 /*
  *              snd_soc_platform
  */
diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
index cf8f59cdd8d7..463de8360985 100644
--- a/sound/soc/sh/rcar/dvc.c
+++ b/sound/soc/sh/rcar/dvc.c
@@ -218,21 +218,6 @@ static int rsnd_dvc_probe_(struct rsnd_mod *mod,
         return rsnd_cmd_attach(io, rsnd_mod_id(mod));
 }
 
-static int rsnd_dvc_remove_(struct rsnd_mod *mod,
-                            struct rsnd_dai_stream *io,
-                            struct rsnd_priv *priv)
-{
-        struct rsnd_dvc *dvc = rsnd_mod_to_dvc(mod);
-
-        rsnd_kctrl_remove(dvc->volume);
-        rsnd_kctrl_remove(dvc->mute);
-        rsnd_kctrl_remove(dvc->ren);
-        rsnd_kctrl_remove(dvc->rup);
-        rsnd_kctrl_remove(dvc->rdown);
-
-        return 0;
-}
-
 static int rsnd_dvc_init(struct rsnd_mod *mod,
                          struct rsnd_dai_stream *io,
                          struct rsnd_priv *priv)
@@ -300,18 +285,18 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Up Rate" : "DVC In Ramp Up Rate",
-                        &dvc->rup,
                         rsnd_dvc_volume_update,
-                        dvc_ramp_rate, ARRAY_SIZE(dvc_ramp_rate));
+                        &dvc->rup,
+                        dvc_ramp_rate);
         if (ret < 0)
                 return ret;
 
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Down Rate" : "DVC In Ramp Down Rate",
-                        &dvc->rdown,
                         rsnd_dvc_volume_update,
-                        dvc_ramp_rate, ARRAY_SIZE(dvc_ramp_rate));
+                        &dvc->rdown,
+                        dvc_ramp_rate);
 
         if (ret < 0)
                 return ret;
@@ -332,7 +317,6 @@ static struct rsnd_mod_ops rsnd_dvc_ops = {
         .name           = DVC_NAME,
         .dma_req        = rsnd_dvc_dma_req,
         .probe          = rsnd_dvc_probe_,
-        .remove         = rsnd_dvc_remove_,
         .init           = rsnd_dvc_init,
         .quit           = rsnd_dvc_quit,
         .pcm_new        = rsnd_dvc_pcm_new,
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 7410ec0174db..dbf4163427e8 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -611,35 +611,30 @@ struct rsnd_kctrl_cfg_s {
         u32 val;
 };
 
-void _rsnd_kctrl_remove(struct rsnd_kctrl_cfg *cfg);
-#define rsnd_kctrl_remove(_cfg) _rsnd_kctrl_remove(&((_cfg).cfg))
-
-int rsnd_kctrl_new_m(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_m *_cfg,
-                     int ch_size,
-                     u32 max);
-int rsnd_kctrl_new_s(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     u32 max);
-int rsnd_kctrl_new_e(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     const char * const *texts,
-                     u32 max);
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg);
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg);
+int rsnd_kctrl_new(struct rsnd_mod *mod,
+                   struct rsnd_dai_stream *io,
+                   struct snd_soc_pcm_runtime *rtd,
+                   const unsigned char *name,
+                   void (*update)(struct rsnd_dai_stream *io,
+                                  struct rsnd_mod *mod),
+                   struct rsnd_kctrl_cfg *cfg,
+                   const char * const *texts,
+                   int size,
+                   u32 max);
+
+#define rsnd_kctrl_new_m(mod, io, rtd, name, update, cfg, size, max) \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_m(cfg), \
+                       NULL, size, max)
+
+#define rsnd_kctrl_new_s(mod, io, rtd, name, update, cfg, max)  \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+                       NULL, 1, max)
+
+#define rsnd_kctrl_new_e(mod, io, rtd, name, update, cfg, texts)        \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+                       texts, 1, ARRAY_SIZE(texts))
 
 /*
  *      R-Car SSI
@@ -732,8 +727,8 @@ void rsnd_cmd_remove(struct rsnd_priv *priv);
 int rsnd_cmd_attach(struct rsnd_dai_stream *io, int id);
 struct rsnd_mod *rsnd_cmd_mod_get(struct rsnd_priv *priv, int id);
 
-#ifdef DEBUG
 void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type);
+#ifdef DEBUG
 #define rsnd_mod_confirm_ssi(mssi)      rsnd_mod_make_sure(mssi, RSND_MOD_SSI)
 #define rsnd_mod_confirm_src(msrc)      rsnd_mod_make_sure(msrc, RSND_MOD_SRC)
 #define rsnd_mod_confirm_dvc(mdvc)      rsnd_mod_make_sure(mdvc, RSND_MOD_DVC)
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 42db48db09ba..20b5b2ec625e 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -167,6 +167,7 @@ static int rsnd_src_hw_params(struct rsnd_mod *mod,
          *      dpcm_fe_dai_hw_params()
          *      dpcm_be_dai_hw_params()
          */
+        src->convert_rate = 0;
         if (fe->dai_link->dynamic) {
                 int stream = substream->stream;
                 struct snd_soc_dpcm *dpcm;
@@ -414,8 +415,6 @@ static int rsnd_src_quit(struct rsnd_mod *mod,
 
         rsnd_mod_power_off(mod);
 
-        src->convert_rate = 0;
-
         /* reset sync convert_rate */
         src->sync.val = 0;
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 411bda2387ad..135c5669f796 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -228,6 +228,15 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) {
 
                 /*
+                 * It will set SSIWSR.CONT here, but SSICR.CKDV = 000
+                 * with it is not allowed. (SSIWSR.WS_MODE with
+                 * SSICR.CKDV = 000 is not allowed either).
+                 * Skip it. See SSICR.CKDV
+                 */
+                if (j == 0)
+                        continue;
+
+                /*
                  * this driver is assuming that
                  * system word is 32bit x chan
                  * see rsnd_ssi_init()
diff --git a/sound/soc/sirf/sirf-audio-port.c b/sound/soc/sirf/sirf-audio-port.c
index 3f2cce03275c..be066de74aaa 100644
--- a/sound/soc/sirf/sirf-audio-port.c
+++ b/sound/soc/sirf/sirf-audio-port.c
@@ -19,6 +19,7 @@ struct sirf_audio_port {
 static int sirf_audio_port_dai_probe(struct snd_soc_dai *dai)
 {
         struct sirf_audio_port *port = snd_soc_dai_get_drvdata(dai);
+
         snd_soc_dai_init_dma_data(dai, &port->playback_dma_data,
                         &port->capture_dma_data);
         return 0;
diff --git a/sound/soc/sirf/sirf-audio.c b/sound/soc/sirf/sirf-audio.c
index 94ea152e0362..f2bc50790f76 100644
--- a/sound/soc/sirf/sirf-audio.c
+++ b/sound/soc/sirf/sirf-audio.c
@@ -27,6 +27,7 @@ static int sirf_audio_hp_event(struct snd_soc_dapm_widget *w,
         struct snd_soc_card *card = dapm->card;
         struct sirf_audio_card *sirf_audio_card = snd_soc_card_get_drvdata(card);
         int on = !SND_SOC_DAPM_EVENT_OFF(event);
+
         if (gpio_is_valid(sirf_audio_card->gpio_hp_pa))
                 gpio_set_value(sirf_audio_card->gpio_hp_pa, on);
         return 0;
diff --git a/sound/soc/sirf/sirf-usp.c b/sound/soc/sirf/sirf-usp.c
index 45fc06c0e0e5..77e7dcf969d0 100644
--- a/sound/soc/sirf/sirf-usp.c
+++ b/sound/soc/sirf/sirf-usp.c
@@ -71,6 +71,7 @@ static void sirf_usp_rx_disable(struct sirf_usp *usp)
 static int sirf_usp_pcm_dai_probe(struct snd_soc_dai *dai)
 {
         struct sirf_usp *usp = snd_soc_dai_get_drvdata(dai);
+
         snd_soc_dai_init_dma_data(dai, &usp->playback_dma_data,
                         &usp->capture_dma_data);
         return 0;
@@ -294,6 +295,7 @@ static struct snd_soc_dai_driver sirf_usp_pcm_dai = {
 static int sirf_usp_pcm_runtime_suspend(struct device *dev)
 {
         struct sirf_usp *usp = dev_get_drvdata(dev);
+
         clk_disable_unprepare(usp->clk);
         return 0;
 }
@@ -302,6 +304,7 @@ static int sirf_usp_pcm_runtime_resume(struct device *dev)
 {
         struct sirf_usp *usp = dev_get_drvdata(dev);
         int ret;
+
         ret = clk_prepare_enable(usp->clk);
         if (ret) {
                 dev_err(dev, "clk_enable failed: %d\n", ret);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 2722bb0c5573..525f2f397b4c 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1776,7 +1776,6 @@ static int soc_bind_aux_dev(struct snd_soc_card *card, int num)
         }
 
         component->init = aux_dev->init;
-        component->auxiliary = 1;
         list_add(&component->card_aux_list, &card->aux_comp_list);
 
         return 0;
@@ -1788,14 +1787,13 @@ err_defer:
 
 static int soc_probe_aux_devices(struct snd_soc_card *card)
 {
-        struct snd_soc_component *comp, *tmp;
+        struct snd_soc_component *comp;
         int order;
         int ret;
 
         for (order = SND_SOC_COMP_ORDER_FIRST; order <= SND_SOC_COMP_ORDER_LAST;
                 order++) {
-                list_for_each_entry_safe(comp, tmp, &card->aux_comp_list,
-                                         card_aux_list) {
+                list_for_each_entry(comp, &card->aux_comp_list, card_aux_list) {
                         if (comp->driver->probe_order == order) {
                                 ret = soc_probe_component(card, comp);
                                 if (ret < 0) {
@@ -1804,7 +1802,6 @@ static int soc_probe_aux_devices(struct snd_soc_card *card)
                                                 comp->name, ret);
                                         return ret;
                                 }
-                                list_del(&comp->card_aux_list);
                         }
                 }
         }
@@ -1820,14 +1817,12 @@ static void soc_remove_aux_devices(struct snd_soc_card *card)
         for (order = SND_SOC_COMP_ORDER_FIRST; order <= SND_SOC_COMP_ORDER_LAST;
                 order++) {
                 list_for_each_entry_safe(comp, _comp,
-                        &card->component_dev_list, card_list) {
-
-                        if (!comp->auxiliary)
-                                continue;
+                        &card->aux_comp_list, card_aux_list) {
 
                         if (comp->driver->remove_order == order) {
                                 soc_remove_component(comp);
-                                comp->auxiliary = 0;
+                                /* remove it from the card's aux_comp_list */
+                                list_del(&comp->card_aux_list);
                         }
                 }
         }
@@ -1918,6 +1913,7 @@ int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
 EXPORT_SYMBOL_GPL(snd_soc_runtime_set_dai_fmt);
 
 
+#ifdef CONFIG_DMI
 /* Trim special characters, and replace '-' with '_' since '-' is used to
  * separate different DMI fields in the card long name. Only number and
  * alphabet characters and a few separator characters are kept.
@@ -2049,6 +2045,7 @@ int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour)
         return 0;
 }
 EXPORT_SYMBOL_GPL(snd_soc_set_dmi_name);
+#endif /* CONFIG_DMI */
 
 static int snd_soc_instantiate_card(struct snd_soc_card *card)
 {
@@ -2190,6 +2187,9 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
                 snd_soc_dapm_add_routes(&card->dapm, card->of_dapm_routes,
                                         card->num_of_dapm_routes);
 
+        /* try to set some sane longname if DMI is available */
+        snd_soc_set_dmi_name(card, NULL);
+
         snprintf(card->snd_card->shortname, sizeof(card->snd_card->shortname),
                  "%s", card->name);
         snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
@@ -3139,7 +3139,7 @@ static int snd_soc_component_initialize(struct snd_soc_component *component,
         component->suspend = component->driver->suspend;
         component->resume = component->driver->resume;
         component->pcm_new = component->driver->pcm_new;
-        component->pcm_free= component->driver->pcm_free;
+        component->pcm_free = component->driver->pcm_free;
 
         dapm = &component->dapm;
         dapm->dev = dev;
@@ -3240,6 +3240,11 @@ static void snd_soc_component_cleanup(struct snd_soc_component *component)
 
 static void snd_soc_component_del_unlocked(struct snd_soc_component *component)
 {
+        struct snd_soc_card *card = component->card;
+
+        if (card)
+                snd_soc_unregister_card(card);
+
         list_del(&component->list);
 }
 
diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
index fbaa1bb41102..7daf21fee355 100644
--- a/sound/soc/soc-jack.c
+++ b/sound/soc/soc-jack.c
@@ -19,9 +19,28 @@
 #include <linux/workqueue.h>
 #include <linux/delay.h>
 #include <linux/export.h>
+#include <linux/suspend.h>
 #include <trace/events/asoc.h>
 
 /**
+ * snd_soc_codec_set_jack - configure codec jack.
+ * @codec: CODEC
+ * @jack: structure to use for the jack
+ * @data: can be used if codec driver need extra data for configuring jack
+ *
+ * Configures and enables jack detection function.
+ */
+int snd_soc_codec_set_jack(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack, void *data)
+{
+        if (codec->driver->set_jack)
+                return codec->driver->set_jack(codec, jack, data);
+        else
+                return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(snd_soc_codec_set_jack);
+
+/**
  * snd_soc_card_jack_new - Create a new jack
  * @card:  ASoC card
  * @id:    an identifying string for this jack
@@ -293,6 +312,27 @@ static void gpio_work(struct work_struct *work)
         snd_soc_jack_gpio_detect(gpio);
 }
 
+static int snd_soc_jack_pm_notifier(struct notifier_block *nb,
+                                    unsigned long action, void *data)
+{
+        struct snd_soc_jack_gpio *gpio =
+                        container_of(nb, struct snd_soc_jack_gpio, pm_notifier);
+
+        switch (action) {
+        case PM_POST_SUSPEND:
+        case PM_POST_HIBERNATION:
+        case PM_POST_RESTORE:
+                /*
+                 * Use workqueue so we do not have to care about running
+                 * concurrently with work triggered by the interrupt handler.
+                 */
+                queue_delayed_work(system_power_efficient_wq, &gpio->work, 0);
+                break;
+        }
+
+        return NOTIFY_DONE;
+}
+
 /**
  * snd_soc_jack_add_gpios - Associate GPIO pins with an ASoC jack
  *
@@ -369,6 +409,13 @@ got_gpio:
                                         i, ret);
                 }
 
+                /*
+                 * Register PM notifier so we do not miss state transitions
+                 * happening while system is asleep.
+                 */
+                gpios[i].pm_notifier.notifier_call = snd_soc_jack_pm_notifier;
+                register_pm_notifier(&gpios[i].pm_notifier);
+
                 /* Expose GPIO value over sysfs for diagnostic purposes */
                 gpiod_export(gpios[i].desc, false);
 
@@ -428,6 +475,7 @@ void snd_soc_jack_free_gpios(struct snd_soc_jack *jack, int count,
 
         for (i = 0; i < count; i++) {
                 gpiod_unexport(gpios[i].desc);
+                unregister_pm_notifier(&gpios[i].pm_notifier);
                 free_irq(gpiod_to_irq(gpios[i].desc), &gpios[i]);
                 cancel_delayed_work_sync(&gpios[i].work);
                 gpiod_put(gpios[i].desc);
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 058bc99c6c34..002772e3ba2c 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -495,12 +495,13 @@ static void remove_widget(struct snd_soc_component *comp,
                         struct snd_kcontrol *kcontrol = w->kcontrols[i];
                         struct soc_enum *se =
                                 (struct soc_enum *)kcontrol->private_value;
+                        int j;
 
                         snd_ctl_remove(card, kcontrol);
 
                         kfree(se->dobj.control.dvalues);
-                        for (i = 0; i < se->items; i++)
-                                kfree(se->dobj.control.dtexts[i]);
+                        for (j = 0; j < se->items; j++)
+                                kfree(se->dobj.control.dtexts[j]);
 
                         kfree(se);
                 }
diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
index d7e8dd46d2cc..d8b6936e544e 100644
--- a/sound/soc/sti/uniperif_player.c
+++ b/sound/soc/sti/uniperif_player.c
@@ -1074,7 +1074,7 @@ int uni_player_init(struct platform_device *pdev,
         player->clk = of_clk_get(pdev->dev.of_node, 0);
         if (IS_ERR(player->clk)) {
                 dev_err(player->dev, "Failed to get clock\n");
-                ret = PTR_ERR(player->clk);
+                return PTR_ERR(player->clk);
         }
 
         /* Select the frequency synthesizer clock */
diff --git a/sound/soc/stm/Kconfig b/sound/soc/stm/Kconfig
new file mode 100644
index 000000000000..972970f0890a
--- /dev/null
+++ b/sound/soc/stm/Kconfig
@@ -0,0 +1,8 @@
+menuconfig SND_SOC_STM32
+        tristate "STMicroelectronics STM32 SOC audio support"
+        depends on ARCH_STM32 || COMPILE_TEST
+        depends on SND_SOC
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        select REGMAP_MMIO
+        help
+          Say Y if you want to enable ASoC-support for STM32
diff --git a/sound/soc/stm/Makefile b/sound/soc/stm/Makefile
new file mode 100644
index 000000000000..e466a4759698
--- /dev/null
+++ b/sound/soc/stm/Makefile
@@ -0,0 +1,6 @@
+# SAI
+snd-soc-stm32-sai-sub-objs := stm32_sai_sub.o
+obj-$(CONFIG_SND_SOC_STM32) += snd-soc-stm32-sai-sub.o
+
+snd-soc-stm32-sai-objs := stm32_sai.o
+obj-$(CONFIG_SND_SOC_STM32) += snd-soc-stm32-sai.o
diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
new file mode 100644
index 000000000000..2a27a26bf7a1
--- /dev/null
+++ b/sound/soc/stm/stm32_sai.c
@@ -0,0 +1,115 @@
+/*
+ * STM32 ALSA SoC Digital Audio Interface (SAI) driver.
+ *
+ * Copyright (C) 2016, STMicroelectronics - All Rights Reserved
+ * Author(s): Olivier Moysan <olivier.moysan@st.com> for STMicroelectronics.
+ *
+ * License terms: GPL V2.0.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/reset.h>
+
+#include <sound/dmaengine_pcm.h>
+#include <sound/core.h>
+
+#include "stm32_sai.h"
+
+static const struct of_device_id stm32_sai_ids[] = {
+        { .compatible = "st,stm32f4-sai", .data = (void *)SAI_STM32F4 },
+        {}
+};
+
+static int stm32_sai_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct stm32_sai_data *sai;
+        struct reset_control *rst;
+        struct resource *res;
+        void __iomem *base;
+        const struct of_device_id *of_id;
+
+        sai = devm_kzalloc(&pdev->dev, sizeof(*sai), GFP_KERNEL);
+        if (!sai)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        of_id = of_match_device(stm32_sai_ids, &pdev->dev);
+        if (of_id)
+                sai->version = (enum stm32_sai_version)of_id->data;
+        else
+                return -EINVAL;
+
+        sai->clk_x8k = devm_clk_get(&pdev->dev, "x8k");
+        if (IS_ERR(sai->clk_x8k)) {
+                dev_err(&pdev->dev, "missing x8k parent clock\n");
+                return PTR_ERR(sai->clk_x8k);
+        }
+
+        sai->clk_x11k = devm_clk_get(&pdev->dev, "x11k");
+        if (IS_ERR(sai->clk_x11k)) {
+                dev_err(&pdev->dev, "missing x11k parent clock\n");
+                return PTR_ERR(sai->clk_x11k);
+        }
+
+        /* init irqs */
+        sai->irq = platform_get_irq(pdev, 0);
+        if (sai->irq < 0) {
+                dev_err(&pdev->dev, "no irq for node %s\n", pdev->name);
+                return sai->irq;
+        }
+
+        /* reset */
+        rst = reset_control_get(&pdev->dev, NULL);
+        if (!IS_ERR(rst)) {
+                reset_control_assert(rst);
+                udelay(2);
+                reset_control_deassert(rst);
+        }
+
+        sai->pdev = pdev;
+        platform_set_drvdata(pdev, sai);
+
+        return of_platform_populate(np, NULL, NULL, &pdev->dev);
+}
+
+static int stm32_sai_remove(struct platform_device *pdev)
+{
+        of_platform_depopulate(&pdev->dev);
+
+        return 0;
+}
+
+MODULE_DEVICE_TABLE(of, stm32_sai_ids);
+
+static struct platform_driver stm32_sai_driver = {
+        .driver = {
+                .name = "st,stm32-sai",
+                .of_match_table = stm32_sai_ids,
+        },
+        .probe = stm32_sai_probe,
+        .remove = stm32_sai_remove,
+};
+
+module_platform_driver(stm32_sai_driver);
+
+MODULE_DESCRIPTION("STM32 Soc SAI Interface");
+MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_ALIAS("platform:st,stm32-sai");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/stm/stm32_sai.h b/sound/soc/stm/stm32_sai.h
new file mode 100644
index 000000000000..a801fda5066f
--- /dev/null
+++ b/sound/soc/stm/stm32_sai.h
@@ -0,0 +1,200 @@
+/*
+ * STM32 ALSA SoC Digital Audio Interface (SAI) driver.
+ *
+ * Copyright (C) 2016, STMicroelectronics - All Rights Reserved
+ * Author(s): Olivier Moysan <olivier.moysan@st.com> for STMicroelectronics.
+ *
+ * License terms: GPL V2.0.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ */
+
+/******************** SAI Register Map **************************************/
+
+/* common register */
+#define STM_SAI_GCR             0x00
+
+/* Sub-block A&B registers offsets, relative to A&B sub-block addresses */
+#define STM_SAI_CR1_REGX        0x00    /* A offset: 0x04. B offset: 0x24 */
+#define STM_SAI_CR2_REGX        0x04
+#define STM_SAI_FRCR_REGX       0x08
+#define STM_SAI_SLOTR_REGX      0x0C
+#define STM_SAI_IMR_REGX        0x10
+#define STM_SAI_SR_REGX         0x14
+#define STM_SAI_CLRFR_REGX      0x18
+#define STM_SAI_DR_REGX         0x1C
+
+/******************** Bit definition for SAI_GCR register *******************/
+#define SAI_GCR_SYNCIN_SHIFT    0
+#define SAI_GCR_SYNCIN_MASK     GENMASK(1, SAI_GCR_SYNCIN_SHIFT)
+#define SAI_GCR_SYNCIN_SET(x)   ((x) << SAI_GCR_SYNCIN_SHIFT)
+
+#define SAI_GCR_SYNCOUT_SHIFT   4
+#define SAI_GCR_SYNCOUT_MASK    GENMASK(5, SAI_GCR_SYNCOUT_SHIFT)
+#define SAI_GCR_SYNCOUT_SET(x)  ((x) << SAI_GCR_SYNCOUT_SHIFT)
+
+/******************* Bit definition for SAI_XCR1 register *******************/
+#define SAI_XCR1_RX_TX_SHIFT    0
+#define SAI_XCR1_RX_TX          BIT(SAI_XCR1_RX_TX_SHIFT)
+#define SAI_XCR1_SLAVE_SHIFT    1
+#define SAI_XCR1_SLAVE          BIT(SAI_XCR1_SLAVE_SHIFT)
+
+#define SAI_XCR1_PRTCFG_SHIFT   2
+#define SAI_XCR1_PRTCFG_MASK    GENMASK(3, SAI_XCR1_PRTCFG_SHIFT)
+#define SAI_XCR1_PRTCFG_SET(x)  ((x) << SAI_XCR1_PRTCFG_SHIFT)
+
+#define SAI_XCR1_DS_SHIFT       5
+#define SAI_XCR1_DS_MASK        GENMASK(7, SAI_XCR1_DS_SHIFT)
+#define SAI_XCR1_DS_SET(x)      ((x) << SAI_XCR1_DS_SHIFT)
+
+#define SAI_XCR1_LSBFIRST_SHIFT 8
+#define SAI_XCR1_LSBFIRST       BIT(SAI_XCR1_LSBFIRST_SHIFT)
+#define SAI_XCR1_CKSTR_SHIFT    9
+#define SAI_XCR1_CKSTR          BIT(SAI_XCR1_CKSTR_SHIFT)
+
+#define SAI_XCR1_SYNCEN_SHIFT   10
+#define SAI_XCR1_SYNCEN_MASK    GENMASK(11, SAI_XCR1_SYNCEN_SHIFT)
+#define SAI_XCR1_SYNCEN_SET(x)  ((x) << SAI_XCR1_SYNCEN_SHIFT)
+
+#define SAI_XCR1_MONO_SHIFT     12
+#define SAI_XCR1_MONO           BIT(SAI_XCR1_MONO_SHIFT)
+#define SAI_XCR1_OUTDRIV_SHIFT  13
+#define SAI_XCR1_OUTDRIV        BIT(SAI_XCR1_OUTDRIV_SHIFT)
+#define SAI_XCR1_SAIEN_SHIFT    16
+#define SAI_XCR1_SAIEN          BIT(SAI_XCR1_SAIEN_SHIFT)
+#define SAI_XCR1_DMAEN_SHIFT    17
+#define SAI_XCR1_DMAEN          BIT(SAI_XCR1_DMAEN_SHIFT)
+#define SAI_XCR1_NODIV_SHIFT    19
+#define SAI_XCR1_NODIV          BIT(SAI_XCR1_NODIV_SHIFT)
+
+#define SAI_XCR1_MCKDIV_SHIFT   20
+#define SAI_XCR1_MCKDIV_WIDTH   4
+#define SAI_XCR1_MCKDIV_MASK    GENMASK(24, SAI_XCR1_MCKDIV_SHIFT)
+#define SAI_XCR1_MCKDIV_SET(x)  ((x) << SAI_XCR1_MCKDIV_SHIFT)
+#define SAI_XCR1_MCKDIV_MAX     ((1 << SAI_XCR1_MCKDIV_WIDTH) - 1)
+
+#define SAI_XCR1_OSR_SHIFT      26
+#define SAI_XCR1_OSR            BIT(SAI_XCR1_OSR_SHIFT)
+
+/******************* Bit definition for SAI_XCR2 register *******************/
+#define SAI_XCR2_FTH_SHIFT      0
+#define SAI_XCR2_FTH_MASK       GENMASK(2, SAI_XCR2_FTH_SHIFT)
+#define SAI_XCR2_FTH_SET(x)     ((x) << SAI_XCR2_FTH_SHIFT)
+
+#define SAI_XCR2_FFLUSH_SHIFT   3
+#define SAI_XCR2_FFLUSH         BIT(SAI_XCR2_FFLUSH_SHIFT)
+#define SAI_XCR2_TRIS_SHIFT     4
+#define SAI_XCR2_TRIS           BIT(SAI_XCR2_TRIS_SHIFT)
+#define SAI_XCR2_MUTE_SHIFT     5
+#define SAI_XCR2_MUTE           BIT(SAI_XCR2_MUTE_SHIFT)
+#define SAI_XCR2_MUTEVAL_SHIFT  6
+#define SAI_XCR2_MUTEVAL        BIT(SAI_XCR2_MUTEVAL_SHIFT)
+
+#define SAI_XCR2_MUTECNT_SHIFT  7
+#define SAI_XCR2_MUTECNT_MASK   GENMASK(12, SAI_XCR2_MUTECNT_SHIFT)
+#define SAI_XCR2_MUTECNT_SET(x) ((x) << SAI_XCR2_MUTECNT_SHIFT)
+
+#define SAI_XCR2_CPL_SHIFT      13
+#define SAI_XCR2_CPL            BIT(SAI_XCR2_CPL_SHIFT)
+
+#define SAI_XCR2_COMP_SHIFT     14
+#define SAI_XCR2_COMP_MASK      GENMASK(15, SAI_XCR2_COMP_SHIFT)
+#define SAI_XCR2_COMP_SET(x)    ((x) << SAI_XCR2_COMP_SHIFT)
+
+/****************** Bit definition for SAI_XFRCR register *******************/
+#define SAI_XFRCR_FRL_SHIFT     0
+#define SAI_XFRCR_FRL_MASK      GENMASK(7, SAI_XFRCR_FRL_SHIFT)
+#define SAI_XFRCR_FRL_SET(x)    ((x) << SAI_XFRCR_FRL_SHIFT)
+
+#define SAI_XFRCR_FSALL_SHIFT   8
+#define SAI_XFRCR_FSALL_MASK    GENMASK(14, SAI_XFRCR_FSALL_SHIFT)
+#define SAI_XFRCR_FSALL_SET(x)  ((x) << SAI_XFRCR_FSALL_SHIFT)
+
+#define SAI_XFRCR_FSDEF_SHIFT   16
+#define SAI_XFRCR_FSDEF         BIT(SAI_XFRCR_FSDEF_SHIFT)
+#define SAI_XFRCR_FSPOL_SHIFT   17
+#define SAI_XFRCR_FSPOL         BIT(SAI_XFRCR_FSPOL_SHIFT)
+#define SAI_XFRCR_FSOFF_SHIFT   18
+#define SAI_XFRCR_FSOFF         BIT(SAI_XFRCR_FSOFF_SHIFT)
+
+/****************** Bit definition for SAI_XSLOTR register ******************/
+
+#define SAI_XSLOTR_FBOFF_SHIFT  0
+#define SAI_XSLOTR_FBOFF_MASK   GENMASK(4, SAI_XSLOTR_FBOFF_SHIFT)
+#define SAI_XSLOTR_FBOFF_SET(x) ((x) << SAI_XSLOTR_FBOFF_SHIFT)
+
+#define SAI_XSLOTR_SLOTSZ_SHIFT 6
+#define SAI_XSLOTR_SLOTSZ_MASK  GENMASK(7, SAI_XSLOTR_SLOTSZ_SHIFT)
+#define SAI_XSLOTR_SLOTSZ_SET(x)        ((x) << SAI_XSLOTR_SLOTSZ_SHIFT)
+
+#define SAI_XSLOTR_NBSLOT_SHIFT 8
+#define SAI_XSLOTR_NBSLOT_MASK  GENMASK(11, SAI_XSLOTR_NBSLOT_SHIFT)
+#define SAI_XSLOTR_NBSLOT_SET(x) ((x) << SAI_XSLOTR_NBSLOT_SHIFT)
+
+#define SAI_XSLOTR_SLOTEN_SHIFT 16
+#define SAI_XSLOTR_SLOTEN_WIDTH 16
+#define SAI_XSLOTR_SLOTEN_MASK  GENMASK(31, SAI_XSLOTR_SLOTEN_SHIFT)
+#define SAI_XSLOTR_SLOTEN_SET(x) ((x) << SAI_XSLOTR_SLOTEN_SHIFT)
+
+/******************* Bit definition for SAI_XIMR register *******************/
+#define SAI_XIMR_OVRUDRIE       BIT(0)
+#define SAI_XIMR_MUTEDETIE      BIT(1)
+#define SAI_XIMR_WCKCFGIE       BIT(2)
+#define SAI_XIMR_FREQIE         BIT(3)
+#define SAI_XIMR_CNRDYIE        BIT(4)
+#define SAI_XIMR_AFSDETIE       BIT(5)
+#define SAI_XIMR_LFSDETIE       BIT(6)
+
+#define SAI_XIMR_SHIFT  0
+#define SAI_XIMR_MASK           GENMASK(6, SAI_XIMR_SHIFT)
+
+/******************** Bit definition for SAI_XSR register *******************/
+#define SAI_XSR_OVRUDR          BIT(0)
+#define SAI_XSR_MUTEDET         BIT(1)
+#define SAI_XSR_WCKCFG          BIT(2)
+#define SAI_XSR_FREQ            BIT(3)
+#define SAI_XSR_CNRDY           BIT(4)
+#define SAI_XSR_AFSDET          BIT(5)
+#define SAI_XSR_LFSDET          BIT(6)
+
+#define SAI_XSR_SHIFT   0
+#define SAI_XSR_MASK            GENMASK(6, SAI_XSR_SHIFT)
+
+/****************** Bit definition for SAI_XCLRFR register ******************/
+#define SAI_XCLRFR_COVRUDR      BIT(0)
+#define SAI_XCLRFR_CMUTEDET     BIT(1)
+#define SAI_XCLRFR_CWCKCFG      BIT(2)
+#define SAI_XCLRFR_CFREQ        BIT(3)
+#define SAI_XCLRFR_CCNRDY       BIT(4)
+#define SAI_XCLRFR_CAFSDET      BIT(5)
+#define SAI_XCLRFR_CLFSDET      BIT(6)
+
+#define SAI_XCLRFR_SHIFT        0
+#define SAI_XCLRFR_MASK         GENMASK(6, SAI_XCLRFR_SHIFT)
+
+enum stm32_sai_version {
+        SAI_STM32F4
+};
+
+/**
+ * struct stm32_sai_data - private data of SAI instance driver
+ * @pdev: device data pointer
+ * @clk_x8k: SAI parent clock for sampling frequencies multiple of 8kHz
+ * @clk_x11k: SAI parent clock for sampling frequencies multiple of 11kHz
+ * @version: SOC version
+ * @irq: SAI interrupt line
+ */
+struct stm32_sai_data {
+        struct platform_device *pdev;
+        struct clk *clk_x8k;
+        struct clk *clk_x11k;
+        int version;
+        int irq;
+};
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
new file mode 100644
index 000000000000..ae4706ca265b
--- /dev/null
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -0,0 +1,884 @@
+/*
+ * STM32 ALSA SoC Digital Audio Interface (SAI) driver.
+ *
+ * Copyright (C) 2016, STMicroelectronics - All Rights Reserved
+ * Author(s): Olivier Moysan <olivier.moysan@st.com> for STMicroelectronics.
+ *
+ * License terms: GPL V2.0.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+ * details.
+ */
+
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/regmap.h>
+
+#include <sound/core.h>
+#include <sound/dmaengine_pcm.h>
+#include <sound/pcm_params.h>
+
+#include "stm32_sai.h"
+
+#define SAI_FREE_PROTOCOL       0x0
+
+#define SAI_SLOT_SIZE_AUTO      0x0
+#define SAI_SLOT_SIZE_16        0x1
+#define SAI_SLOT_SIZE_32        0x2
+
+#define SAI_DATASIZE_8          0x2
+#define SAI_DATASIZE_10         0x3
+#define SAI_DATASIZE_16         0x4
+#define SAI_DATASIZE_20         0x5
+#define SAI_DATASIZE_24         0x6
+#define SAI_DATASIZE_32         0x7
+
+#define STM_SAI_FIFO_SIZE       8
+#define STM_SAI_DAI_NAME_SIZE   15
+
+#define STM_SAI_IS_PLAYBACK(ip) ((ip)->dir == SNDRV_PCM_STREAM_PLAYBACK)
+#define STM_SAI_IS_CAPTURE(ip)  ((ip)->dir == SNDRV_PCM_STREAM_CAPTURE)
+
+#define STM_SAI_A_ID            0x0
+#define STM_SAI_B_ID            0x1
+
+#define STM_SAI_BLOCK_NAME(x)   (((x)->id == STM_SAI_A_ID) ? "A" : "B")
+
+/**
+ * struct stm32_sai_sub_data - private data of SAI sub block (block A or B)
+ * @pdev: device data pointer
+ * @regmap: SAI register map pointer
+ * @dma_params: dma configuration data for rx or tx channel
+ * @cpu_dai_drv: DAI driver data pointer
+ * @cpu_dai: DAI runtime data pointer
+ * @substream: PCM substream data pointer
+ * @pdata: SAI block parent data pointer
+ * @sai_ck: kernel clock feeding the SAI clock generator
+ * @phys_addr: SAI registers physical base address
+ * @mclk_rate: SAI block master clock frequency (Hz). set at init
+ * @id: SAI sub block id corresponding to sub-block A or B
+ * @dir: SAI block direction (playback or capture). set at init
+ * @master: SAI block mode flag. (true=master, false=slave) set at init
+ * @fmt: SAI block format. relevant only for custom protocols. set at init
+ * @sync: SAI block synchronization mode. (none, internal or external)
+ * @fs_length: frame synchronization length. depends on protocol settings
+ * @slots: rx or tx slot number
+ * @slot_width: rx or tx slot width in bits
+ * @slot_mask: rx or tx active slots mask. set at init or at runtime
+ * @data_size: PCM data width. corresponds to PCM substream width.
+ */
+struct stm32_sai_sub_data {
+        struct platform_device *pdev;
+        struct regmap *regmap;
+        struct snd_dmaengine_dai_dma_data dma_params;
+        struct snd_soc_dai_driver *cpu_dai_drv;
+        struct snd_soc_dai *cpu_dai;
+        struct snd_pcm_substream *substream;
+        struct stm32_sai_data *pdata;
+        struct clk *sai_ck;
+        dma_addr_t phys_addr;
+        unsigned int mclk_rate;
+        unsigned int id;
+        int dir;
+        bool master;
+        int fmt;
+        int sync;
+        int fs_length;
+        int slots;
+        int slot_width;
+        int slot_mask;
+        int data_size;
+};
+
+enum stm32_sai_fifo_th {
+        STM_SAI_FIFO_TH_EMPTY,
+        STM_SAI_FIFO_TH_QUARTER,
+        STM_SAI_FIFO_TH_HALF,
+        STM_SAI_FIFO_TH_3_QUARTER,
+        STM_SAI_FIFO_TH_FULL,
+};
+
+static bool stm32_sai_sub_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM_SAI_CR1_REGX:
+        case STM_SAI_CR2_REGX:
+        case STM_SAI_FRCR_REGX:
+        case STM_SAI_SLOTR_REGX:
+        case STM_SAI_IMR_REGX:
+        case STM_SAI_SR_REGX:
+        case STM_SAI_CLRFR_REGX:
+        case STM_SAI_DR_REGX:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool stm32_sai_sub_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM_SAI_DR_REGX:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool stm32_sai_sub_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case STM_SAI_CR1_REGX:
+        case STM_SAI_CR2_REGX:
+        case STM_SAI_FRCR_REGX:
+        case STM_SAI_SLOTR_REGX:
+        case STM_SAI_IMR_REGX:
+        case STM_SAI_SR_REGX:
+        case STM_SAI_CLRFR_REGX:
+        case STM_SAI_DR_REGX:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const struct regmap_config stm32_sai_sub_regmap_config = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+        .max_register = STM_SAI_DR_REGX,
+        .readable_reg = stm32_sai_sub_readable_reg,
+        .volatile_reg = stm32_sai_sub_volatile_reg,
+        .writeable_reg = stm32_sai_sub_writeable_reg,
+        .fast_io = true,
+};
+
+static irqreturn_t stm32_sai_isr(int irq, void *devid)
+{
+        struct stm32_sai_sub_data *sai = (struct stm32_sai_sub_data *)devid;
+        struct snd_pcm_substream *substream = sai->substream;
+        struct platform_device *pdev = sai->pdev;
+        unsigned int sr, imr, flags;
+        snd_pcm_state_t status = SNDRV_PCM_STATE_RUNNING;
+
+        regmap_read(sai->regmap, STM_SAI_IMR_REGX, &imr);
+        regmap_read(sai->regmap, STM_SAI_SR_REGX, &sr);
+
+        flags = sr & imr;
+        if (!flags)
+                return IRQ_NONE;
+
+        regmap_update_bits(sai->regmap, STM_SAI_CLRFR_REGX, SAI_XCLRFR_MASK,
+                           SAI_XCLRFR_MASK);
+
+        if (flags & SAI_XIMR_OVRUDRIE) {
+                dev_err(&pdev->dev, "IT %s\n",
+                        STM_SAI_IS_PLAYBACK(sai) ? "underrun" : "overrun");
+                status = SNDRV_PCM_STATE_XRUN;
+        }
+
+        if (flags & SAI_XIMR_MUTEDETIE)
+                dev_dbg(&pdev->dev, "IT mute detected\n");
+
+        if (flags & SAI_XIMR_WCKCFGIE) {
+                dev_err(&pdev->dev, "IT wrong clock configuration\n");
+                status = SNDRV_PCM_STATE_DISCONNECTED;
+        }
+
+        if (flags & SAI_XIMR_CNRDYIE)
+                dev_warn(&pdev->dev, "IT Codec not ready\n");
+
+        if (flags & SAI_XIMR_AFSDETIE) {
+                dev_warn(&pdev->dev, "IT Anticipated frame synchro\n");
+                status = SNDRV_PCM_STATE_XRUN;
+        }
+
+        if (flags & SAI_XIMR_LFSDETIE) {
+                dev_warn(&pdev->dev, "IT Late frame synchro\n");
+                status = SNDRV_PCM_STATE_XRUN;
+        }
+
+        if (status != SNDRV_PCM_STATE_RUNNING) {
+                snd_pcm_stream_lock(substream);
+                snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
+                snd_pcm_stream_unlock(substream);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
+                                int clk_id, unsigned int freq, int dir)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+
+        if ((dir == SND_SOC_CLOCK_OUT) && sai->master) {
+                sai->mclk_rate = freq;
+                dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
+        }
+
+        return 0;
+}
+
+static int stm32_sai_set_dai_tdm_slot(struct snd_soc_dai *cpu_dai, u32 tx_mask,
+                                      u32 rx_mask, int slots, int slot_width)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int slotr, slotr_mask, slot_size;
+
+        dev_dbg(cpu_dai->dev, "masks tx/rx:%#x/%#x, slots:%d, width:%d\n",
+                tx_mask, rx_mask, slots, slot_width);
+
+        switch (slot_width) {
+        case 16:
+                slot_size = SAI_SLOT_SIZE_16;
+                break;
+        case 32:
+                slot_size = SAI_SLOT_SIZE_32;
+                break;
+        default:
+                slot_size = SAI_SLOT_SIZE_AUTO;
+                break;
+        }
+
+        slotr = SAI_XSLOTR_SLOTSZ_SET(slot_size) |
+                SAI_XSLOTR_NBSLOT_SET(slots - 1);
+        slotr_mask = SAI_XSLOTR_SLOTSZ_MASK | SAI_XSLOTR_NBSLOT_MASK;
+
+        /* tx/rx mask set in machine init, if slot number defined in DT */
+        if (STM_SAI_IS_PLAYBACK(sai)) {
+                sai->slot_mask = tx_mask;
+                slotr |= SAI_XSLOTR_SLOTEN_SET(tx_mask);
+        }
+
+        if (STM_SAI_IS_CAPTURE(sai)) {
+                sai->slot_mask = rx_mask;
+                slotr |= SAI_XSLOTR_SLOTEN_SET(rx_mask);
+        }
+
+        slotr_mask |= SAI_XSLOTR_SLOTEN_MASK;
+
+        regmap_update_bits(sai->regmap, STM_SAI_SLOTR_REGX, slotr_mask, slotr);
+
+        sai->slot_width = slot_width;
+        sai->slots = slots;
+
+        return 0;
+}
+
+static int stm32_sai_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int cr1 = 0, frcr = 0;
+        int cr1_mask = 0, frcr_mask = 0;
+        int ret;
+
+        dev_dbg(cpu_dai->dev, "fmt %x\n", fmt);
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        /* SCK active high for all protocols */
+        case SND_SOC_DAIFMT_I2S:
+                cr1 |= SAI_XCR1_CKSTR;
+                frcr |= SAI_XFRCR_FSOFF | SAI_XFRCR_FSDEF;
+                break;
+        /* Left justified */
+        case SND_SOC_DAIFMT_MSB:
+                frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSDEF;
+                break;
+        /* Right justified */
+        case SND_SOC_DAIFMT_LSB:
+                frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSDEF;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                frcr |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSOFF;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                frcr |= SAI_XFRCR_FSPOL;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unsupported protocol %#x\n",
+                        fmt & SND_SOC_DAIFMT_FORMAT_MASK);
+                return -EINVAL;
+        }
+
+        cr1_mask |= SAI_XCR1_PRTCFG_MASK | SAI_XCR1_CKSTR;
+        frcr_mask |= SAI_XFRCR_FSPOL | SAI_XFRCR_FSOFF |
+                     SAI_XFRCR_FSDEF;
+
+        /* DAI clock strobing. Invert setting previously set */
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                cr1 ^= SAI_XCR1_CKSTR;
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                frcr ^= SAI_XFRCR_FSPOL;
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                /* Invert fs & sck */
+                cr1 ^= SAI_XCR1_CKSTR;
+                frcr ^= SAI_XFRCR_FSPOL;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unsupported strobing %#x\n",
+                        fmt & SND_SOC_DAIFMT_INV_MASK);
+                return -EINVAL;
+        }
+        cr1_mask |= SAI_XCR1_CKSTR;
+        frcr_mask |= SAI_XFRCR_FSPOL;
+
+        regmap_update_bits(sai->regmap, STM_SAI_FRCR_REGX, frcr_mask, frcr);
+
+        /* DAI clock master masks */
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                /* codec is master */
+                cr1 |= SAI_XCR1_SLAVE;
+                sai->master = false;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                sai->master = true;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unsupported mode %#x\n",
+                        fmt & SND_SOC_DAIFMT_MASTER_MASK);
+                return -EINVAL;
+        }
+        cr1_mask |= SAI_XCR1_SLAVE;
+
+        ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, cr1_mask, cr1);
+        if (ret < 0) {
+                dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
+                return ret;
+        }
+
+        sai->fmt = fmt;
+
+        return 0;
+}
+
+static int stm32_sai_startup(struct snd_pcm_substream *substream,
+                             struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int imr, cr2, ret;
+
+        sai->substream = substream;
+
+        ret = clk_prepare_enable(sai->sai_ck);
+        if (ret < 0) {
+                dev_err(cpu_dai->dev, "failed to enable clock: %d\n", ret);
+                return ret;
+        }
+
+        /* Enable ITs */
+        regmap_update_bits(sai->regmap, STM_SAI_SR_REGX,
+                           SAI_XSR_MASK, (unsigned int)~SAI_XSR_MASK);
+
+        regmap_update_bits(sai->regmap, STM_SAI_CLRFR_REGX,
+                           SAI_XCLRFR_MASK, SAI_XCLRFR_MASK);
+
+        imr = SAI_XIMR_OVRUDRIE;
+        if (STM_SAI_IS_CAPTURE(sai)) {
+                regmap_read(sai->regmap, STM_SAI_CR2_REGX, &cr2);
+                if (cr2 & SAI_XCR2_MUTECNT_MASK)
+                        imr |= SAI_XIMR_MUTEDETIE;
+        }
+
+        if (sai->master)
+                imr |= SAI_XIMR_WCKCFGIE;
+        else
+                imr |= SAI_XIMR_AFSDETIE | SAI_XIMR_LFSDETIE;
+
+        regmap_update_bits(sai->regmap, STM_SAI_IMR_REGX,
+                           SAI_XIMR_MASK, imr);
+
+        return 0;
+}
+
+static int stm32_sai_set_config(struct snd_soc_dai *cpu_dai,
+                                struct snd_pcm_substream *substream,
+                                struct snd_pcm_hw_params *params)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int cr1, cr1_mask, ret;
+        int fth = STM_SAI_FIFO_TH_HALF;
+
+        /* FIFO config */
+        regmap_update_bits(sai->regmap, STM_SAI_CR2_REGX,
+                           SAI_XCR2_FFLUSH | SAI_XCR2_FTH_MASK,
+                           SAI_XCR2_FFLUSH | SAI_XCR2_FTH_SET(fth));
+
+        /* Mode, data format and channel config */
+        cr1 = SAI_XCR1_PRTCFG_SET(SAI_FREE_PROTOCOL);
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_S8:
+                cr1 |= SAI_XCR1_DS_SET(SAI_DATASIZE_8);
+                break;
+        case SNDRV_PCM_FORMAT_S16_LE:
+                cr1 |= SAI_XCR1_DS_SET(SAI_DATASIZE_16);
+                break;
+        case SNDRV_PCM_FORMAT_S32_LE:
+                cr1 |= SAI_XCR1_DS_SET(SAI_DATASIZE_32);
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Data format not supported");
+                return -EINVAL;
+        }
+        cr1_mask = SAI_XCR1_DS_MASK | SAI_XCR1_PRTCFG_MASK;
+
+        cr1_mask |= SAI_XCR1_RX_TX;
+        if (STM_SAI_IS_CAPTURE(sai))
+                cr1 |= SAI_XCR1_RX_TX;
+
+        cr1_mask |= SAI_XCR1_MONO;
+        if ((sai->slots == 2) && (params_channels(params) == 1))
+                cr1 |= SAI_XCR1_MONO;
+
+        ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, cr1_mask, cr1);
+        if (ret < 0) {
+                dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
+                return ret;
+        }
+
+        /* DMA config */
+        sai->dma_params.maxburst = STM_SAI_FIFO_SIZE * fth / sizeof(u32);
+        snd_soc_dai_set_dma_data(cpu_dai, substream, (void *)&sai->dma_params);
+
+        return 0;
+}
+
+static int stm32_sai_set_slots(struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int slotr, slot_sz;
+
+        regmap_read(sai->regmap, STM_SAI_SLOTR_REGX, &slotr);
+
+        /*
+         * If SLOTSZ is set to auto in SLOTR, align slot width on data size
+         * By default slot width = data size, if not forced from DT
+         */
+        slot_sz = slotr & SAI_XSLOTR_SLOTSZ_MASK;
+        if (slot_sz == SAI_XSLOTR_SLOTSZ_SET(SAI_SLOT_SIZE_AUTO))
+                sai->slot_width = sai->data_size;
+
+        if (sai->slot_width < sai->data_size) {
+                dev_err(cpu_dai->dev,
+                        "Data size %d larger than slot width\n",
+                        sai->data_size);
+                return -EINVAL;
+        }
+
+        /* Slot number is set to 2, if not specified in DT */
+        if (!sai->slots)
+                sai->slots = 2;
+
+        /* The number of slots in the audio frame is equal to NBSLOT[3:0] + 1*/
+        regmap_update_bits(sai->regmap, STM_SAI_SLOTR_REGX,
+                           SAI_XSLOTR_NBSLOT_MASK,
+                           SAI_XSLOTR_NBSLOT_SET((sai->slots - 1)));
+
+        /* Set default slots mask if not already set from DT */
+        if (!(slotr & SAI_XSLOTR_SLOTEN_MASK)) {
+                sai->slot_mask = (1 << sai->slots) - 1;
+                regmap_update_bits(sai->regmap,
+                                   STM_SAI_SLOTR_REGX, SAI_XSLOTR_SLOTEN_MASK,
+                                   SAI_XSLOTR_SLOTEN_SET(sai->slot_mask));
+        }
+
+        dev_dbg(cpu_dai->dev, "slots %d, slot width %d\n",
+                sai->slots, sai->slot_width);
+
+        return 0;
+}
+
+static void stm32_sai_set_frame(struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int fs_active, offset, format;
+        int frcr, frcr_mask;
+
+        format = sai->fmt & SND_SOC_DAIFMT_FORMAT_MASK;
+        sai->fs_length = sai->slot_width * sai->slots;
+
+        fs_active = sai->fs_length / 2;
+        if ((format == SND_SOC_DAIFMT_DSP_A) ||
+            (format == SND_SOC_DAIFMT_DSP_B))
+                fs_active = 1;
+
+        frcr = SAI_XFRCR_FRL_SET((sai->fs_length - 1));
+        frcr |= SAI_XFRCR_FSALL_SET((fs_active - 1));
+        frcr_mask = SAI_XFRCR_FRL_MASK | SAI_XFRCR_FSALL_MASK;
+
+        dev_dbg(cpu_dai->dev, "frame length %d, frame active %d\n",
+                sai->fs_length, fs_active);
+
+        regmap_update_bits(sai->regmap, STM_SAI_FRCR_REGX, frcr_mask, frcr);
+
+        if ((sai->fmt & SND_SOC_DAIFMT_FORMAT_MASK) == SND_SOC_DAIFMT_LSB) {
+                offset = sai->slot_width - sai->data_size;
+
+                regmap_update_bits(sai->regmap, STM_SAI_SLOTR_REGX,
+                                   SAI_XSLOTR_FBOFF_MASK,
+                                   SAI_XSLOTR_FBOFF_SET(offset));
+        }
+}
+
+static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
+                                     struct snd_pcm_hw_params *params)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int cr1, mask, div = 0;
+        int sai_clk_rate, ret;
+
+        if (!sai->mclk_rate) {
+                dev_err(cpu_dai->dev, "Mclk rate is null\n");
+                return -EINVAL;
+        }
+
+        if (!(params_rate(params) % 11025))
+                clk_set_parent(sai->sai_ck, sai->pdata->clk_x11k);
+        else
+                clk_set_parent(sai->sai_ck, sai->pdata->clk_x8k);
+        sai_clk_rate = clk_get_rate(sai->sai_ck);
+
+        /*
+         * mclk_rate = 256 * fs
+         * MCKDIV = 0 if sai_ck < 3/2 * mclk_rate
+         * MCKDIV = sai_ck / (2 * mclk_rate) otherwise
+         */
+        if (2 * sai_clk_rate >= 3 * sai->mclk_rate)
+                div = DIV_ROUND_CLOSEST(sai_clk_rate, 2 * sai->mclk_rate);
+
+        if (div > SAI_XCR1_MCKDIV_MAX) {
+                dev_err(cpu_dai->dev, "Divider %d out of range\n", div);
+                return -EINVAL;
+        }
+        dev_dbg(cpu_dai->dev, "SAI clock %d, divider %d\n", sai_clk_rate, div);
+
+        mask = SAI_XCR1_MCKDIV_MASK;
+        cr1 = SAI_XCR1_MCKDIV_SET(div);
+        ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, mask, cr1);
+        if (ret < 0) {
+                dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int stm32_sai_hw_params(struct snd_pcm_substream *substream,
+                               struct snd_pcm_hw_params *params,
+                               struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret;
+
+        sai->data_size = params_width(params);
+
+        ret = stm32_sai_set_slots(cpu_dai);
+        if (ret < 0)
+                return ret;
+        stm32_sai_set_frame(cpu_dai);
+
+        ret = stm32_sai_set_config(cpu_dai, substream, params);
+        if (ret)
+                return ret;
+
+        if (sai->master)
+                ret = stm32_sai_configure_clock(cpu_dai, params);
+
+        return ret;
+}
+
+static int stm32_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+                             struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        int ret;
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                dev_dbg(cpu_dai->dev, "Enable DMA and SAI\n");
+
+                regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
+                                   SAI_XCR1_DMAEN, SAI_XCR1_DMAEN);
+
+                /* Enable SAI */
+                ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
+                                         SAI_XCR1_SAIEN, SAI_XCR1_SAIEN);
+                if (ret < 0)
+                        dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
+                break;
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+        case SNDRV_PCM_TRIGGER_STOP:
+                dev_dbg(cpu_dai->dev, "Disable DMA and SAI\n");
+
+                regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
+                                   SAI_XCR1_DMAEN,
+                                   (unsigned int)~SAI_XCR1_DMAEN);
+
+                ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
+                                         SAI_XCR1_SAIEN,
+                                         (unsigned int)~SAI_XCR1_SAIEN);
+                if (ret < 0)
+                        dev_err(cpu_dai->dev, "Failed to update CR1 register\n");
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return ret;
+}
+
+static void stm32_sai_shutdown(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+
+        regmap_update_bits(sai->regmap, STM_SAI_IMR_REGX, SAI_XIMR_MASK, 0);
+
+        clk_disable_unprepare(sai->sai_ck);
+        sai->substream = NULL;
+}
+
+static int stm32_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+{
+        struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
+
+        sai->dma_params.addr = (dma_addr_t)(sai->phys_addr + STM_SAI_DR_REGX);
+        sai->dma_params.maxburst = 1;
+        /* Buswidth will be set by framework at runtime */
+        sai->dma_params.addr_width = DMA_SLAVE_BUSWIDTH_UNDEFINED;
+
+        if (STM_SAI_IS_PLAYBACK(sai))
+                snd_soc_dai_init_dma_data(cpu_dai, &sai->dma_params, NULL);
+        else
+                snd_soc_dai_init_dma_data(cpu_dai, NULL, &sai->dma_params);
+
+        return 0;
+}
+
+static const struct snd_soc_dai_ops stm32_sai_pcm_dai_ops = {
+        .set_sysclk     = stm32_sai_set_sysclk,
+        .set_fmt        = stm32_sai_set_dai_fmt,
+        .set_tdm_slot   = stm32_sai_set_dai_tdm_slot,
+        .startup        = stm32_sai_startup,
+        .hw_params      = stm32_sai_hw_params,
+        .trigger        = stm32_sai_trigger,
+        .shutdown       = stm32_sai_shutdown,
+};
+
+static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+        .buffer_bytes_max = 8 * PAGE_SIZE,
+        .period_bytes_min = 1024, /* 5ms at 48kHz */
+        .period_bytes_max = PAGE_SIZE,
+        .periods_min = 2,
+        .periods_max = 8,
+};
+
+static struct snd_soc_dai_driver stm32_sai_playback_dai[] = {
+{
+                .probe = stm32_sai_dai_probe,
+                .id = 1, /* avoid call to fmt_single_name() */
+                .playback = {
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rate_min = 8000,
+                        .rate_max = 192000,
+                        .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                        /* DMA does not support 24 bits transfers */
+                        .formats =
+                                SNDRV_PCM_FMTBIT_S8 |
+                                SNDRV_PCM_FMTBIT_S16_LE |
+                                SNDRV_PCM_FMTBIT_S32_LE,
+                },
+                .ops = &stm32_sai_pcm_dai_ops,
+        }
+};
+
+static struct snd_soc_dai_driver stm32_sai_capture_dai[] = {
+{
+                .probe = stm32_sai_dai_probe,
+                .id = 1, /* avoid call to fmt_single_name() */
+                .capture = {
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rate_min = 8000,
+                        .rate_max = 192000,
+                        .rates = SNDRV_PCM_RATE_CONTINUOUS,
+                        /* DMA does not support 24 bits transfers */
+                        .formats =
+                                SNDRV_PCM_FMTBIT_S8 |
+                                SNDRV_PCM_FMTBIT_S16_LE |
+                                SNDRV_PCM_FMTBIT_S32_LE,
+                },
+                .ops = &stm32_sai_pcm_dai_ops,
+        }
+};
+
+static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
+        .pcm_hardware   = &stm32_sai_pcm_hw,
+        .prepare_slave_config   = snd_dmaengine_pcm_prepare_slave_config,
+};
+
+static const struct snd_soc_component_driver stm32_component = {
+        .name = "stm32-sai",
+};
+
+static const struct of_device_id stm32_sai_sub_ids[] = {
+        { .compatible = "st,stm32-sai-sub-a",
+          .data = (void *)STM_SAI_A_ID},
+        { .compatible = "st,stm32-sai-sub-b",
+          .data = (void *)STM_SAI_B_ID},
+        {}
+};
+MODULE_DEVICE_TABLE(of, stm32_sai_sub_ids);
+
+static int stm32_sai_sub_parse_of(struct platform_device *pdev,
+                                  struct stm32_sai_sub_data *sai)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct resource *res;
+        void __iomem *base;
+
+        if (!np)
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+        dev_err(&pdev->dev, "res %pr\n", res);
+
+        base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        sai->phys_addr = res->start;
+        sai->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+                                            &stm32_sai_sub_regmap_config);
+
+        /* Get direction property */
+        if (of_property_match_string(np, "dma-names", "tx") >= 0) {
+                sai->dir = SNDRV_PCM_STREAM_PLAYBACK;
+        } else if (of_property_match_string(np, "dma-names", "rx") >= 0) {
+                sai->dir = SNDRV_PCM_STREAM_CAPTURE;
+        } else {
+                dev_err(&pdev->dev, "Unsupported direction\n");
+                return -EINVAL;
+        }
+
+        sai->sai_ck = devm_clk_get(&pdev->dev, "sai_ck");
+        if (IS_ERR(sai->sai_ck)) {
+                dev_err(&pdev->dev, "missing kernel clock sai_ck\n");
+                return PTR_ERR(sai->sai_ck);
+        }
+
+        return 0;
+}
+
+static int stm32_sai_sub_dais_init(struct platform_device *pdev,
+                                   struct stm32_sai_sub_data *sai)
+{
+        sai->cpu_dai_drv = devm_kzalloc(&pdev->dev,
+                                        sizeof(struct snd_soc_dai_driver),
+                                        GFP_KERNEL);
+        if (!sai->cpu_dai_drv)
+                return -ENOMEM;
+
+        sai->cpu_dai_drv->name = dev_name(&pdev->dev);
+        if (STM_SAI_IS_PLAYBACK(sai)) {
+                memcpy(sai->cpu_dai_drv, &stm32_sai_playback_dai,
+                       sizeof(stm32_sai_playback_dai));
+                sai->cpu_dai_drv->playback.stream_name = sai->cpu_dai_drv->name;
+        } else {
+                memcpy(sai->cpu_dai_drv, &stm32_sai_capture_dai,
+                       sizeof(stm32_sai_capture_dai));
+                sai->cpu_dai_drv->capture.stream_name = sai->cpu_dai_drv->name;
+        }
+
+        return 0;
+}
+
+static int stm32_sai_sub_probe(struct platform_device *pdev)
+{
+        struct stm32_sai_sub_data *sai;
+        const struct of_device_id *of_id;
+        int ret;
+
+        sai = devm_kzalloc(&pdev->dev, sizeof(*sai), GFP_KERNEL);
+        if (!sai)
+                return -ENOMEM;
+
+        of_id = of_match_device(stm32_sai_sub_ids, &pdev->dev);
+        if (!of_id)
+                return -EINVAL;
+        sai->id = (uintptr_t)of_id->data;
+
+        sai->pdev = pdev;
+        platform_set_drvdata(pdev, sai);
+
+        sai->pdata = dev_get_drvdata(pdev->dev.parent);
+        if (!sai->pdata) {
+                dev_err(&pdev->dev, "Parent device data not available\n");
+                return -EINVAL;
+        }
+
+        ret = stm32_sai_sub_parse_of(pdev, sai);
+        if (ret)
+                return ret;
+
+        ret = stm32_sai_sub_dais_init(pdev, sai);
+        if (ret)
+                return ret;
+
+        ret = devm_request_irq(&pdev->dev, sai->pdata->irq, stm32_sai_isr,
+                               IRQF_SHARED, dev_name(&pdev->dev), sai);
+        if (ret) {
+                dev_err(&pdev->dev, "irq request returned %d\n", ret);
+                return ret;
+        }
+
+        ret = devm_snd_soc_register_component(&pdev->dev, &stm32_component,
+                                              sai->cpu_dai_drv, 1);
+        if (ret)
+                return ret;
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev,
+                                              &stm32_sai_pcm_config, 0);
+        if (ret) {
+                dev_err(&pdev->dev, "could not register pcm dma\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static struct platform_driver stm32_sai_sub_driver = {
+        .driver = {
+                .name = "st,stm32-sai-sub",
+                .of_match_table = stm32_sai_sub_ids,
+        },
+        .probe = stm32_sai_sub_probe,
+};
+
+module_platform_driver(stm32_sai_sub_driver);
+
+MODULE_DESCRIPTION("STM32 Soc SAI sub-block Interface");
+MODULE_AUTHOR("Olivier Moysan, <olivier.moysan@st.com>");
+MODULE_ALIAS("platform:st,stm32-sai-sub");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/sunxi/sun8i-codec-analog.c b/sound/soc/sunxi/sun8i-codec-analog.c
index 72331332b72e..6c17c99c2c8d 100644
--- a/sound/soc/sunxi/sun8i-codec-analog.c
+++ b/sound/soc/sunxi/sun8i-codec-analog.c
@@ -252,24 +252,15 @@ static const DECLARE_TLV_DB_RANGE(sun8i_codec_mic_gain_scale,
 );
 
 static const struct snd_kcontrol_new sun8i_codec_common_controls[] = {
-        /* Mixer pre-gains */
-        SOC_SINGLE_TLV("Line In Playback Volume", SUN8I_ADDA_LINEIN_GCTRL,
-                       SUN8I_ADDA_LINEIN_GCTRL_LINEING,
-                       0x7, 0, sun8i_codec_out_mixer_pregain_scale),
+        /* Mixer pre-gain */
         SOC_SINGLE_TLV("Mic1 Playback Volume", SUN8I_ADDA_MICIN_GCTRL,
                        SUN8I_ADDA_MICIN_GCTRL_MIC1G,
                        0x7, 0, sun8i_codec_out_mixer_pregain_scale),
-        SOC_SINGLE_TLV("Mic2 Playback Volume",
-                       SUN8I_ADDA_MICIN_GCTRL, SUN8I_ADDA_MICIN_GCTRL_MIC2G,
-                       0x7, 0, sun8i_codec_out_mixer_pregain_scale),
 
-        /* Microphone Amp boost gains */
+        /* Microphone Amp boost gain */
         SOC_SINGLE_TLV("Mic1 Boost Volume", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
                        SUN8I_ADDA_MIC1G_MICBIAS_CTRL_MIC1BOOST, 0x7, 0,
                        sun8i_codec_mic_gain_scale),
-        SOC_SINGLE_TLV("Mic2 Boost Volume", SUN8I_ADDA_MIC2G_CTRL,
-                       SUN8I_ADDA_MIC2G_CTRL_MIC2BOOST, 0x7, 0,
-                       sun8i_codec_mic_gain_scale),
 
         /* ADC */
         SOC_SINGLE_TLV("ADC Gain Capture Volume", SUN8I_ADDA_ADC_AP_EN,
@@ -295,12 +286,8 @@ static const struct snd_soc_dapm_widget sun8i_codec_common_widgets[] = {
          * stream widgets at the card level.
          */
 
-        /* Line In */
-        SND_SOC_DAPM_INPUT("LINEIN"),
-
-        /* Microphone inputs */
+        /* Microphone input */
         SND_SOC_DAPM_INPUT("MIC1"),
-        SND_SOC_DAPM_INPUT("MIC2"),
 
         /* Microphone Bias */
         SND_SOC_DAPM_SUPPLY("MBIAS", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
@@ -310,8 +297,6 @@ static const struct snd_soc_dapm_widget sun8i_codec_common_widgets[] = {
         /* Mic input path */
         SND_SOC_DAPM_PGA("Mic1 Amplifier", SUN8I_ADDA_MIC1G_MICBIAS_CTRL,
                          SUN8I_ADDA_MIC1G_MICBIAS_CTRL_MIC1AMPEN, 0, NULL, 0),
-        SND_SOC_DAPM_PGA("Mic2 Amplifier", SUN8I_ADDA_MIC2G_CTRL,
-                         SUN8I_ADDA_MIC2G_CTRL_MIC2AMPEN, 0, NULL, 0),
 
         /* Mixers */
         SND_SOC_DAPM_MIXER("Left Mixer", SUN8I_ADDA_DAC_PA_SRC,
@@ -335,35 +320,26 @@ static const struct snd_soc_dapm_widget sun8i_codec_common_widgets[] = {
 static const struct snd_soc_dapm_route sun8i_codec_common_routes[] = {
         /* Microphone Routes */
         { "Mic1 Amplifier", NULL, "MIC1"},
-        { "Mic2 Amplifier", NULL, "MIC2"},
 
         /* Left Mixer Routes */
         { "Left Mixer", "DAC Playback Switch", "Left DAC" },
         { "Left Mixer", "DAC Reversed Playback Switch", "Right DAC" },
-        { "Left Mixer", "Line In Playback Switch", "LINEIN" },
         { "Left Mixer", "Mic1 Playback Switch", "Mic1 Amplifier" },
-        { "Left Mixer", "Mic2 Playback Switch", "Mic2 Amplifier" },
 
         /* Right Mixer Routes */
         { "Right Mixer", "DAC Playback Switch", "Right DAC" },
         { "Right Mixer", "DAC Reversed Playback Switch", "Left DAC" },
-        { "Right Mixer", "Line In Playback Switch", "LINEIN" },
         { "Right Mixer", "Mic1 Playback Switch", "Mic1 Amplifier" },
-        { "Right Mixer", "Mic2 Playback Switch", "Mic2 Amplifier" },
 
         /* Left ADC Mixer Routes */
         { "Left ADC Mixer", "Mixer Capture Switch", "Left Mixer" },
         { "Left ADC Mixer", "Mixer Reversed Capture Switch", "Right Mixer" },
-        { "Left ADC Mixer", "Line In Capture Switch", "LINEIN" },
         { "Left ADC Mixer", "Mic1 Capture Switch", "Mic1 Amplifier" },
-        { "Left ADC Mixer", "Mic2 Capture Switch", "Mic2 Amplifier" },
 
         /* Right ADC Mixer Routes */
         { "Right ADC Mixer", "Mixer Capture Switch", "Right Mixer" },
         { "Right ADC Mixer", "Mixer Reversed Capture Switch", "Left Mixer" },
-        { "Right ADC Mixer", "Line In Capture Switch", "LINEIN" },
         { "Right ADC Mixer", "Mic1 Capture Switch", "Mic1 Amplifier" },
-        { "Right ADC Mixer", "Mic2 Capture Switch", "Mic2 Amplifier" },
 
         /* ADC Routes */
         { "Left ADC", NULL, "Left ADC Mixer" },
@@ -498,6 +474,61 @@ static int sun8i_codec_add_hmic(struct snd_soc_component *cmpnt)
         return ret;
 }
 
+/* line in specific controls, widgets and rines */
+static const struct snd_kcontrol_new sun8i_codec_linein_controls[] = {
+        /* Mixer pre-gain */
+        SOC_SINGLE_TLV("Line In Playback Volume", SUN8I_ADDA_LINEIN_GCTRL,
+                       SUN8I_ADDA_LINEIN_GCTRL_LINEING,
+                       0x7, 0, sun8i_codec_out_mixer_pregain_scale),
+};
+
+static const struct snd_soc_dapm_widget sun8i_codec_linein_widgets[] = {
+        /* Line input */
+        SND_SOC_DAPM_INPUT("LINEIN"),
+};
+
+static const struct snd_soc_dapm_route sun8i_codec_linein_routes[] = {
+        { "Left Mixer", "Line In Playback Switch", "LINEIN" },
+
+        { "Right Mixer", "Line In Playback Switch", "LINEIN" },
+
+        { "Left ADC Mixer", "Line In Capture Switch", "LINEIN" },
+
+        { "Right ADC Mixer", "Line In Capture Switch", "LINEIN" },
+};
+
+static int sun8i_codec_add_linein(struct snd_soc_component *cmpnt)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(cmpnt);
+        struct device *dev = cmpnt->dev;
+        int ret;
+
+        ret = snd_soc_add_component_controls(cmpnt,
+                                             sun8i_codec_linein_controls,
+                                             ARRAY_SIZE(sun8i_codec_linein_controls));
+        if (ret) {
+                dev_err(dev, "Failed to add Line In controls: %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dapm_new_controls(dapm, sun8i_codec_linein_widgets,
+                                        ARRAY_SIZE(sun8i_codec_linein_widgets));
+        if (ret) {
+                dev_err(dev, "Failed to add Line In DAPM widgets: %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dapm_add_routes(dapm, sun8i_codec_linein_routes,
+                                      ARRAY_SIZE(sun8i_codec_linein_routes));
+        if (ret) {
+                dev_err(dev, "Failed to add Line In DAPM routes: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+
 /* line out specific controls, widgets and routes */
 static const DECLARE_TLV_DB_RANGE(sun8i_codec_lineout_vol_scale,
         0, 1, TLV_DB_SCALE_ITEM(TLV_DB_GAIN_MUTE, 0, 1),
@@ -578,19 +609,90 @@ static int sun8i_codec_add_lineout(struct snd_soc_component *cmpnt)
         return 0;
 }
 
+/* mic2 specific controls, widgets and routes */
+static const struct snd_kcontrol_new sun8i_codec_mic2_controls[] = {
+        /* Mixer pre-gain */
+        SOC_SINGLE_TLV("Mic2 Playback Volume",
+                       SUN8I_ADDA_MICIN_GCTRL, SUN8I_ADDA_MICIN_GCTRL_MIC2G,
+                       0x7, 0, sun8i_codec_out_mixer_pregain_scale),
+
+        /* Microphone Amp boost gain */
+        SOC_SINGLE_TLV("Mic2 Boost Volume", SUN8I_ADDA_MIC2G_CTRL,
+                       SUN8I_ADDA_MIC2G_CTRL_MIC2BOOST, 0x7, 0,
+                       sun8i_codec_mic_gain_scale),
+};
+
+static const struct snd_soc_dapm_widget sun8i_codec_mic2_widgets[] = {
+        /* Microphone input */
+        SND_SOC_DAPM_INPUT("MIC2"),
+
+        /* Mic input path */
+        SND_SOC_DAPM_PGA("Mic2 Amplifier", SUN8I_ADDA_MIC2G_CTRL,
+                         SUN8I_ADDA_MIC2G_CTRL_MIC2AMPEN, 0, NULL, 0),
+};
+
+static const struct snd_soc_dapm_route sun8i_codec_mic2_routes[] = {
+        { "Mic2 Amplifier", NULL, "MIC2"},
+
+        { "Left Mixer", "Mic2 Playback Switch", "Mic2 Amplifier" },
+
+        { "Right Mixer", "Mic2 Playback Switch", "Mic2 Amplifier" },
+
+        { "Left ADC Mixer", "Mic2 Capture Switch", "Mic2 Amplifier" },
+
+        { "Right ADC Mixer", "Mic2 Capture Switch", "Mic2 Amplifier" },
+};
+
+static int sun8i_codec_add_mic2(struct snd_soc_component *cmpnt)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(cmpnt);
+        struct device *dev = cmpnt->dev;
+        int ret;
+
+        ret = snd_soc_add_component_controls(cmpnt,
+                                             sun8i_codec_mic2_controls,
+                                             ARRAY_SIZE(sun8i_codec_mic2_controls));
+        if (ret) {
+                dev_err(dev, "Failed to add MIC2 controls: %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dapm_new_controls(dapm, sun8i_codec_mic2_widgets,
+                                        ARRAY_SIZE(sun8i_codec_mic2_widgets));
+        if (ret) {
+                dev_err(dev, "Failed to add MIC2 DAPM widgets: %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dapm_add_routes(dapm, sun8i_codec_mic2_routes,
+                                      ARRAY_SIZE(sun8i_codec_mic2_routes));
+        if (ret) {
+                dev_err(dev, "Failed to add MIC2 DAPM routes: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 struct sun8i_codec_analog_quirks {
         bool has_headphone;
         bool has_hmic;
+        bool has_linein;
         bool has_lineout;
+        bool has_mic2;
 };
 
 static const struct sun8i_codec_analog_quirks sun8i_a23_quirks = {
         .has_headphone  = true,
         .has_hmic       = true,
+        .has_linein     = true,
+        .has_mic2       = true,
 };
 
 static const struct sun8i_codec_analog_quirks sun8i_h3_quirks = {
+        .has_linein     = true,
         .has_lineout    = true,
+        .has_mic2       = true,
 };
 
 static int sun8i_codec_analog_cmpnt_probe(struct snd_soc_component *cmpnt)
@@ -620,12 +722,24 @@ static int sun8i_codec_analog_cmpnt_probe(struct snd_soc_component *cmpnt)
                         return ret;
         }
 
+        if (quirks->has_linein) {
+                ret = sun8i_codec_add_linein(cmpnt);
+                if (ret)
+                        return ret;
+        }
+
         if (quirks->has_lineout) {
                 ret = sun8i_codec_add_lineout(cmpnt);
                 if (ret)
                         return ret;
         }
 
+        if (quirks->has_mic2) {
+                ret = sun8i_codec_add_mic2(cmpnt);
+                if (ret)
+                        return ret;
+        }
+
         return 0;
 }
 
diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index 7527ba29a5a0..5723c3404f6b 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -290,12 +290,10 @@ static const struct snd_soc_dapm_widget sun8i_codec_dapm_widgets[] = {
                             SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0R_ENA, 0),
 
         /* DAC Mixers */
-        SND_SOC_DAPM_MIXER("Left Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_dac_mixer_controls,
-                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
-        SND_SOC_DAPM_MIXER("Right Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_dac_mixer_controls,
-                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
+        SOC_MIXER_ARRAY("Left Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                        sun8i_dac_mixer_controls),
+        SOC_MIXER_ARRAY("Right Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                        sun8i_dac_mixer_controls),
 
         /* Clocks */
         SND_SOC_DAPM_SUPPLY("MODCLK AFI1", SUN8I_MOD_CLK_ENA,
diff --git a/sound/soc/tegra/tegra20_ac97.c b/sound/soc/tegra/tegra20_ac97.c
index a68368edab9c..affad46bf188 100644
--- a/sound/soc/tegra/tegra20_ac97.c
+++ b/sound/soc/tegra/tegra20_ac97.c
@@ -318,7 +318,6 @@ static int tegra20_ac97_platform_probe(struct platform_device *pdev)
         ac97 = devm_kzalloc(&pdev->dev, sizeof(struct tegra20_ac97),
                             GFP_KERNEL);
         if (!ac97) {
-                dev_err(&pdev->dev, "Can't allocate tegra20_ac97\n");
                 ret = -ENOMEM;
                 goto err;
         }
diff --git a/sound/soc/tegra/tegra20_das.c b/sound/soc/tegra/tegra20_das.c
index 89add13c31cf..4024e3abbeed 100644
--- a/sound/soc/tegra/tegra20_das.c
+++ b/sound/soc/tegra/tegra20_das.c
@@ -41,6 +41,7 @@ static inline void tegra20_das_write(u32 reg, u32 val)
 static inline u32 tegra20_das_read(u32 reg)
 {
         u32 val;
+
         regmap_read(das->regmap, reg, &val);
         return val;
 }
@@ -142,7 +143,6 @@ static int tegra20_das_probe(struct platform_device *pdev)
 
         das = devm_kzalloc(&pdev->dev, sizeof(struct tegra20_das), GFP_KERNEL);
         if (!das) {
-                dev_err(&pdev->dev, "Can't allocate tegra20_das\n");
                 ret = -ENOMEM;
                 goto err;
         }
diff --git a/sound/soc/tegra/tegra20_i2s.c b/sound/soc/tegra/tegra20_i2s.c
index 14106fa82bca..26253c2849e7 100644
--- a/sound/soc/tegra/tegra20_i2s.c
+++ b/sound/soc/tegra/tegra20_i2s.c
@@ -345,7 +345,6 @@ static int tegra20_i2s_platform_probe(struct platform_device *pdev)
 
         i2s = devm_kzalloc(&pdev->dev, sizeof(struct tegra20_i2s), GFP_KERNEL);
         if (!i2s) {
-                dev_err(&pdev->dev, "Can't allocate tegra20_i2s\n");
                 ret = -ENOMEM;
                 goto err;
         }
diff --git a/sound/soc/tegra/tegra20_spdif.c b/sound/soc/tegra/tegra20_spdif.c
index a0c3640572b9..767c0491e11a 100644
--- a/sound/soc/tegra/tegra20_spdif.c
+++ b/sound/soc/tegra/tegra20_spdif.c
@@ -271,10 +271,9 @@ static int tegra20_spdif_platform_probe(struct platform_device *pdev)
 
         spdif = devm_kzalloc(&pdev->dev, sizeof(struct tegra20_spdif),
                              GFP_KERNEL);
-        if (!spdif) {
-                dev_err(&pdev->dev, "Can't allocate tegra20_spdif\n");
+        if (!spdif)
                 return -ENOMEM;
-        }
+
         dev_set_drvdata(&pdev->dev, spdif);
 
         spdif->clk_spdif_out = devm_clk_get(&pdev->dev, "spdif_out");
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index fef3b9a21a66..8c10ae7982ba 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -41,6 +41,7 @@ static inline void tegra30_apbif_write(u32 reg, u32 val)
 static inline u32 tegra30_apbif_read(u32 reg)
 {
         u32 val;
+
         regmap_read(ahub->regmap_apbif, reg, &val);
         return val;
 }
@@ -560,10 +561,8 @@ static int tegra30_ahub_probe(struct platform_device *pdev)
 
         ahub = devm_kzalloc(&pdev->dev, sizeof(struct tegra30_ahub),
                             GFP_KERNEL);
-        if (!ahub) {
-                dev_err(&pdev->dev, "Can't allocate tegra30_ahub\n");
+        if (!ahub)
                 return -ENOMEM;
-        }
         dev_set_drvdata(&pdev->dev, ahub);
 
         ahub->soc_data = soc_data;
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 8e55583aa104..b2b279c96029 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -385,7 +385,6 @@ static int tegra30_i2s_platform_probe(struct platform_device *pdev)
 
         i2s = devm_kzalloc(&pdev->dev, sizeof(struct tegra30_i2s), GFP_KERNEL);
         if (!i2s) {
-                dev_err(&pdev->dev, "Can't allocate tegra30_i2s\n");
                 ret = -ENOMEM;
                 goto err;
         }
diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c
index eead6e7f205b..0509902512cc 100644
--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -169,10 +169,8 @@ static int tegra_alc5632_probe(struct platform_device *pdev)
 
         alc5632 = devm_kzalloc(&pdev->dev,
                         sizeof(struct tegra_alc5632), GFP_KERNEL);
-        if (!alc5632) {
-                dev_err(&pdev->dev, "Can't allocate tegra_alc5632\n");
+        if (!alc5632)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_max98090.c b/sound/soc/tegra/tegra_max98090.c
index a403db6d563e..c34a54d6e812 100644
--- a/sound/soc/tegra/tegra_max98090.c
+++ b/sound/soc/tegra/tegra_max98090.c
@@ -225,10 +225,8 @@ static int tegra_max98090_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev,
                         sizeof(struct tegra_max98090), GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_max98090\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c
index 25b9fc03ba62..93a356802345 100644
--- a/sound/soc/tegra/tegra_rt5640.c
+++ b/sound/soc/tegra/tegra_rt5640.c
@@ -170,10 +170,8 @@ static int tegra_rt5640_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev,
                         sizeof(struct tegra_rt5640), GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_rt5640\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
index 4bbab098f50b..6dda01f69983 100644
--- a/sound/soc/tegra/tegra_sgtl5000.c
+++ b/sound/soc/tegra/tegra_sgtl5000.c
@@ -120,10 +120,8 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev, sizeof(struct tegra_sgtl5000),
                                GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_sgtl5000 struct\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_wm8753.c b/sound/soc/tegra/tegra_wm8753.c
index bdedd1028569..d0ab0026a4cd 100644
--- a/sound/soc/tegra/tegra_wm8753.c
+++ b/sound/soc/tegra/tegra_wm8753.c
@@ -128,10 +128,8 @@ static int tegra_wm8753_driver_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev, sizeof(struct tegra_wm8753),
                                GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_wm8753 struct\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index 2013e9c4bba0..dbfb49298ae8 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -248,10 +248,8 @@ static int tegra_wm8903_driver_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev, sizeof(struct tegra_wm8903),
                                GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_wm8903 struct\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/tegra_wm9712.c b/sound/soc/tegra/tegra_wm9712.c
index 6492f8143ff1..c9cd22432627 100644
--- a/sound/soc/tegra/tegra_wm9712.c
+++ b/sound/soc/tegra/tegra_wm9712.c
@@ -77,10 +77,8 @@ static int tegra_wm9712_driver_probe(struct platform_device *pdev)
 
         machine = devm_kzalloc(&pdev->dev, sizeof(struct tegra_wm9712),
                                GFP_KERNEL);
-        if (!machine) {
-                dev_err(&pdev->dev, "Can't allocate tegra_wm9712 struct\n");
+        if (!machine)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/tegra/trimslice.c b/sound/soc/tegra/trimslice.c
index 870f84ab5005..c9dcad9bb931 100644
--- a/sound/soc/tegra/trimslice.c
+++ b/sound/soc/tegra/trimslice.c
@@ -123,10 +123,8 @@ static int tegra_snd_trimslice_probe(struct platform_device *pdev)
 
         trimslice = devm_kzalloc(&pdev->dev, sizeof(struct tegra_trimslice),
                                  GFP_KERNEL);
-        if (!trimslice) {
-                dev_err(&pdev->dev, "Can't allocate tegra_trimslice\n");
+        if (!trimslice)
                 return -ENOMEM;
-        }
 
         card->dev = &pdev->dev;
         platform_set_drvdata(pdev, card);
diff --git a/sound/soc/txx9/txx9aclc.c b/sound/soc/txx9/txx9aclc.c
index a8f705bb60dc..7912bf09dc4d 100644
--- a/sound/soc/txx9/txx9aclc.c
+++ b/sound/soc/txx9/txx9aclc.c
@@ -206,7 +206,7 @@ static void txx9aclc_dma_tasklet(unsigned long data)
 static int txx9aclc_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
         struct txx9aclc_dmadata *dmadata = substream->runtime->private_data;
-        struct txx9aclc_plat_drvdata *drvdata =txx9aclc_drvdata;
+        struct txx9aclc_plat_drvdata *drvdata = txx9aclc_drvdata;
         void __iomem *base = drvdata->base;
         unsigned long flags;
         int ret = 0;
@@ -340,7 +340,7 @@ static bool filter(struct dma_chan *chan, void *param)
 static int txx9aclc_dma_init(struct txx9aclc_soc_device *dev,
                              struct txx9aclc_dmadata *dmadata)
 {
-        struct txx9aclc_plat_drvdata *drvdata =txx9aclc_drvdata;
+        struct txx9aclc_plat_drvdata *drvdata = txx9aclc_drvdata;
         struct txx9dmac_slave *ds = &dmadata->dma_slave;
         dma_cap_mask_t mask;
 
@@ -392,6 +392,7 @@ static int txx9aclc_pcm_remove(struct snd_soc_platform *platform)
         for (i = 0; i < 2; i++) {
                 struct txx9aclc_dmadata *dmadata = &dev->dmadata[i];
                 struct dma_chan *chan = dmadata->dma_chan;
+
                 if (chan) {
                         dmadata->frag_count = -1;
                         dmaengine_terminate_all(chan);
diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
index ba9fc099cf67..b50f68a439ce 100644
--- a/sound/soc/ux500/mop500.c
+++ b/sound/soc/ux500/mop500.c
@@ -33,7 +33,6 @@ static struct snd_soc_dai_link mop500_dai_links[] = {
                 .stream_name = "ab8500_0",
                 .cpu_dai_name = "ux500-msp-i2s.1",
                 .codec_dai_name = "ab8500-codec-dai.0",
-                .platform_name = "ux500-msp-i2s.1",
                 .codec_name = "ab8500-codec.0",
                 .init = mop500_ab8500_machine_init,
                 .ops = mop500_ab8500_ops,
@@ -43,7 +42,6 @@ static struct snd_soc_dai_link mop500_dai_links[] = {
                 .stream_name = "ab8500_1",
                 .cpu_dai_name = "ux500-msp-i2s.3",
                 .codec_dai_name = "ab8500-codec-dai.1",
-                .platform_name = "ux500-msp-i2s.3",
                 .codec_name = "ab8500-codec.0",
                 .init = NULL,
                 .ops = mop500_ab8500_ops,
@@ -87,8 +85,6 @@ static int mop500_of_probe(struct platform_device *pdev,
         for (i = 0; i < 2; i++) {
                 mop500_dai_links[i].cpu_of_node = msp_np[i];
                 mop500_dai_links[i].cpu_dai_name = NULL;
-                mop500_dai_links[i].platform_of_node = msp_np[i];
-                mop500_dai_links[i].platform_name = NULL;
                 mop500_dai_links[i].codec_of_node = codec_np;
                 mop500_dai_links[i].codec_name = NULL;
         }
diff --git a/sound/soc/ux500/ux500_msp_dai.c b/sound/soc/ux500/ux500_msp_dai.c
index b343efd9be5b..ec5152aa3f6e 100644
--- a/sound/soc/ux500/ux500_msp_dai.c
+++ b/sound/soc/ux500/ux500_msp_dai.c
@@ -133,6 +133,7 @@ static int setup_pcm_framing(struct snd_soc_dai *dai, unsigned int rate,
         struct ux500_msp_i2s_drvdata *drvdata = dev_get_drvdata(dai->dev);
 
         u32 frame_length = MSP_FRAME_LEN_1;
+
         prot_desc->frame_width = 0;
 
         switch (drvdata->slots) {
@@ -482,7 +483,8 @@ static int ux500_msp_dai_prepare(struct snd_pcm_substream *substream,
         if ((drvdata->fmt & SND_SOC_DAIFMT_MASTER_MASK) &&
                 (drvdata->msp->f_bitclk > 19200000)) {
                 /* If the bit-clock is higher than 19.2MHz, Vape should be
-                 * run in 100% OPP. Only when bit-clock is used (MSP master) */
+                 * run in 100% OPP. Only when bit-clock is used (MSP master)
+                 */
                 prcmu_qos_update_requirement(PRCMU_QOS_APE_OPP,
                                         "ux500-msp-i2s", 100);
                 drvdata->vape_opp_constraint = 1;
diff --git a/sound/soc/ux500/ux500_msp_i2s.c b/sound/soc/ux500/ux500_msp_i2s.c
index 959d7b4edf56..bd5266aca0f1 100644
--- a/sound/soc/ux500/ux500_msp_i2s.c
+++ b/sound/soc/ux500/ux500_msp_i2s.c
@@ -604,7 +604,6 @@ int ux500_msp_i2s_trigger(struct ux500_msp *msp, int cmd, int direction)
                 break;
         default:
                 return -EINVAL;
-                break;
         }
 
         return 0;
diff --git a/sound/soc/zte/Kconfig b/sound/soc/zte/Kconfig
index 6d8a90d36315..75f67a5d23ea 100644
--- a/sound/soc/zte/Kconfig
+++ b/sound/soc/zte/Kconfig
@@ -15,3 +15,11 @@ config ZX_I2S
         help
           Say Y or M if you want to add support for codecs attached to the
           ZTE ZX I2S interface
+
+config ZX_TDM
+        tristate "ZTE ZX TDM Driver Support"
+        depends on COMMON_CLK
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        help
+          Say Y or M if you want to add support for codecs attached to the
+          ZTE ZX TDM interface
diff --git a/sound/soc/zte/Makefile b/sound/soc/zte/Makefile
index 77768f5fd10c..1fc841acdfdd 100644
--- a/sound/soc/zte/Makefile
+++ b/sound/soc/zte/Makefile
@@ -1,2 +1,3 @@
 obj-$(CONFIG_ZX_SPDIF)  += zx-spdif.o
 obj-$(CONFIG_ZX_I2S)    += zx-i2s.o
+obj-$(CONFIG_ZX_TDM)    += zx-tdm.o
diff --git a/sound/soc/zte/zx-tdm.c b/sound/soc/zte/zx-tdm.c
new file mode 100644
index 000000000000..bd632cc503b3
--- /dev/null
+++ b/sound/soc/zte/zx-tdm.c
@@ -0,0 +1,461 @@
+/*
+ * ZTE's TDM driver
+ *
+ * Copyright (C) 2017 ZTE Ltd
+ *
+ * Author: Baoyou Xie <baoyou.xie@linaro.org>
+ *
+ * License terms: GNU General Public License (GPL) version 2
+ */
+
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/mfd/syscon.h>
+#include <linux/module.h>
+#include <sound/dmaengine_pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+
+#define REG_TIMING_CTRL         0x04
+#define REG_TX_FIFO_CTRL        0x0C
+#define REG_RX_FIFO_CTRL        0x10
+#define REG_INT_EN              0x1C
+#define REG_INT_STATUS          0x20
+#define REG_DATABUF             0x24
+#define REG_TS_MASK0            0x44
+#define REG_PROCESS_CTRL        0x54
+
+#define FIFO_CTRL_TX_RST        BIT(0)
+#define FIFO_CTRL_RX_RST        BIT(0)
+#define DEAGULT_FIFO_THRES      GENMASK(4, 2)
+
+#define FIFO_CTRL_TX_DMA_EN     BIT(1)
+#define FIFO_CTRL_RX_DMA_EN     BIT(1)
+
+#define TX_FIFO_RST_MASK        BIT(0)
+#define RX_FIFO_RST_MASK        BIT(0)
+
+#define FIFOCTRL_TX_FIFO_RST    BIT(0)
+#define FIFOCTRL_RX_FIFO_RST    BIT(0)
+
+#define TXTH_MASK               GENMASK(5, 2)
+#define RXTH_MASK               GENMASK(5, 2)
+
+#define FIFOCTRL_THRESHOLD(x)   ((x) << 2)
+
+#define TIMING_MS_MASK          BIT(1)
+/*
+ * 00: 8 clk cycles every timeslot
+ * 01: 16 clk cycles every timeslot
+ * 10: 32 clk cycles every timeslot
+ */
+#define TIMING_SYNC_WIDTH_MASK  GENMASK(6, 5)
+#define TIMING_WIDTH_SHIFT      5
+#define TIMING_DEFAULT_WIDTH    0
+#define TIMING_TS_WIDTH(x)      ((x) << TIMING_WIDTH_SHIFT)
+#define TIMING_WIDTH_FACTOR     8
+
+#define TIMING_MASTER_MODE      BIT(21)
+#define TIMING_LSB_FIRST        BIT(20)
+#define TIMING_TS_NUM(x)        (((x) - 1) << 7)
+#define TIMING_CLK_SEL_MASK     GENMASK(2, 0)
+#define TIMING_CLK_SEL_DEF      BIT(2)
+
+#define PROCESS_TX_EN           BIT(0)
+#define PROCESS_RX_EN           BIT(1)
+#define PROCESS_TDM_EN          BIT(2)
+#define PROCESS_DISABLE_ALL     0
+
+#define INT_DISABLE_ALL         0
+#define INT_STATUS_MASK         GENMASK(6, 0)
+
+struct zx_tdm_info {
+        struct snd_dmaengine_dai_dma_data       dma_playback;
+        struct snd_dmaengine_dai_dma_data       dma_capture;
+        resource_size_t                         phy_addr;
+        void __iomem                            *regbase;
+        struct clk                              *dai_wclk;
+        struct clk                              *dai_pclk;
+        int                                     master;
+        struct device                           *dev;
+};
+
+static inline u32 zx_tdm_readl(struct zx_tdm_info *tdm, u16 reg)
+{
+        return readl_relaxed(tdm->regbase + reg);
+}
+
+static inline void zx_tdm_writel(struct zx_tdm_info *tdm, u16 reg, u32 val)
+{
+        writel_relaxed(val, tdm->regbase + reg);
+}
+
+static void zx_tdm_tx_en(struct zx_tdm_info *tdm, bool on)
+{
+        unsigned long val;
+
+        val = zx_tdm_readl(tdm, REG_PROCESS_CTRL);
+        if (on)
+                val |= PROCESS_TX_EN | PROCESS_TDM_EN;
+        else
+                val &= ~(PROCESS_TX_EN | PROCESS_TDM_EN);
+        zx_tdm_writel(tdm, REG_PROCESS_CTRL, val);
+}
+
+static void zx_tdm_rx_en(struct zx_tdm_info *tdm, bool on)
+{
+        unsigned long val;
+
+        val = zx_tdm_readl(tdm, REG_PROCESS_CTRL);
+        if (on)
+                val |= PROCESS_RX_EN | PROCESS_TDM_EN;
+        else
+                val &= ~(PROCESS_RX_EN | PROCESS_TDM_EN);
+        zx_tdm_writel(tdm, REG_PROCESS_CTRL, val);
+}
+
+static void zx_tdm_tx_dma_en(struct zx_tdm_info *tdm, bool on)
+{
+        unsigned long val;
+
+        val = zx_tdm_readl(tdm, REG_TX_FIFO_CTRL);
+        val |= FIFO_CTRL_TX_RST | DEAGULT_FIFO_THRES;
+        if (on)
+                val |= FIFO_CTRL_TX_DMA_EN;
+        else
+                val &= ~FIFO_CTRL_TX_DMA_EN;
+        zx_tdm_writel(tdm, REG_TX_FIFO_CTRL, val);
+}
+
+static void zx_tdm_rx_dma_en(struct zx_tdm_info *tdm, bool on)
+{
+        unsigned long val;
+
+        val = zx_tdm_readl(tdm, REG_RX_FIFO_CTRL);
+        val |= FIFO_CTRL_RX_RST | DEAGULT_FIFO_THRES;
+        if (on)
+                val |= FIFO_CTRL_RX_DMA_EN;
+        else
+                val &= ~FIFO_CTRL_RX_DMA_EN;
+        zx_tdm_writel(tdm, REG_RX_FIFO_CTRL, val);
+}
+
+#define ZX_TDM_RATES    (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000)
+
+#define ZX_TDM_FMTBIT \
+        (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_MU_LAW | \
+        SNDRV_PCM_FORMAT_A_LAW)
+
+static int zx_tdm_dai_probe(struct snd_soc_dai *dai)
+{
+        struct zx_tdm_info *zx_tdm = dev_get_drvdata(dai->dev);
+
+        snd_soc_dai_set_drvdata(dai, zx_tdm);
+        zx_tdm->dma_playback.addr = zx_tdm->phy_addr + REG_DATABUF;
+        zx_tdm->dma_playback.maxburst = 16;
+        zx_tdm->dma_capture.addr = zx_tdm->phy_addr + REG_DATABUF;
+        zx_tdm->dma_capture.maxburst = 16;
+        snd_soc_dai_init_dma_data(dai, &zx_tdm->dma_playback,
+                                  &zx_tdm->dma_capture);
+        return 0;
+}
+
+static int zx_tdm_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
+{
+        struct zx_tdm_info *tdm = snd_soc_dai_get_drvdata(cpu_dai);
+        unsigned long val;
+
+        val = zx_tdm_readl(tdm, REG_TIMING_CTRL);
+        val &= ~(TIMING_SYNC_WIDTH_MASK | TIMING_MS_MASK);
+        val |= TIMING_DEFAULT_WIDTH << TIMING_WIDTH_SHIFT;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                tdm->master = 1;
+                val |= TIMING_MASTER_MODE;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                tdm->master = 0;
+                val &= ~TIMING_MASTER_MODE;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Unknown master/slave format\n");
+                return -EINVAL;
+        }
+
+
+        zx_tdm_writel(tdm, REG_TIMING_CTRL, val);
+
+        return 0;
+}
+
+static int zx_tdm_hw_params(struct snd_pcm_substream *substream,
+                            struct snd_pcm_hw_params *params,
+                            struct snd_soc_dai *socdai)
+{
+        struct zx_tdm_info *tdm = snd_soc_dai_get_drvdata(socdai);
+        struct snd_dmaengine_dai_dma_data *dma_data;
+        unsigned int ts_width = TIMING_DEFAULT_WIDTH;
+        unsigned int ch_num = 32;
+        unsigned int mask = 0;
+        unsigned int ret = 0;
+        unsigned long val;
+
+        dma_data = snd_soc_dai_get_dma_data(socdai, substream);
+        dma_data->addr_width = ch_num >> 3;
+
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_MU_LAW:
+        case SNDRV_PCM_FORMAT_A_LAW:
+        case SNDRV_PCM_FORMAT_S16_LE:
+                ts_width = 1;
+                break;
+        default:
+                ts_width = 0;
+                dev_err(socdai->dev, "Unknown data format\n");
+                return -EINVAL;
+        }
+
+        val = zx_tdm_readl(tdm, REG_TIMING_CTRL);
+        val |= TIMING_TS_WIDTH(ts_width) | TIMING_TS_NUM(1);
+        zx_tdm_writel(tdm, REG_TIMING_CTRL, val);
+        zx_tdm_writel(tdm, REG_TS_MASK0, mask);
+
+        if (tdm->master)
+                ret = clk_set_rate(tdm->dai_wclk,
+                        params_rate(params) * TIMING_WIDTH_FACTOR * ch_num);
+
+        return ret;
+}
+
+static int zx_tdm_trigger(struct snd_pcm_substream *substream, int cmd,
+                          struct snd_soc_dai *dai)
+{
+        int capture = (substream->stream == SNDRV_PCM_STREAM_CAPTURE);
+        struct zx_tdm_info *zx_tdm = dev_get_drvdata(dai->dev);
+        unsigned int val;
+        int ret = 0;
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+                if (capture) {
+                        val = zx_tdm_readl(zx_tdm, REG_RX_FIFO_CTRL);
+                        val |= FIFOCTRL_RX_FIFO_RST;
+                        zx_tdm_writel(zx_tdm, REG_RX_FIFO_CTRL, val);
+
+                        zx_tdm_rx_dma_en(zx_tdm, true);
+                } else {
+                        val = zx_tdm_readl(zx_tdm, REG_TX_FIFO_CTRL);
+                        val |= FIFOCTRL_TX_FIFO_RST;
+                        zx_tdm_writel(zx_tdm, REG_TX_FIFO_CTRL, val);
+
+                        zx_tdm_tx_dma_en(zx_tdm, true);
+                }
+                break;
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                if (capture)
+                        zx_tdm_rx_en(zx_tdm, true);
+                else
+                        zx_tdm_tx_en(zx_tdm, true);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+                if (capture)
+                        zx_tdm_rx_dma_en(zx_tdm, false);
+                else
+                        zx_tdm_tx_dma_en(zx_tdm, false);
+                break;
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (capture)
+                        zx_tdm_rx_en(zx_tdm, false);
+                else
+                        zx_tdm_tx_en(zx_tdm, false);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        return ret;
+}
+
+static int zx_tdm_startup(struct snd_pcm_substream *substream,
+                          struct snd_soc_dai *dai)
+{
+        struct zx_tdm_info *zx_tdm = dev_get_drvdata(dai->dev);
+        int ret;
+
+        ret = clk_prepare_enable(zx_tdm->dai_wclk);
+        if (ret)
+                return ret;
+
+        ret = clk_prepare_enable(zx_tdm->dai_pclk);
+        if (ret) {
+                clk_disable_unprepare(zx_tdm->dai_wclk);
+                return ret;
+        }
+
+        return 0;
+}
+
+static void zx_tdm_shutdown(struct snd_pcm_substream *substream,
+                            struct snd_soc_dai *dai)
+{
+        struct zx_tdm_info *zx_tdm = dev_get_drvdata(dai->dev);
+
+        clk_disable_unprepare(zx_tdm->dai_pclk);
+        clk_disable_unprepare(zx_tdm->dai_wclk);
+}
+
+static struct snd_soc_dai_ops zx_tdm_dai_ops = {
+        .trigger        = zx_tdm_trigger,
+        .hw_params      = zx_tdm_hw_params,
+        .set_fmt        = zx_tdm_set_fmt,
+        .startup        = zx_tdm_startup,
+        .shutdown       = zx_tdm_shutdown,
+};
+
+static const struct snd_soc_component_driver zx_tdm_component = {
+        .name                   = "zx-tdm",
+};
+
+static void zx_tdm_init_state(struct zx_tdm_info *tdm)
+{
+        unsigned int val;
+
+        zx_tdm_writel(tdm, REG_PROCESS_CTRL, PROCESS_DISABLE_ALL);
+
+        val = zx_tdm_readl(tdm, REG_TIMING_CTRL);
+        val |= TIMING_LSB_FIRST;
+        val &= ~TIMING_CLK_SEL_MASK;
+        val |= TIMING_CLK_SEL_DEF;
+        zx_tdm_writel(tdm, REG_TIMING_CTRL, val);
+
+        zx_tdm_writel(tdm, REG_INT_EN, INT_DISABLE_ALL);
+        /*
+         * write INT_STATUS register to clear it.
+         */
+        zx_tdm_writel(tdm, REG_INT_STATUS, INT_STATUS_MASK);
+        zx_tdm_writel(tdm, REG_RX_FIFO_CTRL, FIFOCTRL_RX_FIFO_RST);
+        zx_tdm_writel(tdm, REG_TX_FIFO_CTRL, FIFOCTRL_TX_FIFO_RST);
+
+        val = zx_tdm_readl(tdm, REG_RX_FIFO_CTRL);
+        val &= ~(RXTH_MASK | RX_FIFO_RST_MASK);
+        val |= FIFOCTRL_THRESHOLD(8);
+        zx_tdm_writel(tdm, REG_RX_FIFO_CTRL, val);
+
+        val = zx_tdm_readl(tdm, REG_TX_FIFO_CTRL);
+        val &= ~(TXTH_MASK | TX_FIFO_RST_MASK);
+        val |= FIFOCTRL_THRESHOLD(8);
+        zx_tdm_writel(tdm, REG_TX_FIFO_CTRL, val);
+}
+
+static struct snd_soc_dai_driver zx_tdm_dai = {
+        .name   = "zx-tdm-dai",
+        .id     = 0,
+        .probe  = zx_tdm_dai_probe,
+        .playback   = {
+                .channels_min   = 1,
+                .channels_max   = 4,
+                .rates          = ZX_TDM_RATES,
+                .formats        = ZX_TDM_FMTBIT,
+        },
+        .capture = {
+                .channels_min   = 1,
+                .channels_max   = 4,
+                .rates          = ZX_TDM_RATES,
+                .formats        = ZX_TDM_FMTBIT,
+        },
+        .ops    = &zx_tdm_dai_ops,
+};
+
+static int zx_tdm_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct of_phandle_args out_args;
+        unsigned int dma_reg_offset;
+        struct zx_tdm_info *zx_tdm;
+        unsigned int dma_mask;
+        struct resource *res;
+        struct regmap *regmap_sysctrl;
+        int ret;
+
+        zx_tdm = devm_kzalloc(&pdev->dev, sizeof(*zx_tdm), GFP_KERNEL);
+        if (!zx_tdm)
+                return -ENOMEM;
+
+        zx_tdm->dev = dev;
+
+        zx_tdm->dai_wclk = devm_clk_get(&pdev->dev, "wclk");
+        if (IS_ERR(zx_tdm->dai_wclk)) {
+                dev_err(&pdev->dev, "Fail to get wclk\n");
+                return PTR_ERR(zx_tdm->dai_wclk);
+        }
+
+        zx_tdm->dai_pclk = devm_clk_get(&pdev->dev, "pclk");
+        if (IS_ERR(zx_tdm->dai_pclk)) {
+                dev_err(&pdev->dev, "Fail to get pclk\n");
+                return PTR_ERR(zx_tdm->dai_pclk);
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        zx_tdm->phy_addr = res->start;
+        zx_tdm->regbase = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(zx_tdm->regbase))
+                return PTR_ERR(zx_tdm->regbase);
+
+        ret = of_parse_phandle_with_fixed_args(pdev->dev.of_node,
+                                "zte,tdm-dma-sysctrl", 2, 0, &out_args);
+        if (ret) {
+                dev_err(&pdev->dev, "Fail to get zte,tdm-dma-sysctrl\n");
+                return ret;
+        }
+
+        dma_reg_offset = out_args.args[0];
+        dma_mask = out_args.args[1];
+        regmap_sysctrl = syscon_node_to_regmap(out_args.np);
+        if (IS_ERR(regmap_sysctrl)) {
+                of_node_put(out_args.np);
+                return PTR_ERR(regmap_sysctrl);
+        }
+
+        regmap_update_bits(regmap_sysctrl, dma_reg_offset, dma_mask, dma_mask);
+        of_node_put(out_args.np);
+
+        zx_tdm_init_state(zx_tdm);
+        platform_set_drvdata(pdev, zx_tdm);
+
+        ret = devm_snd_soc_register_component(&pdev->dev, &zx_tdm_component,
+                                                &zx_tdm_dai, 1);
+        if (ret) {
+                dev_err(&pdev->dev, "Register DAI failed: %d\n", ret);
+                return ret;
+        }
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+        if (ret)
+                dev_err(&pdev->dev, "Register platform PCM failed: %d\n", ret);
+
+        return ret;
+}
+
+static const struct of_device_id zx_tdm_dt_ids[] = {
+        { .compatible = "zte,zx296718-tdm", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, zx_tdm_dt_ids);
+
+static struct platform_driver tdm_driver = {
+        .probe = zx_tdm_probe,
+        .driver = {
+                .name = "zx-tdm",
+                .of_match_table = zx_tdm_dt_ids,
+        },
+};
+module_platform_driver(tdm_driver);
+
+MODULE_AUTHOR("Baoyou Xie <baoyou.xie@linaro.org>");
+MODULE_DESCRIPTION("ZTE TDM DAI driver");
+MODULE_LICENSE("GPL v2");
diff --git a/tools/include/linux/filter.h b/tools/include/linux/filter.h
index 122153b16ea4..390d7c9685fd 100644
--- a/tools/include/linux/filter.h
+++ b/tools/include/linux/filter.h
@@ -168,6 +168,16 @@
                 .off   = OFF,                                   \
                 .imm   = 0 })
 
+/* Atomic memory add, *(uint *)(dst_reg + off16) += src_reg */
+
+#define BPF_STX_XADD(SIZE, DST, SRC, OFF)                       \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,   \
+                .dst_reg = DST,                                 \
+                .src_reg = SRC,                                 \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Memory store, *(uint *) (dst_reg + off16) = imm32 */
 
 #define BPF_ST_MEM(SIZE, DST, OFF, IMM)                         \
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 273f21fa32b5..7aa57225cbf7 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -130,6 +130,12 @@ static struct arch architectures[] = {
                 .name = "powerpc",
                 .init = powerpc__annotate_init,
         },
+        {
+                .name = "s390",
+                .objdump =  {
+                        .comment_char = '#',
+                },
+        },
 };
 
 static void ins__delete(struct ins_operands *ops)
diff --git a/tools/power/cpupower/utils/helpers/cpuid.c b/tools/power/cpupower/utils/helpers/cpuid.c
index 93b0aa74ca03..39c2c7d067bb 100644
--- a/tools/power/cpupower/utils/helpers/cpuid.c
+++ b/tools/power/cpupower/utils/helpers/cpuid.c
@@ -156,6 +156,7 @@ out:
                                          */
                         case 0x2C:      /* Westmere EP - Gulftown */
                                 cpu_info->caps |= CPUPOWER_CAP_HAS_TURBO_RATIO;
+                                break;
                         case 0x2A:      /* SNB */
                         case 0x2D:      /* SNB Xeon */
                         case 0x3A:      /* IVB */
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index fedca3285326..ccf2a69365cc 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -100,6 +100,8 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBCPU%c1, CPU%c3, CPU%c6, CPU%c7\fP show the percentage residency in hardware core idle states.  These numbers are from hardware residency counters.
 \fBCoreTmp\fP Degrees Celsius reported by the per-core Digital Thermal Sensor.
 \fBPkgTtmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
+\fBGFX%rc6\fP The percentage of time the GPU is in the "render C6" state, rc6, during the measurement interval. From /sys/class/drm/card0/power/rc6_residency_ms.
+\fBGFXMHz\fP Instantaneous snapshot of what sysfs presents at the end of the measurement interval. From /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz.
 \fBPkg%pc2, Pkg%pc3, Pkg%pc6, Pkg%pc7\fP percentage residency in hardware package idle states.  These numbers are from hardware residency counters.
 \fBPkgWatt\fP Watts consumed by the whole package.
 \fBCorWatt\fP Watts consumed by the core part of the package.
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 828dccd3f01e..b11294730771 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1142,7 +1142,7 @@ delta_thread(struct thread_data *new, struct thread_data *old,
                  * it is possible for mperf's non-halted cycles + idle states
                  * to exceed TSC's all cycles: show c1 = 0% in that case.
                  */
-                if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > old->tsc)
+                if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > (old->tsc * tsc_tweak))
                         old->c1 = 0;
                 else {
                         /* normal case, derive c1 */
@@ -2485,8 +2485,10 @@ int snapshot_gfx_mhz(void)
 
         if (fp == NULL)
                 fp = fopen_or_die("/sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz", "r");
-        else
+        else {
                 rewind(fp);
+                fflush(fp);
+        }
 
         retval = fscanf(fp, "%d", &gfx_cur_mhz);
         if (retval != 1)
@@ -3111,7 +3113,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return 0;
 
         fprintf(outf, "cpu%d: MSR_HWP_CAPABILITIES: 0x%08llx "
-                        "(high 0x%x guar 0x%x eff 0x%x low 0x%x)\n",
+                        "(high %d guar %d eff %d low %d)\n",
                         cpu, msr,
                         (unsigned int)HWP_HIGHEST_PERF(msr),
                         (unsigned int)HWP_GUARANTEED_PERF(msr),
@@ -3122,7 +3124,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return 0;
 
         fprintf(outf, "cpu%d: MSR_HWP_REQUEST: 0x%08llx "
-                        "(min 0x%x max 0x%x des 0x%x epp 0x%x window 0x%x pkg 0x%x)\n",
+                        "(min %d max %d des %d epp 0x%x window 0x%x pkg 0x%x)\n",
                         cpu, msr,
                         (unsigned int)(((msr) >> 0) & 0xff),
                         (unsigned int)(((msr) >> 8) & 0xff),
@@ -3136,7 +3138,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                         return 0;
 
                 fprintf(outf, "cpu%d: MSR_HWP_REQUEST_PKG: 0x%08llx "
-                        "(min 0x%x max 0x%x des 0x%x epp 0x%x window 0x%x)\n",
+                        "(min %d max %d des %d epp 0x%x window 0x%x)\n",
                         cpu, msr,
                         (unsigned int)(((msr) >> 0) & 0xff),
                         (unsigned int)(((msr) >> 8) & 0xff),
@@ -3353,17 +3355,19 @@ void rapl_probe(unsigned int family, unsigned int model)
         case INTEL_FAM6_SKYLAKE_DESKTOP:        /* SKL */
         case INTEL_FAM6_KABYLAKE_MOBILE:        /* KBL */
         case INTEL_FAM6_KABYLAKE_DESKTOP:       /* KBL */
-                do_rapl = RAPL_PKG | RAPL_DRAM | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_PKG_POWER_INFO;
+                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_CORE_POLICY | RAPL_DRAM | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_GFX | RAPL_PKG_POWER_INFO;
                 BIC_PRESENT(BIC_PKG__);
                 BIC_PRESENT(BIC_RAM__);
                 if (rapl_joules) {
                         BIC_PRESENT(BIC_Pkg_J);
                         BIC_PRESENT(BIC_Cor_J);
                         BIC_PRESENT(BIC_RAM_J);
+                        BIC_PRESENT(BIC_GFX_J);
                 } else {
                         BIC_PRESENT(BIC_PkgWatt);
                         BIC_PRESENT(BIC_CorWatt);
                         BIC_PRESENT(BIC_RAMWatt);
+                        BIC_PRESENT(BIC_GFXWatt);
                 }
                 break;
         case INTEL_FAM6_HASWELL_X:      /* HSX */
@@ -3478,7 +3482,7 @@ void perf_limit_reasons_probe(unsigned int family, unsigned int model)
 int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
-        unsigned int dts;
+        unsigned int dts, dts2;
         int cpu;
 
         if (!(do_dts || do_ptm))
@@ -3503,7 +3507,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 fprintf(outf, "cpu%d: MSR_IA32_PACKAGE_THERM_STATUS: 0x%08llx (%d C)\n",
                         cpu, msr, tcc_activation_temp - dts);
 
-#ifdef  THERM_DEBUG
                 if (get_msr(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, &msr))
                         return 0;
 
@@ -3511,11 +3514,10 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 dts2 = (msr >> 8) & 0x7F;
                 fprintf(outf, "cpu%d: MSR_IA32_PACKAGE_THERM_INTERRUPT: 0x%08llx (%d C, %d C)\n",
                         cpu, msr, tcc_activation_temp - dts, tcc_activation_temp - dts2);
-#endif
         }
 
 
-        if (do_dts) {
+        if (do_dts && debug) {
                 unsigned int resolution;
 
                 if (get_msr(cpu, MSR_IA32_THERM_STATUS, &msr))
@@ -3526,7 +3528,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 fprintf(outf, "cpu%d: MSR_IA32_THERM_STATUS: 0x%08llx (%d C +/- %d)\n",
                         cpu, msr, tcc_activation_temp - dts, resolution);
 
-#ifdef THERM_DEBUG
                 if (get_msr(cpu, MSR_IA32_THERM_INTERRUPT, &msr))
                         return 0;
 
@@ -3534,7 +3535,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 dts2 = (msr >> 8) & 0x7F;
                 fprintf(outf, "cpu%d: MSR_IA32_THERM_INTERRUPT: 0x%08llx (%d C, %d C)\n",
                         cpu, msr, tcc_activation_temp - dts, tcc_activation_temp - dts2);
-#endif
         }
 
         return 0;
@@ -4578,7 +4578,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 17.02.24"
+        fprintf(outf, "turbostat version 17.04.12"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 67531f47781b..9af09e8099c0 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -1,22 +1,30 @@
 LIBDIR := ../../../lib
-BPFOBJ := $(LIBDIR)/bpf/bpf.o
+BPFDIR := $(LIBDIR)/bpf
+APIDIR := ../../../include/uapi
+GENDIR := ../../../../include/generated
+GENHDR := $(GENDIR)/autoconf.h
 
-CFLAGS += -Wall -O2 -lcap -I../../../include/uapi -I$(LIBDIR) $(BPFOBJ)
+ifneq ($(wildcard $(GENHDR)),)
+  GENFLAGS := -DHAVE_GENHDR
+endif
+
+CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS)
+LDLIBS += -lcap
 
 TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map
 
 TEST_PROGS := test_kmod.sh
 
-all: $(TEST_GEN_PROGS)
+include ../lib.mk
+
+BPFOBJ := $(OUTPUT)/bpf.o
+
+$(TEST_GEN_PROGS): $(BPFOBJ)
 
-.PHONY: all clean force
+.PHONY: force
 
 # force a rebuild of BPFOBJ when its dependencies are updated
 force:
 
 $(BPFOBJ): force
-        $(MAKE) -C $(dir $(BPFOBJ))
-
-$(test_objs): $(BPFOBJ)
-
-include ../lib.mk
+        $(MAKE) -C $(BPFDIR) OUTPUT=$(OUTPUT)/
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index cada17ac00b8..20f1871874df 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -80,8 +80,9 @@ static void test_hashmap(int task, void *data)
         assert(bpf_map_update_elem(fd, &key, &value, BPF_EXIST) == 0);
         key = 2;
         assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
-        key = 1;
-        assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
+        key = 3;
+        assert(bpf_map_update_elem(fd, &key, &value, BPF_NOEXIST) == -1 &&
+               errno == E2BIG);
 
         /* Check that key = 0 doesn't exist. */
         key = 0;
@@ -110,6 +111,24 @@ static void test_hashmap(int task, void *data)
         close(fd);
 }
 
+static void test_hashmap_sizes(int task, void *data)
+{
+        int fd, i, j;
+
+        for (i = 1; i <= 512; i <<= 1)
+                for (j = 1; j <= 1 << 18; j <<= 1) {
+                        fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j,
+                                            2, map_flags);
+                        if (fd < 0) {
+                                printf("Failed to create hashmap key=%d value=%d '%s'\n",
+                                       i, j, strerror(errno));
+                                exit(1);
+                        }
+                        close(fd);
+                        usleep(10); /* give kernel time to destroy */
+                }
+}
+
 static void test_hashmap_percpu(int task, void *data)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
@@ -263,7 +282,7 @@ static void test_arraymap_percpu(int task, void *data)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
         int key, next_key, fd, i;
-        long values[nr_cpus];
+        long long values[nr_cpus];
 
         fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
                             sizeof(values[0]), 2, 0);
@@ -317,8 +336,11 @@ static void test_arraymap_percpu(int task, void *data)
 static void test_arraymap_percpu_many_keys(void)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
-        unsigned int nr_keys = 20000;
-        long values[nr_cpus];
+        /* nr_keys is not too large otherwise the test stresses percpu
+         * allocator more than anything else
+         */
+        unsigned int nr_keys = 2000;
+        long long values[nr_cpus];
         int key, fd, i;
 
         fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
@@ -419,6 +441,7 @@ static void test_map_stress(void)
 {
         run_parallel(100, test_hashmap, NULL);
         run_parallel(100, test_hashmap_percpu, NULL);
+        run_parallel(100, test_hashmap_sizes, NULL);
 
         run_parallel(100, test_arraymap, NULL);
         run_parallel(100, test_arraymap_percpu, NULL);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index d1555e4240c0..c848e90b6421 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -30,6 +30,14 @@
 
 #include <bpf/bpf.h>
 
+#ifdef HAVE_GENHDR
+# include "autoconf.h"
+#else
+# if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
+#  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
+# endif
+#endif
+
 #include "../../../include/linux/filter.h"
 
 #ifndef ARRAY_SIZE
@@ -39,6 +47,8 @@
 #define MAX_INSNS       512
 #define MAX_FIXUPS      8
 
+#define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
+
 struct bpf_test {
         const char *descr;
         struct bpf_insn insns[MAX_INSNS];
@@ -53,6 +63,7 @@ struct bpf_test {
                 REJECT
         } result, result_unpriv;
         enum bpf_prog_type prog_type;
+        uint8_t flags;
 };
 
 /* Note we want this to be 64 bit aligned so that the end of our array is
@@ -2432,6 +2443,30 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "direct packet access: test15 (spill with xadd)",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
+                        BPF_MOV64_IMM(BPF_REG_5, 4096),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
+                        BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 invalid mem access 'inv'",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
                 "helper access to packet: test1, valid packet_ptr range",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -2934,6 +2969,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "valid map access into an array with a variable",
@@ -2957,6 +2993,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "valid map access into an array with a signed variable",
@@ -2984,6 +3021,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a constant",
@@ -3025,6 +3063,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is outside of the array range",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a variable",
@@ -3048,6 +3087,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with no floor check",
@@ -3074,6 +3114,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a invalid max check",
@@ -3100,6 +3141,7 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a invalid max check",
@@ -3129,6 +3171,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "multiple registers share map_lookup_elem result",
@@ -3252,6 +3295,7 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "constant register |= constant should keep constant type",
@@ -3418,6 +3462,26 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
         },
         {
+                "overlapping checks for direct packet access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+        },
+        {
                 "invalid access of tc_classid for LWT_IN",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
@@ -3961,7 +4025,208 @@ static struct bpf_test tests[] = {
                 .result_unpriv = REJECT,
         },
         {
-                "map element value (adjusted) is preserved across register spilling",
+                "map element value or null is marked on register spilling",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 leaks addr",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value store of cleared call register",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R1 !read_ok",
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value with unaligned store",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
+                        BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
+                        BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "map element value with unaligned load",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
+                        BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "map element value illegal alu op, 1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_MOV64_IMM(BPF_REG_3, 4096),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 invalid mem access 'inv'",
+                .errstr = "R0 invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value is preserved across register spilling",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
@@ -3983,6 +4248,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result = ACCEPT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
@@ -4421,6 +4687,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result = REJECT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid range check",
@@ -4452,6 +4719,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result = REJECT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         }
 };
 
@@ -4530,11 +4798,11 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
 static void do_test_single(struct bpf_test *test, bool unpriv,
                            int *passes, int *errors)
 {
+        int fd_prog, expected_ret, reject_from_alignment;
         struct bpf_insn *prog = test->insns;
         int prog_len = probe_filter_length(prog);
         int prog_type = test->prog_type;
         int fd_f1 = -1, fd_f2 = -1, fd_f3 = -1;
-        int fd_prog, expected_ret;
         const char *expected_err;
 
         do_test_fixup(test, prog, &fd_f1, &fd_f2, &fd_f3);
@@ -4547,8 +4815,19 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
                        test->result_unpriv : test->result;
         expected_err = unpriv && test->errstr_unpriv ?
                        test->errstr_unpriv : test->errstr;
+
+        reject_from_alignment = fd_prog < 0 &&
+                                (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
+                                strstr(bpf_vlog, "Unknown alignment.");
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+        if (reject_from_alignment) {
+                printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
+                       strerror(errno));
+                goto fail_log;
+        }
+#endif
         if (expected_ret == ACCEPT) {
-                if (fd_prog < 0) {
+                if (fd_prog < 0 && !reject_from_alignment) {
                         printf("FAIL\nFailed to load prog '%s'!\n",
                                strerror(errno));
                         goto fail_log;
@@ -4558,14 +4837,15 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
                         printf("FAIL\nUnexpected success to load!\n");
                         goto fail_log;
                 }
-                if (!strstr(bpf_vlog, expected_err)) {
+                if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
                         printf("FAIL\nUnexpected error message!\n");
                         goto fail_log;
                 }
         }
 
         (*passes)++;
-        printf("OK\n");
+        printf("OK%s\n", reject_from_alignment ?
+               " (NOTE: reject due to unknown alignment)" : "");
 close_fds:
         close(fd_prog);
         close(fd_f1);
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
new file mode 100644
index 000000000000..bab5ff7c607e
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
@@ -0,0 +1,117 @@
+#!/bin/sh
+# description: ftrace - function pid filters
+
+# Make sure that function pid matching filter works.
+# Also test it on an instance directory
+
+if ! grep -q function available_tracers; then
+    echo "no function tracer configured"
+    exit_unsupported
+fi
+
+if [ ! -f set_ftrace_pid ]; then
+    echo "set_ftrace_pid not found? Is function tracer not set?"
+    exit_unsupported
+fi
+
+if [ ! -f set_ftrace_filter ]; then
+    echo "set_ftrace_filter not found? Is function tracer not set?"
+    exit_unsupported
+fi
+
+do_function_fork=1
+
+if [ ! -f options/function-fork ]; then
+    do_function_fork=0
+    echo "no option for function-fork found. Option will not be tested."
+fi
+
+read PID _ < /proc/self/stat
+
+if [ $do_function_fork -eq 1 ]; then
+    # default value of function-fork option
+    orig_value=`grep function-fork trace_options`
+fi
+
+do_reset() {
+    reset_tracer
+    clear_trace
+    enable_tracing
+    echo > set_ftrace_filter
+    echo > set_ftrace_pid
+
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+
+    echo $orig_value > trace_options
+}
+
+fail() { # msg
+    do_reset
+    echo $1
+    exit $FAIL
+}
+
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
+}
+
+do_test() {
+    disable_tracing
+
+    echo do_execve* > set_ftrace_filter
+    echo *do_fork >> set_ftrace_filter
+
+    echo $PID > set_ftrace_pid
+    echo function > current_tracer
+
+    if [ $do_function_fork -eq 1 ]; then
+        # don't allow children to be traced
+        echo nofunction-fork > trace_options
+    fi
+
+    enable_tracing
+    yield
+
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+
+    # count_other should be 0
+    if [ $count_pid -eq 0 -o $count_other -ne 0 ]; then
+        fail "PID filtering not working?"
+    fi
+
+    disable_tracing
+    clear_trace
+
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+
+    # allow children to be traced
+    echo function-fork > trace_options
+
+    enable_tracing
+    yield
+
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+
+    # count_other should NOT be 0
+    if [ $count_pid -eq 0 -o $count_other -eq 0 ]; then
+        fail "PID filtering not following fork?"
+    fi
+}
+
+do_test
+
+mkdir instances/foo
+cd instances/foo
+do_test
+cd ../../
+rmdir instances/foo
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 412459369686..e62bb354820c 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -75,7 +75,7 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
 {
         int fd, val;
 
-        fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP));
+        fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP));
         if (fd < 0) {
                 perror("socket packet");
                 exit(1);
@@ -95,6 +95,24 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
         return fd;
 }
 
+static void sock_fanout_set_cbpf(int fd)
+{
+        struct sock_filter bpf_filter[] = {
+                BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 80),           /* ldb [80] */
+                BPF_STMT(BPF_RET+BPF_A, 0),                   /* ret A */
+        };
+        struct sock_fprog bpf_prog;
+
+        bpf_prog.filter = bpf_filter;
+        bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
+
+        if (setsockopt(fd, SOL_PACKET, PACKET_FANOUT_DATA, &bpf_prog,
+                       sizeof(bpf_prog))) {
+                perror("fanout data cbpf");
+                exit(1);
+        }
+}
+
 static void sock_fanout_set_ebpf(int fd)
 {
         const int len_off = __builtin_offsetof(struct __sk_buff, len);
@@ -270,7 +288,7 @@ static int test_datapath(uint16_t typeflags, int port_off,
                 exit(1);
         }
         if (type == PACKET_FANOUT_CBPF)
-                sock_setfilter(fds[0], SOL_PACKET, PACKET_FANOUT_DATA);
+                sock_fanout_set_cbpf(fds[0]);
         else if (type == PACKET_FANOUT_EBPF)
                 sock_fanout_set_ebpf(fds[0]);
 
diff --git a/tools/testing/selftests/net/psock_lib.h b/tools/testing/selftests/net/psock_lib.h
index a77da88bf946..7d990d6c861b 100644
--- a/tools/testing/selftests/net/psock_lib.h
+++ b/tools/testing/selftests/net/psock_lib.h
@@ -38,7 +38,7 @@
 # define __maybe_unused         __attribute__ ((__unused__))
 #endif
 
-static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
+static __maybe_unused void pair_udp_setfilter(int fd)
 {
         /* the filter below checks for all of the following conditions that
          * are based on the contents of create_payload()
@@ -76,23 +76,16 @@ static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
         };
         struct sock_fprog bpf_prog;
 
-        if (lvl == SOL_PACKET && optnum == PACKET_FANOUT_DATA)
-                bpf_filter[5].code = 0x16;   /* RET A                         */
-
         bpf_prog.filter = bpf_filter;
         bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
-        if (setsockopt(fd, lvl, optnum, &bpf_prog,
+
+        if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &bpf_prog,
                        sizeof(bpf_prog))) {
                 perror("setsockopt SO_ATTACH_FILTER");
                 exit(1);
         }
 }
 
-static __maybe_unused void pair_udp_setfilter(int fd)
-{
-        sock_setfilter(fd, SOL_SOCKET, SO_ATTACH_FILTER);
-}
-
 static __maybe_unused void pair_udp_open(int fds[], uint16_t port)
 {
         struct sockaddr_in saddr, daddr;
diff --git a/tools/testing/selftests/powerpc/Makefile b/tools/testing/selftests/powerpc/Makefile
index 1c5d0575802e..bf13fc2297aa 100644
--- a/tools/testing/selftests/powerpc/Makefile
+++ b/tools/testing/selftests/powerpc/Makefile
@@ -34,34 +34,34 @@ endif
 all: $(SUB_DIRS)
 
 $(SUB_DIRS):
-        BUILD_TARGET=$$OUTPUT/$@; mkdir -p $$BUILD_TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -k -C $@ all
+        BUILD_TARGET=$(OUTPUT)/$@; mkdir -p $$BUILD_TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -k -C $@ all
 
 include ../lib.mk
 
 override define RUN_TESTS
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests;\
         done;
 endef
 
 override define INSTALL_RULE
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install;\
         done;
 endef
 
 override define EMIT_TESTS
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests;\
         done;
 endef
 
 clean:
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean; \
         done;
         rm -f tags
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 276139a24e6f..702f8108608d 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -392,6 +392,25 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
 }
 
 /**
+ * kvm_vgic_init_cpu_hardware - initialize the GIC VE hardware
+ *
+ * For a specific CPU, initialize the GIC VE hardware.
+ */
+void kvm_vgic_init_cpu_hardware(void)
+{
+        BUG_ON(preemptible());
+
+        /*
+         * We want to make sure the list registers start out clear so that we
+         * only have the program the used registers.
+         */
+        if (kvm_vgic_global_state.type == VGIC_V2)
+                vgic_v2_init_lrs();
+        else
+                kvm_call_hyp(__vgic_v3_init_lrs);
+}
+
+/**
  * kvm_vgic_hyp_init: populates the kvm_vgic_global_state variable
  * according to the host GIC model. Accordingly calls either
  * vgic_v2/v3_probe which registers the KVM_DEVICE that can be
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index a3ad7ff95c9b..0a4283ed9aa7 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -229,7 +229,15 @@ static unsigned long vgic_mmio_read_vcpuif(struct kvm_vcpu *vcpu,
                 val = vmcr.ctlr;
                 break;
         case GIC_CPU_PRIMASK:
-                val = vmcr.pmr;
+                /*
+                 * Our KVM_DEV_TYPE_ARM_VGIC_V2 device ABI exports the
+                 * the PMR field as GICH_VMCR.VMPriMask rather than
+                 * GICC_PMR.Priority, so we expose the upper five bits of
+                 * priority mask to userspace using the lower bits in the
+                 * unsigned long.
+                 */
+                val = (vmcr.pmr & GICV_PMR_PRIORITY_MASK) >>
+                        GICV_PMR_PRIORITY_SHIFT;
                 break;
         case GIC_CPU_BINPOINT:
                 val = vmcr.bpr;
@@ -262,7 +270,15 @@ static void vgic_mmio_write_vcpuif(struct kvm_vcpu *vcpu,
                 vmcr.ctlr = val;
                 break;
         case GIC_CPU_PRIMASK:
-                vmcr.pmr = val;
+                /*
+                 * Our KVM_DEV_TYPE_ARM_VGIC_V2 device ABI exports the
+                 * the PMR field as GICH_VMCR.VMPriMask rather than
+                 * GICC_PMR.Priority, so we expose the upper five bits of
+                 * priority mask to userspace using the lower bits in the
+                 * unsigned long.
+                 */
+                vmcr.pmr = (val << GICV_PMR_PRIORITY_SHIFT) &
+                        GICV_PMR_PRIORITY_MASK;
                 break;
         case GIC_CPU_BINPOINT:
                 vmcr.bpr = val;
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index b834ecdf3225..b637d9c7afe3 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -36,6 +36,21 @@ static unsigned long *u64_to_bitmask(u64 *val)
         return (unsigned long *)val;
 }
 
+static inline void vgic_v2_write_lr(int lr, u32 val)
+{
+        void __iomem *base = kvm_vgic_global_state.vctrl_base;
+
+        writel_relaxed(val, base + GICH_LR0 + (lr * 4));
+}
+
+void vgic_v2_init_lrs(void)
+{
+        int i;
+
+        for (i = 0; i < kvm_vgic_global_state.nr_lr; i++)
+                vgic_v2_write_lr(i, 0);
+}
+
 void vgic_v2_process_maintenance(struct kvm_vcpu *vcpu)
 {
         struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -191,8 +206,8 @@ void vgic_v2_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
                 GICH_VMCR_ALIAS_BINPOINT_MASK;
         vmcr |= (vmcrp->bpr << GICH_VMCR_BINPOINT_SHIFT) &
                 GICH_VMCR_BINPOINT_MASK;
-        vmcr |= (vmcrp->pmr << GICH_VMCR_PRIMASK_SHIFT) &
-                GICH_VMCR_PRIMASK_MASK;
+        vmcr |= ((vmcrp->pmr >> GICV_PMR_PRIORITY_SHIFT) <<
+                 GICH_VMCR_PRIMASK_SHIFT) & GICH_VMCR_PRIMASK_MASK;
 
         vcpu->arch.vgic_cpu.vgic_v2.vgic_vmcr = vmcr;
 }
@@ -207,8 +222,8 @@ void vgic_v2_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
                         GICH_VMCR_ALIAS_BINPOINT_SHIFT;
         vmcrp->bpr  = (vmcr & GICH_VMCR_BINPOINT_MASK) >>
                         GICH_VMCR_BINPOINT_SHIFT;
-        vmcrp->pmr  = (vmcr & GICH_VMCR_PRIMASK_MASK) >>
-                        GICH_VMCR_PRIMASK_SHIFT;
+        vmcrp->pmr  = ((vmcr & GICH_VMCR_PRIMASK_MASK) >>
+                        GICH_VMCR_PRIMASK_SHIFT) << GICV_PMR_PRIORITY_SHIFT;
 }
 
 void vgic_v2_enable(struct kvm_vcpu *vcpu)
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index db28f7cadab2..6cf557e9f718 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -81,11 +81,18 @@ static inline bool irq_is_pending(struct vgic_irq *irq)
                 return irq->pending_latch || irq->line_level;
 }
 
+/*
+ * This struct provides an intermediate representation of the fields contained
+ * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC
+ * state to userspace can generate either GICv2 or GICv3 CPU interface
+ * registers regardless of the hardware backed GIC used.
+ */
 struct vgic_vmcr {
         u32     ctlr;
         u32     abpr;
         u32     bpr;
-        u32     pmr;
+        u32     pmr;  /* Priority mask field in the GICC_PMR and
+                       * ICC_PMR_EL1 priority field format */
         /* Below member variable are valid only for GICv3 */
         u32     grpen0;
         u32     grpen1;
@@ -130,6 +137,8 @@ int vgic_v2_map_resources(struct kvm *kvm);
 int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
                              enum vgic_type);
 
+void vgic_v2_init_lrs(void);
+
 static inline void vgic_get_irq_kref(struct vgic_irq *irq)
 {
         if (irq->intid < VGIC_MIN_LPI)
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index a29786dd9522..4d28a9ddbee0 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -870,7 +870,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
                         continue;
 
                 kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-                kvm->buses[bus_idx]->ioeventfd_count--;
+                if (kvm->buses[bus_idx])
+                        kvm->buses[bus_idx]->ioeventfd_count--;
                 ioeventfd_release(p);
                 ret = 0;
                 break;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a17d78759727..88257b311cb5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -727,8 +727,11 @@ static void kvm_destroy_vm(struct kvm *kvm)
         list_del(&kvm->vm_list);
         spin_unlock(&kvm_lock);
         kvm_free_irq_routing(kvm);
-        for (i = 0; i < KVM_NR_BUSES; i++)
-                kvm_io_bus_destroy(kvm->buses[i]);
+        for (i = 0; i < KVM_NR_BUSES; i++) {
+                if (kvm->buses[i])
+                        kvm_io_bus_destroy(kvm->buses[i]);
+                kvm->buses[i] = NULL;
+        }
         kvm_coalesced_mmio_free(kvm);
 #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
         mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
@@ -1062,7 +1065,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
          * changes) is disallowed above, so any other attribute changes getting
          * here can be skipped.
          */
-        if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
+        if (as_id == 0 && (change == KVM_MR_CREATE || change == KVM_MR_MOVE)) {
                 r = kvm_iommu_map_pages(kvm, &new);
                 return r;
         }
@@ -3474,6 +3477,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_write(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3491,6 +3496,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
 
         /* First try the device referenced by cookie. */
         if ((cookie >= 0) && (cookie < bus->dev_count) &&
@@ -3541,6 +3548,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_read(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3553,6 +3562,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
+        if (!bus)
+                return -ENOMEM;
+
         /* exclude ioeventfd which is limited by maximum fd */
         if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
                 return -ENOSPC;
@@ -3572,37 +3584,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 }
 
 /* Caller must hold slots_lock. */
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev)
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev)
 {
-        int i, r;
+        int i;
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
-        r = -ENOENT;
+        if (!bus)
+                return;
+
         for (i = 0; i < bus->dev_count; i++)
                 if (bus->range[i].dev == dev) {
-                        r = 0;
                         break;
                 }
 
-        if (r)
-                return r;
+        if (i == bus->dev_count)
+                return;
 
         new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
                           sizeof(struct kvm_io_range)), GFP_KERNEL);
-        if (!new_bus)
-                return -ENOMEM;
+        if (!new_bus)  {
+                pr_err("kvm: failed to shrink bus, removing it completely\n");
+                goto broken;
+        }
 
         memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
         new_bus->dev_count--;
         memcpy(new_bus->range + i, bus->range + i + 1,
                (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
 
+broken:
         rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
         synchronize_srcu_expedited(&kvm->srcu);
         kfree(bus);
-        return r;
+        return;
 }
 
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
@@ -3615,6 +3631,8 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
         srcu_idx = srcu_read_lock(&kvm->srcu);
 
         bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
+        if (!bus)
+                goto out_unlock;
 
         dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
         if (dev_idx < 0)