617 files changed, 8864 insertions, 3860 deletions

diff --git a/Documentation/CodeOfConflict b/Documentation/CodeOfConflict
new file mode 100644
index 000000000000..1684d0b4efa6
--- /dev/null
+++ b/Documentation/CodeOfConflict
@@ -0,0 +1,27 @@
+Code of Conflict
+----------------
+
+The Linux kernel development effort is a very personal process compared
+to "traditional" ways of developing software.  Your code and ideas
+behind it will be carefully reviewed, often resulting in critique and
+criticism.  The review will almost always require improvements to the
+code before it can be included in the kernel.  Know that this happens
+because everyone involved wants to see the best possible solution for
+the overall success of Linux.  This development process has been proven
+to create the most robust operating system kernel ever, and we do not
+want to do anything to cause the quality of submission and eventual
+result to ever decrease.
+
+If however, anyone feels personally abused, threatened, or otherwise
+uncomfortable due to this process, that is not acceptable.  If so,
+please contact the Linux Foundation's Technical Advisory Board at
+<tab@lists.linux-foundation.org>, or the individual members, and they
+will work to resolve the issue to the best of their ability.  For more
+information on who is on the Technical Advisory Board and what their
+role is, please see:
+        http://www.linuxfoundation.org/programs/advisory-councils/tab
+
+As a reviewer of code, please strive to keep things civil and focused on
+the technical issues involved.  We are all humans, and frustrations can
+be high on both sides of the process.  Try to keep in mind the immortal
+words of Bill and Ted, "Be excellent to each other."
diff --git a/Documentation/cgroups/unified-hierarchy.txt b/Documentation/cgroups/unified-hierarchy.txt
index 71daa35ec2d9..eb102fb72213 100644
--- a/Documentation/cgroups/unified-hierarchy.txt
+++ b/Documentation/cgroups/unified-hierarchy.txt
@@ -404,8 +404,8 @@ supported and the interface files "release_agent" and
   be understood as an underflow into the highest possible value, -2 or
   -10M etc. do not work, so it's not consistent.
 
-  memory.low, memory.high, and memory.max will use the string
-  "infinity" to indicate and set the highest possible value.
+  memory.low, memory.high, and memory.max will use the string "max" to
+  indicate and set the highest possible value.
 
 5. Planned Changes
 
diff --git a/Documentation/devicetree/bindings/i2c/i2c-imx.txt b/Documentation/devicetree/bindings/i2c/i2c-imx.txt
index 52d37fd8d3e5..ce4311d726ae 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-imx.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-imx.txt
@@ -7,6 +7,7 @@ Required properties:
   - "fsl,vf610-i2c" for I2C compatible with the one integrated on Vybrid vf610 SoC
 - reg : Should contain I2C/HS-I2C registers location and length
 - interrupts : Should contain I2C/HS-I2C interrupt
+- clocks : Should contain the I2C/HS-I2C clock specifier
 
 Optional properties:
 - clock-frequency : Constains desired I2C/HS-I2C bus clock frequency in Hz.
diff --git a/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt b/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
index 33df3932168e..8db32384a486 100644
--- a/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
+++ b/Documentation/devicetree/bindings/net/amd-xgbe-phy.txt
@@ -27,6 +27,8 @@ property is used.
 - amd,serdes-cdr-rate: CDR rate speed selection
 - amd,serdes-pq-skew: PQ (data sampling) skew
 - amd,serdes-tx-amp: TX amplitude boost
+- amd,serdes-dfe-tap-config: DFE taps available to run
+- amd,serdes-dfe-tap-enable: DFE taps to enable
 
 Example:
         xgbe_phy@e1240800 {
@@ -41,4 +43,6 @@ Example:
                 amd,serdes-cdr-rate = <2>, <2>, <7>;
                 amd,serdes-pq-skew = <10>, <10>, <30>;
                 amd,serdes-tx-amp = <15>, <15>, <10>;
+                amd,serdes-dfe-tap-config = <3>, <3>, <1>;
+                amd,serdes-dfe-tap-enable = <0>, <0>, <127>;
         };
diff --git a/Documentation/devicetree/bindings/net/apm-xgene-enet.txt b/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
index cfcc52705ed8..6151999c5dca 100644
--- a/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
+++ b/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
@@ -4,7 +4,10 @@ Ethernet nodes are defined to describe on-chip ethernet interfaces in
 APM X-Gene SoC.
 
 Required properties for all the ethernet interfaces:
-- compatible: Should be "apm,xgene-enet"
+- compatible: Should state binding information from the following list,
+  - "apm,xgene-enet":    RGMII based 1G interface
+  - "apm,xgene1-sgenet": SGMII based 1G interface
+  - "apm,xgene1-xgenet": XFI based 10G interface
 - reg: Address and length of the register set for the device. It contains the
   information of registers in the same order as described by reg-names
 - reg-names: Should contain the register set names
diff --git a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
index 7f76214f728a..289c40ed7470 100644
--- a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
+++ b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.txt
@@ -21,6 +21,18 @@ Optional properties:
 - reg-io-width : the size (in bytes) of the IO accesses that should be
   performed on the device.  If this property is not present then single byte
   accesses are used.
+- dcd-override : Override the DCD modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- dsr-override : Override the DTS modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- cts-override : Override the CTS modem status signal. This signal will always
+  be reported as active instead of being obtained from the modem status
+  register. Define this if your serial port does not use this pin.
+- ri-override : Override the RI modem status signal. This signal will always be
+  reported as inactive instead of being obtained from the modem status register.
+  Define this if your serial port does not use this pin.
 
 Example:
 
@@ -31,6 +43,10 @@ Example:
                 interrupts = <10>;
                 reg-shift = <2>;
                 reg-io-width = <4>;
+                dcd-override;
+                dsr-override;
+                cts-override;
+                ri-override;
         };
 
 Example with one clock:
diff --git a/Documentation/filesystems/dlmfs.txt b/Documentation/filesystems/dlmfs.txt
index 1b528b2ad809..fcf4d509d118 100644
--- a/Documentation/filesystems/dlmfs.txt
+++ b/Documentation/filesystems/dlmfs.txt
@@ -5,8 +5,8 @@ system.
 
 dlmfs is built with OCFS2 as it requires most of its infrastructure.
 
-Project web page:    http://oss.oracle.com/projects/ocfs2
-Tools web page:      http://oss.oracle.com/projects/ocfs2-tools
+Project web page:    http://ocfs2.wiki.kernel.org
+Tools web page:      https://github.com/markfasheh/ocfs2-tools
 OCFS2 mailing lists: http://oss.oracle.com/projects/ocfs2/mailman/
 
 All code copyright 2005 Oracle except when otherwise noted.
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index 28f8c08201e2..4c49e5410595 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -8,8 +8,8 @@ also make it attractive for non-clustered use.
 You'll want to install the ocfs2-tools package in order to at least
 get "mount.ocfs2" and "ocfs2_hb_ctl".
 
-Project web page:    http://oss.oracle.com/projects/ocfs2
-Tools web page:      http://oss.oracle.com/projects/ocfs2-tools
+Project web page:    http://ocfs2.wiki.kernel.org
+Tools git tree:      https://github.com/markfasheh/ocfs2-tools
 OCFS2 mailing lists: http://oss.oracle.com/projects/ocfs2/mailman/
 
 All code copyright 2005 Oracle except when otherwise noted.
diff --git a/Documentation/power/suspend-and-interrupts.txt b/Documentation/power/suspend-and-interrupts.txt
index 2f9c5a5fcb25..8afb29a8604a 100644
--- a/Documentation/power/suspend-and-interrupts.txt
+++ b/Documentation/power/suspend-and-interrupts.txt
@@ -40,8 +40,10 @@ but also to IPIs and to some other special-purpose interrupts.
 
 The IRQF_NO_SUSPEND flag is used to indicate that to the IRQ subsystem when
 requesting a special-purpose interrupt.  It causes suspend_device_irqs() to
-leave the corresponding IRQ enabled so as to allow the interrupt to work all
-the time as expected.
+leave the corresponding IRQ enabled so as to allow the interrupt to work as
+expected during the suspend-resume cycle, but does not guarantee that the
+interrupt will wake the system from a suspended state -- for such cases it is
+necessary to use enable_irq_wake().
 
 Note that the IRQF_NO_SUSPEND flag affects the entire IRQ and not just one
 user of it.  Thus, if the IRQ is shared, all of the interrupt handlers installed
@@ -110,8 +112,9 @@ any special interrupt handling logic for it to work.
 IRQF_NO_SUSPEND and enable_irq_wake()
 -------------------------------------
 
-There are no valid reasons to use both enable_irq_wake() and the IRQF_NO_SUSPEND
-flag on the same IRQ.
+There are very few valid reasons to use both enable_irq_wake() and the
+IRQF_NO_SUSPEND flag on the same IRQ, and it is never valid to use both for the
+same device.
 
 First of all, if the IRQ is not shared, the rules for handling IRQF_NO_SUSPEND
 interrupts (interrupt handlers are invoked after suspend_device_irqs()) are
@@ -120,4 +123,13 @@ handlers are not invoked after suspend_device_irqs()).
 
 Second, both enable_irq_wake() and IRQF_NO_SUSPEND apply to entire IRQs and not
 to individual interrupt handlers, so sharing an IRQ between a system wakeup
-interrupt source and an IRQF_NO_SUSPEND interrupt source does not make sense.
+interrupt source and an IRQF_NO_SUSPEND interrupt source does not generally
+make sense.
+
+In rare cases an IRQ can be shared between a wakeup device driver and an
+IRQF_NO_SUSPEND user. In order for this to be safe, the wakeup device driver
+must be able to discern spurious IRQs from genuine wakeup events (signalling
+the latter to the core with pm_system_wakeup()), must use enable_irq_wake() to
+ensure that the IRQ will function as a wakeup source, and must request the IRQ
+with IRQF_COND_SUSPEND to tell the core that it meets these requirements. If
+these requirements are not met, it is not valid to use IRQF_COND_SUSPEND.
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 71d10d7d141e..57d25fdd3d7e 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1975,15 +1975,25 @@ registers, find a list below:
   MIPS  | KVM_REG_MIPS_CP0_STATUS       | 32
   MIPS  | KVM_REG_MIPS_CP0_CAUSE        | 32
   MIPS  | KVM_REG_MIPS_CP0_EPC          | 64
+  MIPS  | KVM_REG_MIPS_CP0_PRID         | 32
   MIPS  | KVM_REG_MIPS_CP0_CONFIG       | 32
   MIPS  | KVM_REG_MIPS_CP0_CONFIG1      | 32
   MIPS  | KVM_REG_MIPS_CP0_CONFIG2      | 32
   MIPS  | KVM_REG_MIPS_CP0_CONFIG3      | 32
+  MIPS  | KVM_REG_MIPS_CP0_CONFIG4      | 32
+  MIPS  | KVM_REG_MIPS_CP0_CONFIG5      | 32
   MIPS  | KVM_REG_MIPS_CP0_CONFIG7      | 32
   MIPS  | KVM_REG_MIPS_CP0_ERROREPC     | 64
   MIPS  | KVM_REG_MIPS_COUNT_CTL        | 64
   MIPS  | KVM_REG_MIPS_COUNT_RESUME     | 64
   MIPS  | KVM_REG_MIPS_COUNT_HZ         | 64
+  MIPS  | KVM_REG_MIPS_FPR_32(0..31)    | 32
+  MIPS  | KVM_REG_MIPS_FPR_64(0..31)    | 64
+  MIPS  | KVM_REG_MIPS_VEC_128(0..31)   | 128
+  MIPS  | KVM_REG_MIPS_FCR_IR           | 32
+  MIPS  | KVM_REG_MIPS_FCR_CSR          | 32
+  MIPS  | KVM_REG_MIPS_MSA_IR           | 32
+  MIPS  | KVM_REG_MIPS_MSA_CSR          | 32
 
 ARM registers are mapped using the lower 32 bits.  The upper 16 of that
 is the register group type, or coprocessor number:
@@ -2037,6 +2047,25 @@ patterns depending on whether they're 32-bit or 64-bit registers:
 MIPS KVM control registers (see above) have the following id bit patterns:
   0x7030 0000 0002 <reg:16>
 
+MIPS FPU registers (see KVM_REG_MIPS_FPR_{32,64}() above) have the following
+id bit patterns depending on the size of the register being accessed. They are
+always accessed according to the current guest FPU mode (Status.FR and
+Config5.FRE), i.e. as the guest would see them, and they become unpredictable
+if the guest FPU mode is changed. MIPS SIMD Architecture (MSA) vector
+registers (see KVM_REG_MIPS_VEC_128() above) have similar patterns as they
+overlap the FPU registers:
+  0x7020 0000 0003 00 <0:3> <reg:5> (32-bit FPU registers)
+  0x7030 0000 0003 00 <0:3> <reg:5> (64-bit FPU registers)
+  0x7040 0000 0003 00 <0:3> <reg:5> (128-bit MSA vector registers)
+
+MIPS FPU control registers (see KVM_REG_MIPS_FCR_{IR,CSR} above) have the
+following id bit patterns:
+  0x7020 0000 0003 01 <0:3> <reg:5>
+
+MIPS MSA control registers (see KVM_REG_MIPS_MSA_{IR,CSR} above) have the
+following id bit patterns:
+  0x7020 0000 0003 02 <0:3> <reg:5>
+
 
 4.69 KVM_GET_ONE_REG
 
@@ -2728,6 +2757,110 @@ The fields in each entry are defined as follows:
    eax, ebx, ecx, edx: the values returned by the cpuid instruction for
          this function/index combination
 
+4.89 KVM_S390_MEM_OP
+
+Capability: KVM_CAP_S390_MEM_OP
+Architectures: s390
+Type: vcpu ioctl
+Parameters: struct kvm_s390_mem_op (in)
+Returns: = 0 on success,
+         < 0 on generic error (e.g. -EFAULT or -ENOMEM),
+         > 0 if an exception occurred while walking the page tables
+
+Read or write data from/to the logical (virtual) memory of a VPCU.
+
+Parameters are specified via the following structure:
+
+struct kvm_s390_mem_op {
+        __u64 gaddr;            /* the guest address */
+        __u64 flags;            /* flags */
+        __u32 size;             /* amount of bytes */
+        __u32 op;               /* type of operation */
+        __u64 buf;              /* buffer in userspace */
+        __u8 ar;                /* the access register number */
+        __u8 reserved[31];      /* should be set to 0 */
+};
+
+The type of operation is specified in the "op" field. It is either
+KVM_S390_MEMOP_LOGICAL_READ for reading from logical memory space or
+KVM_S390_MEMOP_LOGICAL_WRITE for writing to logical memory space. The
+KVM_S390_MEMOP_F_CHECK_ONLY flag can be set in the "flags" field to check
+whether the corresponding memory access would create an access exception
+(without touching the data in the memory at the destination). In case an
+access exception occurred while walking the MMU tables of the guest, the
+ioctl returns a positive error number to indicate the type of exception.
+This exception is also raised directly at the corresponding VCPU if the
+flag KVM_S390_MEMOP_F_INJECT_EXCEPTION is set in the "flags" field.
+
+The start address of the memory region has to be specified in the "gaddr"
+field, and the length of the region in the "size" field. "buf" is the buffer
+supplied by the userspace application where the read data should be written
+to for KVM_S390_MEMOP_LOGICAL_READ, or where the data that should be written
+is stored for a KVM_S390_MEMOP_LOGICAL_WRITE. "buf" is unused and can be NULL
+when KVM_S390_MEMOP_F_CHECK_ONLY is specified. "ar" designates the access
+register number to be used.
+
+The "reserved" field is meant for future extensions. It is not used by
+KVM with the currently defined set of flags.
+
+4.90 KVM_S390_GET_SKEYS
+
+Capability: KVM_CAP_S390_SKEYS
+Architectures: s390
+Type: vm ioctl
+Parameters: struct kvm_s390_skeys
+Returns: 0 on success, KVM_S390_GET_KEYS_NONE if guest is not using storage
+         keys, negative value on error
+
+This ioctl is used to get guest storage key values on the s390
+architecture. The ioctl takes parameters via the kvm_s390_skeys struct.
+
+struct kvm_s390_skeys {
+        __u64 start_gfn;
+        __u64 count;
+        __u64 skeydata_addr;
+        __u32 flags;
+        __u32 reserved[9];
+};
+
+The start_gfn field is the number of the first guest frame whose storage keys
+you want to get.
+
+The count field is the number of consecutive frames (starting from start_gfn)
+whose storage keys to get. The count field must be at least 1 and the maximum
+allowed value is defined as KVM_S390_SKEYS_ALLOC_MAX. Values outside this range
+will cause the ioctl to return -EINVAL.
+
+The skeydata_addr field is the address to a buffer large enough to hold count
+bytes. This buffer will be filled with storage key data by the ioctl.
+
+4.91 KVM_S390_SET_SKEYS
+
+Capability: KVM_CAP_S390_SKEYS
+Architectures: s390
+Type: vm ioctl
+Parameters: struct kvm_s390_skeys
+Returns: 0 on success, negative value on error
+
+This ioctl is used to set guest storage key values on the s390
+architecture. The ioctl takes parameters via the kvm_s390_skeys struct.
+See section on KVM_S390_GET_SKEYS for struct definition.
+
+The start_gfn field is the number of the first guest frame whose storage keys
+you want to set.
+
+The count field is the number of consecutive frames (starting from start_gfn)
+whose storage keys to get. The count field must be at least 1 and the maximum
+allowed value is defined as KVM_S390_SKEYS_ALLOC_MAX. Values outside this range
+will cause the ioctl to return -EINVAL.
+
+The skeydata_addr field is the address to a buffer containing count bytes of
+storage keys. Each byte in the buffer will be set as the storage key for a
+single frame starting at start_gfn for count frames.
+
+Note: If any architecturally invalid key value is found in the given data then
+the ioctl will return -EINVAL.
+
 5. The kvm_run structure
 ------------------------
 
@@ -3201,6 +3334,31 @@ Parameters: none
 This capability enables the in-kernel irqchip for s390. Please refer to
 "4.24 KVM_CREATE_IRQCHIP" for details.
 
+6.9 KVM_CAP_MIPS_FPU
+
+Architectures: mips
+Target: vcpu
+Parameters: args[0] is reserved for future use (should be 0).
+
+This capability allows the use of the host Floating Point Unit by the guest. It
+allows the Config1.FP bit to be set to enable the FPU in the guest. Once this is
+done the KVM_REG_MIPS_FPR_* and KVM_REG_MIPS_FCR_* registers can be accessed
+(depending on the current guest FPU register mode), and the Status.FR,
+Config5.FRE bits are accessible via the KVM API and also from the guest,
+depending on them being supported by the FPU.
+
+6.10 KVM_CAP_MIPS_MSA
+
+Architectures: mips
+Target: vcpu
+Parameters: args[0] is reserved for future use (should be 0).
+
+This capability allows the use of the MIPS SIMD Architecture (MSA) by the guest.
+It allows the Config3.MSAP bit to be set to enable the use of MSA by the guest.
+Once this is done the KVM_REG_MIPS_VEC_* and KVM_REG_MIPS_MSA_* registers can be
+accessed, and the Config5.MSAEn bit is accessible via the KVM API and also from
+the guest.
+
 7. Capabilities that can be enabled on VMs
 ------------------------------------------
 
@@ -3260,3 +3418,41 @@ All other orders will be handled completely in user space.
 Only privileged operation exceptions will be checked for in the kernel (or even
 in the hardware prior to interception). If this capability is not enabled, the
 old way of handling SIGP orders is used (partially in kernel and user space).
+
+7.3 KVM_CAP_S390_VECTOR_REGISTERS
+
+Architectures: s390
+Parameters: none
+Returns: 0 on success, negative value on error
+
+Allows use of the vector registers introduced with z13 processor, and
+provides for the synchronization between host and user space.  Will
+return -EINVAL if the machine does not support vectors.
+
+7.4 KVM_CAP_S390_USER_STSI
+
+Architectures: s390
+Parameters: none
+
+This capability allows post-handlers for the STSI instruction. After
+initial handling in the kernel, KVM exits to user space with
+KVM_EXIT_S390_STSI to allow user space to insert further data.
+
+Before exiting to userspace, kvm handlers should fill in s390_stsi field of
+vcpu->run:
+struct {
+        __u64 addr;
+        __u8 ar;
+        __u8 reserved;
+        __u8 fc;
+        __u8 sel1;
+        __u16 sel2;
+} s390_stsi;
+
+@addr - guest address of STSI SYSIB
+@fc   - function code
+@sel1 - selector 1
+@sel2 - selector 2
+@ar   - access register number
+
+KVM handlers should exit to userspace with rc = -EREMOTE.
diff --git a/MAINTAINERS b/MAINTAINERS
index ddc5a8cf9a8a..15e4015c5a2f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2065,7 +2065,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
-M:      Andy Gospodarek <andy@greyhouse.net>
+M:      Andy Gospodarek <gospo@cumulusnetworks.com>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -2369,8 +2369,9 @@ F:	arch/x86/include/asm/tce.h
 
 CAN NETWORK LAYER
 M:      Oliver Hartkopp <socketcan@hartkopp.net>
+M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
-W:      http://gitorious.org/linux-can
+W:      https://github.com/linux-can
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
@@ -2386,7 +2387,7 @@ CAN NETWORK DRIVERS
 M:      Wolfgang Grandegger <wg@grandegger.com>
 M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
-W:      http://gitorious.org/linux-can
+W:      https://github.com/linux-can
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
@@ -5574,6 +5575,8 @@ S:	Supported
 F:      Documentation/*/kvm*.txt
 F:      Documentation/virtual/kvm/
 F:      arch/*/kvm/
+F:      arch/x86/kernel/kvm.c
+F:      arch/x86/kernel/kvmclock.c
 F:      arch/*/include/asm/kvm*
 F:      include/linux/kvm*
 F:      include/uapi/linux/kvm*
@@ -7213,8 +7216,7 @@ ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
 M:      Mark Fasheh <mfasheh@suse.com>
 M:      Joel Becker <jlbec@evilplan.org>
 L:      ocfs2-devel@oss.oracle.com (moderated for non-subscribers)
-W:      http://oss.oracle.com/projects/ocfs2/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2.git
+W:      http://ocfs2.wiki.kernel.org
 S:      Supported
 F:      Documentation/filesystems/ocfs2.txt
 F:      Documentation/filesystems/dlmfs.txt
@@ -8481,6 +8483,14 @@ S:	Supported
 L:      netdev@vger.kernel.org
 F:      drivers/net/ethernet/samsung/sxgbe/
 
+SAMSUNG THERMAL DRIVER
+M:      Lukasz Majewski <l.majewski@samsung.com>
+L:      linux-pm@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org
+S:      Supported
+T:      https://github.com/lmajewski/linux-samsung-thermal.git
+F:      drivers/thermal/samsung/
+
 SAMSUNG USB2 PHY DRIVER
 M:      Kamil Debski <k.debski@samsung.com>
 L:      linux-kernel@vger.kernel.org
diff --git a/Makefile b/Makefile
index 9fab639727c7..1100ff3c77e3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
index 4e547296831d..52312cb5dbe2 100644
--- a/arch/arc/include/asm/processor.h
+++ b/arch/arc/include/asm/processor.h
@@ -47,9 +47,6 @@ struct thread_struct {
 /* Forward declaration, a strange C thing */
 struct task_struct;
 
-/* Return saved PC of a blocked thread  */
-unsigned long thread_saved_pc(struct task_struct *t);
-
 #define task_pt_regs(p) \
         ((struct pt_regs *)(THREAD_SIZE + (void *)task_stack_page(p)) - 1)
 
@@ -72,18 +69,21 @@ unsigned long thread_saved_pc(struct task_struct *t);
 #define release_segments(mm)        do { } while (0)
 
 #define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ret)
+#define KSTK_ESP(tsk)   (task_pt_regs(tsk)->sp)
 
 /*
  * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode.
  * Look in process.c for details of kernel stack layout
  */
-#define KSTK_ESP(tsk)   (tsk->thread.ksp)
+#define TSK_K_ESP(tsk)          (tsk->thread.ksp)
 
-#define KSTK_REG(tsk, off)      (*((unsigned int *)(KSTK_ESP(tsk) + \
+#define TSK_K_REG(tsk, off)     (*((unsigned int *)(TSK_K_ESP(tsk) + \
                                         sizeof(struct callee_regs) + off)))
 
-#define KSTK_BLINK(tsk) KSTK_REG(tsk, 4)
-#define KSTK_FP(tsk)    KSTK_REG(tsk, 0)
+#define TSK_K_BLINK(tsk)        TSK_K_REG(tsk, 4)
+#define TSK_K_FP(tsk)           TSK_K_REG(tsk, 0)
+
+#define thread_saved_pc(tsk)    TSK_K_BLINK(tsk)
 
 extern void start_thread(struct pt_regs * regs, unsigned long pc,
                          unsigned long usp);
diff --git a/arch/arc/include/asm/stacktrace.h b/arch/arc/include/asm/stacktrace.h
new file mode 100644
index 000000000000..b29b6064ea14
--- /dev/null
+++ b/arch/arc/include/asm/stacktrace.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2014-15 Synopsys, Inc. (www.synopsys.com)
+ * Copyright (C) 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __ASM_STACKTRACE_H
+#define __ASM_STACKTRACE_H
+
+#include <linux/sched.h>
+
+/**
+ * arc_unwind_core - Unwind the kernel mode stack for an execution context
+ * @tsk:                NULL for current task, specific task otherwise
+ * @regs:               pt_regs used to seed the unwinder {SP, FP, BLINK, PC}
+ *                      If NULL, use pt_regs of @tsk (if !NULL) otherwise
+ *                      use the current values of {SP, FP, BLINK, PC}
+ * @consumer_fn:        Callback invoked for each frame unwound
+ *                      Returns 0 to continue unwinding, -1 to stop
+ * @arg:                Arg to callback
+ *
+ * Returns the address of first function in stack
+ *
+ * Semantics:
+ *  - synchronous unwinding (e.g. dump_stack): @tsk  NULL, @regs  NULL
+ *  - Asynchronous unwinding of sleeping task: @tsk !NULL, @regs  NULL
+ *  - Asynchronous unwinding of intr/excp etc: @tsk !NULL, @regs !NULL
+ */
+notrace noinline unsigned int arc_unwind_core(
+        struct task_struct *tsk, struct pt_regs *regs,
+        int (*consumer_fn) (unsigned int, void *),
+        void *arg);
+
+#endif /* __ASM_STACKTRACE_H */
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index fdd89715d2d3..98c00a2d4dd9 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -192,29 +192,6 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *fpu)
         return 0;
 }
 
-/*
- * API: expected by schedular Code: If thread is sleeping where is that.
- * What is this good for? it will be always the scheduler or ret_from_fork.
- * So we hard code that anyways.
- */
-unsigned long thread_saved_pc(struct task_struct *t)
-{
-        struct pt_regs *regs = task_pt_regs(t);
-        unsigned long blink = 0;
-
-        /*
-         * If the thread being queried for in not itself calling this, then it
-         * implies it is not executing, which in turn implies it is sleeping,
-         * which in turn implies it got switched OUT by the schedular.
-         * In that case, it's kernel mode blink can reliably retrieved as per
-         * the picture above (right above pt_regs).
-         */
-        if (t != current && t->state != TASK_RUNNING)
-                blink = *((unsigned int *)regs - 1);
-
-        return blink;
-}
-
 int elf_check_arch(const struct elf32_hdr *x)
 {
         unsigned int eflags;
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 9ce47cfe2303..92320d6f737c 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -43,6 +43,10 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                                    struct pt_regs *regs,
                                    struct unwind_frame_info *frame_info)
 {
+        /*
+         * synchronous unwinding (e.g. dump_stack)
+         *  - uses current values of SP and friends
+         */
         if (tsk == NULL && regs == NULL) {
                 unsigned long fp, sp, blink, ret;
                 frame_info->task = current;
@@ -61,12 +65,17 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                 frame_info->regs.r63 = ret;
                 frame_info->call_frame = 0;
         } else if (regs == NULL) {
+                /*
+                 * Asynchronous unwinding of sleeping task
+                 *  - Gets SP etc from task's pt_regs (saved bottom of kernel
+                 *    mode stack of task)
+                 */
 
                 frame_info->task = tsk;
 
-                frame_info->regs.r27 = KSTK_FP(tsk);
-                frame_info->regs.r28 = KSTK_ESP(tsk);
-                frame_info->regs.r31 = KSTK_BLINK(tsk);
+                frame_info->regs.r27 = TSK_K_FP(tsk);
+                frame_info->regs.r28 = TSK_K_ESP(tsk);
+                frame_info->regs.r31 = TSK_K_BLINK(tsk);
                 frame_info->regs.r63 = (unsigned int)__switch_to;
 
                 /* In the prologue of __switch_to, first FP is saved on stack
@@ -83,6 +92,10 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
                 frame_info->call_frame = 0;
 
         } else {
+                /*
+                 * Asynchronous unwinding of intr/exception
+                 *  - Just uses the pt_regs passed
+                 */
                 frame_info->task = tsk;
 
                 frame_info->regs.r27 = regs->fp;
@@ -95,7 +108,7 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 
 #endif
 
-static noinline unsigned int
+notrace noinline unsigned int
 arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
                 int (*consumer_fn) (unsigned int, void *), void *arg)
 {
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index 7ff5b5c183bb..74db59b6f392 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/perf_event.h>
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
 #include <asm/disasm.h>
@@ -253,6 +254,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
                 }
         }
 
+        perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, address);
         return 0;
 
 fault:
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index 563cb27e37f5..6a2e006cbcce 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -14,6 +14,7 @@
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
+#include <linux/perf_event.h>
 #include <asm/pgalloc.h>
 #include <asm/mmu.h>
 
@@ -139,13 +140,20 @@ good_area:
                         return;
         }
 
+        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+
         if (likely(!(fault & VM_FAULT_ERROR))) {
                 if (flags & FAULT_FLAG_ALLOW_RETRY) {
                         /* To avoid updating stats twice for retry case */
-                        if (fault & VM_FAULT_MAJOR)
+                        if (fault & VM_FAULT_MAJOR) {
                                 tsk->maj_flt++;
-                        else
+                                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
+                                              regs, address);
+                        } else {
                                 tsk->min_flt++;
+                                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                              regs, address);
+                        }
 
                         if (fault & VM_FAULT_RETRY) {
                                 flags &= ~FAULT_FLAG_ALLOW_RETRY;
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 6cc25ed912ee..2c6248d9a9ef 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -195,6 +195,7 @@
 
 &usb0 {
         status = "okay";
+        dr_mode = "peripheral";
 };
 
 &usb1 {
diff --git a/arch/arm/boot/dts/am437x-idk-evm.dts b/arch/arm/boot/dts/am437x-idk-evm.dts
index f9a17e2ca8cb..0198f5a62b96 100644
--- a/arch/arm/boot/dts/am437x-idk-evm.dts
+++ b/arch/arm/boot/dts/am437x-idk-evm.dts
@@ -133,20 +133,6 @@
                 >;
         };
 
-        i2c1_pins_default: i2c1_pins_default {
-                pinctrl-single,pins = <
-                        0x15c (PIN_INPUT | SLEWCTRL_FAST | MUX_MODE2) /* spi0_cs0.i2c1_scl */
-                        0x158 (PIN_INPUT | SLEWCTRL_FAST | MUX_MODE2) /* spi0_d1.i2c1_sda */
-                >;
-        };
-
-        i2c1_pins_sleep: i2c1_pins_sleep {
-                pinctrl-single,pins = <
-                        0x15c (PIN_INPUT_PULLDOWN | MUX_MODE7) /* spi0_cs0.i2c1_scl */
-                        0x158 (PIN_INPUT_PULLDOWN | MUX_MODE7) /* spi0_d1.i2c1_sda */
-                >;
-        };
-
         mmc1_pins_default: pinmux_mmc1_pins_default {
                 pinctrl-single,pins = <
                         0x100 (PIN_INPUT | MUX_MODE0) /* mmc0_clk.mmc0_clk */
@@ -254,7 +240,7 @@
         status = "okay";
         pinctrl-names = "default", "sleep";
         pinctrl-0 = <&i2c0_pins_default>;
-        pinctrl-1 = <&i2c0_pins_default>;
+        pinctrl-1 = <&i2c0_pins_sleep>;
         clock-frequency = <400000>;
 
         at24@50 {
@@ -262,17 +248,10 @@
                 pagesize = <64>;
                 reg = <0x50>;
         };
-};
-
-&i2c1 {
-        status = "okay";
-        pinctrl-names = "default", "sleep";
-        pinctrl-0 = <&i2c1_pins_default>;
-        pinctrl-1 = <&i2c1_pins_default>;
-        clock-frequency = <400000>;
 
         tps: tps62362@60 {
                 compatible = "ti,tps62362";
+                reg = <0x60>;
                 regulator-name = "VDD_MPU";
                 regulator-min-microvolt = <950000>;
                 regulator-max-microvolt = <1330000>;
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
index 03750af3b49a..6463f9ef2b54 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -549,14 +549,6 @@
         pinctrl-0 = <&usb1_pins>;
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb2 {
         dr_mode = "peripheral";
 };
diff --git a/arch/arm/boot/dts/dm8168-evm.dts b/arch/arm/boot/dts/dm8168-evm.dts
index 857d0289ad4d..d3a29c1b8417 100644
--- a/arch/arm/boot/dts/dm8168-evm.dts
+++ b/arch/arm/boot/dts/dm8168-evm.dts
@@ -35,6 +35,18 @@
                         DM816X_IOPAD(0x0aac, PIN_INPUT | MUX_MODE0)     /* SPI_D1 */
                 >;
         };
+
+        usb0_pins: pinmux_usb0_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0d00, MUX_MODE0)                 /* USB0_DRVVBUS */
+                >;
+        };
+
+        usb1_pins: pinmux_usb0_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0d04, MUX_MODE0)                 /* USB1_DRVVBUS */
+                >;
+        };
 };
 
 &i2c1 {
@@ -127,3 +139,16 @@
 &mmc1 {
         vmmc-supply = <&vmmcsd_fixed>;
 };
+
+/* At least dm8168-evm rev c won't support multipoint, later may */
+&usb0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&usb0_pins>;
+        mentor,multipoint = <0>;
+};
+
+&usb1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&usb1_pins>;
+        mentor,multipoint = <0>;
+};
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index d98d0f7de380..3c97b5f2addc 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -97,10 +97,31 @@
 
                         /* Device Configuration Registers */
                         scm_conf: syscon@600 {
-                                compatible = "syscon";
+                                compatible = "syscon", "simple-bus";
                                 reg = <0x600 0x110>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
+                                ranges = <0 0x600 0x110>;
+
+                                usb_phy0: usb-phy@20 {
+                                        compatible = "ti,dm8168-usb-phy";
+                                        reg = <0x20 0x8>;
+                                        reg-names = "phy";
+                                        clocks = <&main_fapll 6>;
+                                        clock-names = "refclk";
+                                        #phy-cells = <0>;
+                                        syscon = <&scm_conf>;
+                                };
+
+                                usb_phy1: usb-phy@28 {
+                                        compatible = "ti,dm8168-usb-phy";
+                                        reg = <0x28 0x8>;
+                                        reg-names = "phy";
+                                        clocks = <&main_fapll 6>;
+                                        clock-names = "refclk";
+                                        #phy-cells = <0>;
+                                        syscon = <&scm_conf>;
+                                };
                         };
 
                         scrm_clocks: clocks {
@@ -357,7 +378,10 @@
                                 reg-names = "mc", "control";
                                 interrupts = <18>;
                                 interrupt-names = "mc";
-                                dr_mode = "otg";
+                                dr_mode = "host";
+                                interface-type = <0>;
+                                phys = <&usb_phy0>;
+                                phy-names = "usb2-phy";
                                 mentor,multipoint = <1>;
                                 mentor,num-eps = <16>;
                                 mentor,ram-bits = <12>;
@@ -366,13 +390,15 @@
 
                         usb1: usb@47401800 {
                                 compatible = "ti,musb-am33xx";
-                                status = "disabled";
                                 reg = <0x47401c00 0x400
                                        0x47401800 0x200>;
                                 reg-names = "mc", "control";
                                 interrupts = <19>;
                                 interrupt-names = "mc";
-                                dr_mode = "otg";
+                                dr_mode = "host";
+                                interface-type = <0>;
+                                phys = <&usb_phy1>;
+                                phy-names = "usb2-phy";
                                 mentor,multipoint = <1>;
                                 mentor,num-eps = <16>;
                                 mentor,ram-bits = <12>;
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 746cddb1b8f5..3290a96ba586 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -543,14 +543,6 @@
         };
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb1 {
         dr_mode = "peripheral";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 5827fedafd43..127608d79033 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -249,8 +249,8 @@
                                      <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4ae10000 {
@@ -1090,8 +1090,8 @@
                                       <0x4A096800 0x40>; /* pll_ctrl */
                                 reg-names = "phy_rx", "phy_tx", "pll_ctrl";
                                 ctrl-module = <&omap_control_sata>;
-                                clocks = <&sys_clkin1>;
-                                clock-names = "sysclk";
+                                clocks = <&sys_clkin1>, <&sata_ref_clk>;
+                                clock-names = "sysclk", "refclk";
                                 #phy-cells = <0>;
                         };
 
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index 4d8711713610..e0264d0bf7b9 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -380,14 +380,6 @@
         phy-supply = <&ldo4_reg>;
 };
 
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
-&omap_dwc3_2 {
-        extcon = <&extcon_usb2>;
-};
-
 &usb1 {
         dr_mode = "peripheral";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
index 59d1c297bb30..578fa2a54dce 100644
--- a/arch/arm/boot/dts/omap2.dtsi
+++ b/arch/arm/boot/dts/omap2.dtsi
@@ -87,8 +87,8 @@
                                      <14>,
                                      <15>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <64>;
+                        dma-channels = <32>;
+                        dma-requests = <64>;
                 };
 
                 i2c1: i2c@48070000 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 60403273f83e..db80f9d376fa 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -16,6 +16,13 @@
         model = "Nokia N900";
         compatible = "nokia,omap3-n900", "ti,omap3430", "ti,omap3";
 
+        aliases {
+                i2c0;
+                i2c1 = &i2c1;
+                i2c2 = &i2c2;
+                i2c3 = &i2c3;
+        };
+
         cpus {
                 cpu@0 {
                         cpu0-supply = <&vcc>;
@@ -704,7 +711,7 @@
                 compatible = "smsc,lan91c94";
                 interrupt-parent = <&gpio2>;
                 interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;  /* gpio54 */
-                reg = <1 0x300 0xf>;            /* 16 byte IO range at offset 0x300 */
+                reg = <1 0 0xf>;                /* 16 byte IO range */
                 bank-width = <2>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&ethernet_pins>;
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 01b71111bd55..f4f78c40b564 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -155,8 +155,8 @@
                                      <14>,
                                      <15>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <96>;
+                        dma-channels = <32>;
+                        dma-requests = <96>;
                 };
 
                 omap3_pmx_core: pinmux@48002030 {
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 074147cebae4..87401d9f4d8b 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -223,8 +223,8 @@
                                      <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4a310000 {
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index b321fdf42c9f..ddff674bd05e 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -238,8 +238,8 @@
                                      <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
                         #dma-cells = <1>;
-                        #dma-channels = <32>;
-                        #dma-requests = <127>;
+                        dma-channels = <32>;
+                        dma-requests = <127>;
                 };
 
                 gpio1: gpio@4ae10000 {
@@ -929,8 +929,8 @@
                                       <0x4A096800 0x40>; /* pll_ctrl */
                                 reg-names = "phy_rx", "phy_tx", "pll_ctrl";
                                 ctrl-module = <&omap_control_sata>;
-                                clocks = <&sys_clkin>;
-                                clock-names = "sysclk";
+                                clocks = <&sys_clkin>, <&sata_ref_clk>;
+                                clock-names = "sysclk", "refclk";
                                 #phy-cells = <0>;
                         };
                 };
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index e8a4c955241b..b7e6b6fba5e0 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -62,6 +62,17 @@ CONFIG_MACH_SPEAR1340=y
 CONFIG_ARCH_STI=y
 CONFIG_ARCH_EXYNOS=y
 CONFIG_EXYNOS5420_MCPM=y
+CONFIG_ARCH_SHMOBILE_MULTI=y
+CONFIG_ARCH_EMEV2=y
+CONFIG_ARCH_R7S72100=y
+CONFIG_ARCH_R8A73A4=y
+CONFIG_ARCH_R8A7740=y
+CONFIG_ARCH_R8A7779=y
+CONFIG_ARCH_R8A7790=y
+CONFIG_ARCH_R8A7791=y
+CONFIG_ARCH_R8A7794=y
+CONFIG_ARCH_SH73A0=y
+CONFIG_MACH_MARZEN=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_ARCH_SIRF=y
 CONFIG_ARCH_TEGRA=y
@@ -84,6 +95,8 @@ CONFIG_PCI_KEYSTONE=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MVEBU=y
 CONFIG_PCI_TEGRA=y
+CONFIG_PCI_RCAR_GEN2=y
+CONFIG_PCI_RCAR_GEN2_PCIE=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=8
@@ -130,6 +143,7 @@ CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=64
 CONFIG_OMAP_OCP2SCP=y
+CONFIG_SIMPLE_PM_BUS=y
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_BLOCK=y
@@ -157,6 +171,7 @@ CONFIG_AHCI_SUNXI=y
 CONFIG_AHCI_TEGRA=y
 CONFIG_SATA_HIGHBANK=y
 CONFIG_SATA_MV=y
+CONFIG_SATA_RCAR=y
 CONFIG_NETDEVICES=y
 CONFIG_HIX5HD2_GMAC=y
 CONFIG_SUN4I_EMAC=y
@@ -167,14 +182,17 @@ CONFIG_MV643XX_ETH=y
 CONFIG_MVNETA=y
 CONFIG_KS8851=y
 CONFIG_R8169=y
+CONFIG_SH_ETH=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
 CONFIG_TI_CPSW=y
 CONFIG_XILINX_EMACLITE=y
 CONFIG_AT803X_PHY=y
 CONFIG_MARVELL_PHY=y
+CONFIG_SMSC_PHY=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_ICPLUS_PHY=y
+CONFIG_MICREL_PHY=y
 CONFIG_USB_PEGASUS=y
 CONFIG_USB_USBNET=y
 CONFIG_USB_NET_SMSC75XX=y
@@ -192,15 +210,18 @@ CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_MOUSE_PS2_ELANTECH=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_TOUCHSCREEN_ATMEL_MXT=y
+CONFIG_TOUCHSCREEN_ST1232=m
 CONFIG_TOUCHSCREEN_STMPE=y
 CONFIG_TOUCHSCREEN_SUN4I=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_MPU3050=y
 CONFIG_INPUT_AXP20X_PEK=y
+CONFIG_INPUT_ADXL34X=m
 CONFIG_SERIO_AMBAKMI=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
+CONFIG_SERIAL_8250_EM=y
 CONFIG_SERIAL_8250_MT6577=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
@@ -213,6 +234,9 @@ CONFIG_SERIAL_SIRFSOC_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
 CONFIG_SERIAL_IMX=y
 CONFIG_SERIAL_IMX_CONSOLE=y
+CONFIG_SERIAL_SH_SCI=y
+CONFIG_SERIAL_SH_SCI_NR_UARTS=20
+CONFIG_SERIAL_SH_SCI_CONSOLE=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_VT8500=y
@@ -233,19 +257,26 @@ CONFIG_I2C_MUX_PCA954x=y
 CONFIG_I2C_MUX_PINCTRL=y
 CONFIG_I2C_CADENCE=y
 CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_GPIO=m
 CONFIG_I2C_EXYNOS5=y
 CONFIG_I2C_MV64XXX=y
+CONFIG_I2C_RIIC=y
 CONFIG_I2C_S3C2410=y
+CONFIG_I2C_SH_MOBILE=y
 CONFIG_I2C_SIRF=y
-CONFIG_I2C_TEGRA=y
 CONFIG_I2C_ST=y
-CONFIG_SPI=y
+CONFIG_I2C_TEGRA=y
 CONFIG_I2C_XILINX=y
-CONFIG_SPI_DAVINCI=y
+CONFIG_I2C_RCAR=y
+CONFIG_SPI=y
 CONFIG_SPI_CADENCE=y
+CONFIG_SPI_DAVINCI=y
 CONFIG_SPI_OMAP24XX=y
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
+CONFIG_SPI_RSPI=y
+CONFIG_SPI_SH_MSIOF=m
+CONFIG_SPI_SH_HSPI=y
 CONFIG_SPI_SIRF=y
 CONFIG_SPI_SUN4I=y
 CONFIG_SPI_SUN6I=y
@@ -259,12 +290,15 @@ CONFIG_PINCTRL_PALMAS=y
 CONFIG_PINCTRL_APQ8084=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_GPIO_GENERIC_PLATFORM=y
-CONFIG_GPIO_DWAPB=y
 CONFIG_GPIO_DAVINCI=y
+CONFIG_GPIO_DWAPB=y
+CONFIG_GPIO_EM=y
+CONFIG_GPIO_RCAR=y
 CONFIG_GPIO_XILINX=y
 CONFIG_GPIO_ZYNQ=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
+CONFIG_GPIO_PCF857X=y
 CONFIG_GPIO_TWL4030=y
 CONFIG_GPIO_PALMAS=y
 CONFIG_GPIO_SYSCON=y
@@ -276,10 +310,12 @@ CONFIG_POWER_RESET_AS3722=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_POWER_RESET_KEYSTONE=y
 CONFIG_POWER_RESET_SUN6I=y
+CONFIG_POWER_RESET_RMOBILE=y
 CONFIG_SENSORS_LM90=y
 CONFIG_SENSORS_LM95245=y
 CONFIG_THERMAL=y
 CONFIG_CPU_THERMAL=y
+CONFIG_RCAR_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_DAVINCI_WATCHDOG
 CONFIG_ST_THERMAL_SYSCFG=y
@@ -290,6 +326,7 @@ CONFIG_ARM_SP805_WATCHDOG=y
 CONFIG_ORION_WATCHDOG=y
 CONFIG_SUNXI_WATCHDOG=y
 CONFIG_MESON_WATCHDOG=y
+CONFIG_MFD_AS3711=y
 CONFIG_MFD_AS3722=y
 CONFIG_MFD_BCM590XX=y
 CONFIG_MFD_AXP20X=y
@@ -304,13 +341,16 @@ CONFIG_MFD_TPS65090=y
 CONFIG_MFD_TPS6586X=y
 CONFIG_MFD_TPS65910=y
 CONFIG_REGULATOR_AB8500=y
+CONFIG_REGULATOR_AS3711=y
 CONFIG_REGULATOR_AS3722=y
 CONFIG_REGULATOR_AXP20X=y
 CONFIG_REGULATOR_BCM590XX=y
+CONFIG_REGULATOR_DA9210=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_MFD_SYSCON=y
 CONFIG_POWER_RESET_SYSCON=y
 CONFIG_REGULATOR_MAX8907=y
+CONFIG_REGULATOR_MAX8973=y
 CONFIG_REGULATOR_MAX77686=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_S2MPS11=y
@@ -324,18 +364,32 @@ CONFIG_REGULATOR_TWL4030=y
 CONFIG_REGULATOR_VEXPRESS=y
 CONFIG_MEDIA_SUPPORT=y
 CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
 CONFIG_MEDIA_USB_SUPPORT=y
 CONFIG_USB_VIDEO_CLASS=y
 CONFIG_USB_GSPCA=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_SOC_CAMERA=m
+CONFIG_SOC_CAMERA_PLATFORM=m
+CONFIG_VIDEO_RCAR_VIN=m
+CONFIG_V4L_MEM2MEM_DRIVERS=y
+CONFIG_VIDEO_RENESAS_VSP1=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_ADV7180=m
 CONFIG_DRM=y
+CONFIG_DRM_RCAR_DU=m
 CONFIG_DRM_TEGRA=y
 CONFIG_DRM_PANEL_SIMPLE=y
 CONFIG_FB_ARMCLCD=y
 CONFIG_FB_WM8505=y
+CONFIG_FB_SH_MOBILE_LCDC=y
 CONFIG_FB_SIMPLE=y
+CONFIG_FB_SH_MOBILE_MERAM=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_BACKLIGHT_PWM=y
+CONFIG_BACKLIGHT_AS3711=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_SOUND=y
@@ -343,6 +397,8 @@ CONFIG_SND=y
 CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_USB_AUDIO=y
 CONFIG_SND_SOC=y
+CONFIG_SND_SOC_SH4_FSI=m
+CONFIG_SND_SOC_RCAR=m
 CONFIG_SND_SOC_TEGRA=y
 CONFIG_SND_SOC_TEGRA_RT5640=y
 CONFIG_SND_SOC_TEGRA_WM8753=y
@@ -350,6 +406,8 @@ CONFIG_SND_SOC_TEGRA_WM8903=y
 CONFIG_SND_SOC_TEGRA_TRIMSLICE=y
 CONFIG_SND_SOC_TEGRA_ALC5632=y
 CONFIG_SND_SOC_TEGRA_MAX98090=y
+CONFIG_SND_SOC_AK4642=m
+CONFIG_SND_SOC_WM8978=m
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_XHCI_MVEBU=y
@@ -362,6 +420,8 @@ CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_STI=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_R8A66597_HCD=m
+CONFIG_USB_RENESAS_USBHS=m
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
 CONFIG_USB_CHIPIDEA=y
@@ -374,6 +434,10 @@ CONFIG_SAMSUNG_USB3PHY=y
 CONFIG_USB_GPIO_VBUS=y
 CONFIG_USB_ISP1301=y
 CONFIG_USB_MXS_PHY=y
+CONFIG_USB_RCAR_PHY=m
+CONFIG_USB_RCAR_GEN2_PHY=m
+CONFIG_USB_GADGET=y
+CONFIG_USB_RENESAS_USBHS_UDC=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_ARMMMCI=y
@@ -392,12 +456,14 @@ CONFIG_MMC_SDHCI_ST=y
 CONFIG_MMC_OMAP=y
 CONFIG_MMC_OMAP_HS=y
 CONFIG_MMC_MVSDIO=y
-CONFIG_MMC_SUNXI=y
+CONFIG_MMC_SDHI=y
 CONFIG_MMC_DW=y
 CONFIG_MMC_DW_IDMAC=y
 CONFIG_MMC_DW_PLTFM=y
 CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_ROCKCHIP=y
+CONFIG_MMC_SH_MMCIF=y
+CONFIG_MMC_SUNXI=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -421,10 +487,12 @@ CONFIG_RTC_DRV_AS3722=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RTC_DRV_MAX8907=y
 CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_RS5C372=m
 CONFIG_RTC_DRV_PALMAS=y
 CONFIG_RTC_DRV_TWL4030=y
 CONFIG_RTC_DRV_TPS6586X=y
 CONFIG_RTC_DRV_TPS65910=y
+CONFIG_RTC_DRV_S35390A=m
 CONFIG_RTC_DRV_EM3027=y
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_VT8500=y
@@ -436,6 +504,9 @@ CONFIG_DMADEVICES=y
 CONFIG_DW_DMAC=y
 CONFIG_MV_XOR=y
 CONFIG_TEGRA20_APB_DMA=y
+CONFIG_SH_DMAE=y
+CONFIG_RCAR_AUDMAC_PP=m
+CONFIG_RCAR_DMAC=y
 CONFIG_STE_DMA40=y
 CONFIG_SIRF_DMA=y
 CONFIG_TI_EDMA=y
@@ -468,6 +539,7 @@ CONFIG_IIO=y
 CONFIG_XILINX_XADC=y
 CONFIG_AK8975=y
 CONFIG_PWM=y
+CONFIG_PWM_RENESAS_TPU=y
 CONFIG_PWM_TEGRA=y
 CONFIG_PWM_VT8500=y
 CONFIG_PHY_HIX5HD2_SATA=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index b7386524c356..a097cffa1231 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -114,6 +114,7 @@ CONFIG_MTD_PHYSMAP_OF=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_ECC_BCH=y
 CONFIG_MTD_NAND_OMAP2=y
+CONFIG_MTD_NAND_OMAP_BCH=y
 CONFIG_MTD_ONENAND=y
 CONFIG_MTD_ONENAND_VERIFY_WRITE=y
 CONFIG_MTD_ONENAND_OMAP2=y
@@ -248,6 +249,7 @@ CONFIG_TWL6040_CORE=y
 CONFIG_REGULATOR_PALMAS=y
 CONFIG_REGULATOR_PBIAS=y
 CONFIG_REGULATOR_TI_ABB=y
+CONFIG_REGULATOR_TPS62360=m
 CONFIG_REGULATOR_TPS65023=y
 CONFIG_REGULATOR_TPS6507X=y
 CONFIG_REGULATOR_TPS65217=y
@@ -374,7 +376,7 @@ CONFIG_PWM_TIEHRPWM=m
 CONFIG_PWM_TWL=m
 CONFIG_PWM_TWL_LED=m
 CONFIG_OMAP_USB2=m
-CONFIG_TI_PIPE3=m
+CONFIG_TI_PIPE3=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index bf0fe99e8ca9..4cf48c3aca13 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -149,29 +149,28 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
         (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
 
+#define kvm_pgd_index(addr)                     pgd_index(addr)
+
 static inline bool kvm_page_empty(void *ptr)
 {
         struct page *ptr_page = virt_to_page(ptr);
         return page_count(ptr_page) == 1;
 }
 
-
 #define kvm_pte_table_empty(kvm, ptep) kvm_page_empty(ptep)
 #define kvm_pmd_table_empty(kvm, pmdp) kvm_page_empty(pmdp)
 #define kvm_pud_table_empty(kvm, pudp) (0)
 
 #define KVM_PREALLOC_LEVEL      0
 
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
+static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
-        return 0;
+        return kvm->arch.pgd;
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm) { }
-
-static inline void *kvm_get_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        return kvm->arch.pgd;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 struct kvm;
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 56c8b03c0ca1..15b050d46fc9 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -290,7 +290,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
         phys_addr_t addr = start, end = start + size;
         phys_addr_t next;
 
-        pgd = pgdp + pgd_index(addr);
+        pgd = pgdp + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 if (!pgd_none(*pgd))
@@ -355,7 +355,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
         phys_addr_t next;
         pgd_t *pgd;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 stage2_flush_puds(kvm, pgd, addr, next);
@@ -632,6 +632,20 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
                                      __phys_to_pfn(phys_addr), PAGE_HYP_DEVICE);
 }
 
+/* Free the HW pgd, one page at a time */
+static void kvm_free_hwpgd(void *hwpgd)
+{
+        free_pages_exact(hwpgd, kvm_get_hwpgd_size());
+}
+
+/* Allocate the HW PGD, making sure that each page gets its own refcount */
+static void *kvm_alloc_hwpgd(void)
+{
+        unsigned int size = kvm_get_hwpgd_size();
+
+        return alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
+}
+
 /**
  * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
  * @kvm:        The KVM struct pointer for the VM.
@@ -645,15 +659,31 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
  */
 int kvm_alloc_stage2_pgd(struct kvm *kvm)
 {
-        int ret;
         pgd_t *pgd;
+        void *hwpgd;
 
         if (kvm->arch.pgd != NULL) {
                 kvm_err("kvm_arch already initialized?\n");
                 return -EINVAL;
         }
 
+        hwpgd = kvm_alloc_hwpgd();
+        if (!hwpgd)
+                return -ENOMEM;
+
+        /* When the kernel uses more levels of page tables than the
+         * guest, we allocate a fake PGD and pre-populate it to point
+         * to the next-level page table, which will be the real
+         * initial page table pointed to by the VTTBR.
+         *
+         * When KVM_PREALLOC_LEVEL==2, we allocate a single page for
+         * the PMD and the kernel will use folded pud.
+         * When KVM_PREALLOC_LEVEL==1, we allocate 2 consecutive PUD
+         * pages.
+         */
         if (KVM_PREALLOC_LEVEL > 0) {
+                int i;
+
                 /*
                  * Allocate fake pgd for the page table manipulation macros to
                  * work.  This is not used by the hardware and we have no
@@ -661,30 +691,32 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
                  */
                 pgd = (pgd_t *)kmalloc(PTRS_PER_S2_PGD * sizeof(pgd_t),
                                        GFP_KERNEL | __GFP_ZERO);
+
+                if (!pgd) {
+                        kvm_free_hwpgd(hwpgd);
+                        return -ENOMEM;
+                }
+
+                /* Plug the HW PGD into the fake one. */
+                for (i = 0; i < PTRS_PER_S2_PGD; i++) {
+                        if (KVM_PREALLOC_LEVEL == 1)
+                                pgd_populate(NULL, pgd + i,
+                                             (pud_t *)hwpgd + i * PTRS_PER_PUD);
+                        else if (KVM_PREALLOC_LEVEL == 2)
+                                pud_populate(NULL, pud_offset(pgd, 0) + i,
+                                             (pmd_t *)hwpgd + i * PTRS_PER_PMD);
+                }
         } else {
                 /*
                  * Allocate actual first-level Stage-2 page table used by the
                  * hardware for Stage-2 page table walks.
                  */
-                pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, S2_PGD_ORDER);
+                pgd = (pgd_t *)hwpgd;
         }
 
-        if (!pgd)
-                return -ENOMEM;
-
-        ret = kvm_prealloc_hwpgd(kvm, pgd);
-        if (ret)
-                goto out_err;
-
         kvm_clean_pgd(pgd);
         kvm->arch.pgd = pgd;
         return 0;
-out_err:
-        if (KVM_PREALLOC_LEVEL > 0)
-                kfree(pgd);
-        else
-                free_pages((unsigned long)pgd, S2_PGD_ORDER);
-        return ret;
 }
 
 /**
@@ -785,11 +817,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
                 return;
 
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
-        kvm_free_hwpgd(kvm);
+        kvm_free_hwpgd(kvm_get_hwpgd(kvm));
         if (KVM_PREALLOC_LEVEL > 0)
                 kfree(kvm->arch.pgd);
-        else
-                free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
+
         kvm->arch.pgd = NULL;
 }
 
@@ -799,7 +830,7 @@ static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pgd_t *pgd;
         pud_t *pud;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         if (WARN_ON(pgd_none(*pgd))) {
                 if (!cache)
                         return NULL;
@@ -1089,7 +1120,7 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
         pgd_t *pgd;
         phys_addr_t next;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 /*
                  * Release kvm_mmu_lock periodically if the memory region is
diff --git a/arch/arm/mach-asm9260/Kconfig b/arch/arm/mach-asm9260/Kconfig
index 8423be76080e..52241207a82a 100644
--- a/arch/arm/mach-asm9260/Kconfig
+++ b/arch/arm/mach-asm9260/Kconfig
@@ -2,5 +2,7 @@ config MACH_ASM9260
         bool "Alphascale ASM9260"
         depends on ARCH_MULTI_V5
         select CPU_ARM926T
+        select ASM9260_TIMER
+        select GENERIC_CLOCKEVENTS
         help
           Support for Alphascale ASM9260 based platform.
diff --git a/arch/arm/mach-msm/board-halibut.c b/arch/arm/mach-msm/board-halibut.c
index 61bfe584a9d7..fc832040c6e9 100644
--- a/arch/arm/mach-msm/board-halibut.c
+++ b/arch/arm/mach-msm/board-halibut.c
@@ -20,6 +20,7 @@
 #include <linux/input.h>
 #include <linux/io.h>
 #include <linux/delay.h>
+#include <linux/smc91x.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -46,15 +47,20 @@ static struct resource smc91x_resources[] = {
         [1] = {
                 .start  = MSM_GPIO_TO_INT(49),
                 .end    = MSM_GPIO_TO_INT(49),
-                .flags  = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
         },
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm/mach-msm/board-qsd8x50.c b/arch/arm/mach-msm/board-qsd8x50.c
index 4c748616ef47..10016a3bc698 100644
--- a/arch/arm/mach-msm/board-qsd8x50.c
+++ b/arch/arm/mach-msm/board-qsd8x50.c
@@ -22,6 +22,7 @@
 #include <linux/usb/msm_hsusb.h>
 #include <linux/err.h>
 #include <linux/clkdev.h>
+#include <linux/smc91x.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
@@ -49,15 +50,20 @@ static struct resource smc91x_resources[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
-                .flags = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
         },
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static int __init msm_init_smc91x(void)
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index 343c4e3a7c5d..f6d02e4cbcda 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -36,6 +36,7 @@
 #include <linux/platform_data/video-pxafb.h>
 #include <mach/bitfield.h>
 #include <linux/platform_data/mmc-pxamci.h>
+#include <linux/smc91x.h>
 
 #include "generic.h"
 #include "devices.h"
@@ -81,11 +82,16 @@ static struct resource smc91x_resources[] = {
         }
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static void idp_backlight_power(int on)
diff --git a/arch/arm/mach-pxa/lpd270.c b/arch/arm/mach-pxa/lpd270.c
index ad777b353bd5..eaee2c20b189 100644
--- a/arch/arm/mach-pxa/lpd270.c
+++ b/arch/arm/mach-pxa/lpd270.c
@@ -24,6 +24,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
 #include <linux/pwm_backlight.h>
+#include <linux/smc91x.h>
 
 #include <asm/types.h>
 #include <asm/setup.h>
@@ -189,15 +190,20 @@ static struct resource smc91x_resources[] = {
         [1] = {
                 .start  = LPD270_ETHERNET_IRQ,
                 .end    = LPD270_ETHERNET_IRQ,
-                .flags  = IORESOURCE_IRQ,
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
         },
 };
 
+struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev.platform_data = &smc91x_platdata,
 };
 
 static struct resource lpd270_flash_resources[] = {
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index 850e506926df..c309593abdb2 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -28,6 +28,7 @@
 #include <linux/platform_data/video-clcd-versatile.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/smc91x.h>
 #include <linux/ata_platform.h>
 #include <linux/amba/mmci.h>
 #include <linux/gfp.h>
@@ -94,6 +95,10 @@ static struct smsc911x_platform_config smsc911x_config = {
         .phy_interface  = PHY_INTERFACE_MODE_MII,
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+};
+
 static struct platform_device realview_eth_device = {
         .name           = "smsc911x",
         .id             = 0,
@@ -107,6 +112,8 @@ int realview_eth_register(const char *name, struct resource *res)
         realview_eth_device.resource = res;
         if (strcmp(realview_eth_device.name, "smsc911x") == 0)
                 realview_eth_device.dev.platform_data = &smsc911x_config;
+        else
+                realview_eth_device.dev.platform_data = &smc91x_platdata;
 
         return platform_device_register(&realview_eth_device);
 }
diff --git a/arch/arm/mach-realview/realview_eb.c b/arch/arm/mach-realview/realview_eb.c
index 64c88d657f9e..b3869cbbcc68 100644
--- a/arch/arm/mach-realview/realview_eb.c
+++ b/arch/arm/mach-realview/realview_eb.c
@@ -234,7 +234,7 @@ static struct resource realview_eb_eth_resources[] = {
         [1] = {
                 .start          = IRQ_EB_ETH,
                 .end            = IRQ_EB_ETH,
-                .flags          = IORESOURCE_IRQ,
+                .flags          = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE,
         },
 };
 
diff --git a/arch/arm/mach-sa1100/neponset.c b/arch/arm/mach-sa1100/neponset.c
index 169262e3040d..af868d258e66 100644
--- a/arch/arm/mach-sa1100/neponset.c
+++ b/arch/arm/mach-sa1100/neponset.c
@@ -12,6 +12,7 @@
 #include <linux/pm.h>
 #include <linux/serial_core.h>
 #include <linux/slab.h>
+#include <linux/smc91x.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
@@ -258,12 +259,17 @@ static int neponset_probe(struct platform_device *dev)
                         0x02000000, "smc91x-attrib"),
                 { .flags = IORESOURCE_IRQ },
         };
+        struct smc91x_platdata smc91x_platdata = {
+                .flags = SMC91X_USE_8BIT | SMC91X_IO_SHIFT_2 | SMC91X_NOWAIT,
+        };
         struct platform_device_info smc91x_devinfo = {
                 .parent = &dev->dev,
                 .name = "smc91x",
                 .id = 0,
                 .res = smc91x_resources,
                 .num_res = ARRAY_SIZE(smc91x_resources),
+                .data = &smc91x_platdata,
+                .size_data = sizeof(smc91x_platdata),
         };
         int ret, irq;
 
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 091261878eff..1525d7b5f1b7 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -11,6 +11,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/mtd/partitions.h>
+#include <linux/smc91x.h>
 
 #include <mach/hardware.h>
 #include <asm/setup.h>
@@ -43,12 +44,18 @@ static struct resource smc91x_resources[] = {
 #endif
 };
 
+static struct smc91x_platdata smc91x_platdata = {
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+};
 
 static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
         .resource       = smc91x_resources,
+        .dev = {
+                .platform_data  = &smc91x_platdata,
+        },
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index f1ad9c2ab2e9..a857794432d6 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -622,7 +622,7 @@
                 };
 
                 sgenet0: ethernet@1f210000 {
-                        compatible = "apm,xgene-enet";
+                        compatible = "apm,xgene1-sgenet";
                         status = "disabled";
                         reg = <0x0 0x1f210000 0x0 0xd100>,
                               <0x0 0x1f200000 0x0 0Xc300>,
@@ -636,7 +636,7 @@
                 };
 
                 xgenet: ethernet@1f610000 {
-                        compatible = "apm,xgene-enet";
+                        compatible = "apm,xgene1-xgenet";
                         status = "disabled";
                         reg = <0x0 0x1f610000 0x0 0xd100>,
                               <0x0 0x1f600000 0x0 0Xc300>,
diff --git a/arch/arm64/boot/dts/arm/foundation-v8.dts b/arch/arm64/boot/dts/arm/foundation-v8.dts
index 27f32962e55c..4eac8dcea423 100644
--- a/arch/arm64/boot/dts/arm/foundation-v8.dts
+++ b/arch/arm64/boot/dts/arm/foundation-v8.dts
@@ -34,6 +34,7 @@
                         reg = <0x0 0x0>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -41,6 +42,7 @@
                         reg = <0x0 0x1>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@2 {
                         device_type = "cpu";
@@ -48,6 +50,7 @@
                         reg = <0x0 0x2>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@3 {
                         device_type = "cpu";
@@ -55,6 +58,11 @@
                         reg = <0x0 0x3>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                L2_0: l2-cache0 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
index d429129ecb3d..133ee59de2d7 100644
--- a/arch/arm64/boot/dts/arm/juno.dts
+++ b/arch/arm64/boot/dts/arm/juno.dts
@@ -39,6 +39,7 @@
                         reg = <0x0 0x0>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A57_L2>;
                 };
 
                 A57_1: cpu@1 {
@@ -46,6 +47,7 @@
                         reg = <0x0 0x1>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A57_L2>;
                 };
 
                 A53_0: cpu@100 {
@@ -53,6 +55,7 @@
                         reg = <0x0 0x100>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_1: cpu@101 {
@@ -60,6 +63,7 @@
                         reg = <0x0 0x101>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_2: cpu@102 {
@@ -67,6 +71,7 @@
                         reg = <0x0 0x102>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
                 };
 
                 A53_3: cpu@103 {
@@ -74,6 +79,15 @@
                         reg = <0x0 0x103>;
                         device_type = "cpu";
                         enable-method = "psci";
+                        next-level-cache = <&A53_L2>;
+                };
+
+                A57_L2: l2-cache0 {
+                        compatible = "cache";
+                };
+
+                A53_L2: l2-cache1 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
index efc59b3baf63..20addabbd127 100644
--- a/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
+++ b/arch/arm64/boot/dts/arm/rtsm_ve-aemv8a.dts
@@ -37,6 +37,7 @@
                         reg = <0x0 0x0>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -44,6 +45,7 @@
                         reg = <0x0 0x1>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@2 {
                         device_type = "cpu";
@@ -51,6 +53,7 @@
                         reg = <0x0 0x2>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
                 };
                 cpu@3 {
                         device_type = "cpu";
@@ -58,6 +61,11 @@
                         reg = <0x0 0x3>;
                         enable-method = "spin-table";
                         cpu-release-addr = <0x0 0x8000fff8>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                L2_0: l2-cache0 {
+                        compatible = "cache";
                 };
         };
 
diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
index 5720608c50b1..abb79b3cfcfe 100644
--- a/arch/arm64/crypto/Makefile
+++ b/arch/arm64/crypto/Makefile
@@ -29,7 +29,7 @@ aes-ce-blk-y := aes-glue-ce.o aes-ce.o
 obj-$(CONFIG_CRYPTO_AES_ARM64_NEON_BLK) += aes-neon-blk.o
 aes-neon-blk-y := aes-glue-neon.o aes-neon.o
 
-AFLAGS_aes-ce.o         := -DINTERLEAVE=2 -DINTERLEAVE_INLINE
+AFLAGS_aes-ce.o         := -DINTERLEAVE=4
 AFLAGS_aes-neon.o       := -DINTERLEAVE=4
 
 CFLAGS_aes-glue-ce.o    := -DUSE_V8_CRYPTO_EXTENSIONS
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 5901480bfdca..750bac4e637e 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -20,6 +20,9 @@
 #error "Only include this from assembly code"
 #endif
 
+#ifndef __ASM_ASSEMBLER_H
+#define __ASM_ASSEMBLER_H
+
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
 
@@ -155,3 +158,5 @@ lr	.req	x30		// link register
 #endif
         orr     \rd, \lbits, \hbits, lsl #32
         .endm
+
+#endif  /* __ASM_ASSEMBLER_H */
diff --git a/arch/arm64/include/asm/cpuidle.h b/arch/arm64/include/asm/cpuidle.h
index 0710654631e7..c60643f14cda 100644
--- a/arch/arm64/include/asm/cpuidle.h
+++ b/arch/arm64/include/asm/cpuidle.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_CPUIDLE_H
 #define __ASM_CPUIDLE_H
 
+#include <asm/proc-fns.h>
+
 #ifdef CONFIG_CPU_IDLE
 extern int cpu_init_idle(unsigned int cpu);
 extern int cpu_suspend(unsigned long arg);
diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
index e2ff32a93b5c..d2f49423c5dc 100644
--- a/arch/arm64/include/asm/insn.h
+++ b/arch/arm64/include/asm/insn.h
@@ -264,8 +264,10 @@ __AARCH64_INSN_FUNCS(ands,	0x7F200000, 0x6A000000)
 __AARCH64_INSN_FUNCS(bics,      0x7F200000, 0x6A200000)
 __AARCH64_INSN_FUNCS(b,         0xFC000000, 0x14000000)
 __AARCH64_INSN_FUNCS(bl,        0xFC000000, 0x94000000)
-__AARCH64_INSN_FUNCS(cbz,       0xFE000000, 0x34000000)
-__AARCH64_INSN_FUNCS(cbnz,      0xFE000000, 0x35000000)
+__AARCH64_INSN_FUNCS(cbz,       0x7F000000, 0x34000000)
+__AARCH64_INSN_FUNCS(cbnz,      0x7F000000, 0x35000000)
+__AARCH64_INSN_FUNCS(tbz,       0x7F000000, 0x36000000)
+__AARCH64_INSN_FUNCS(tbnz,      0x7F000000, 0x37000000)
 __AARCH64_INSN_FUNCS(bcond,     0xFF000010, 0x54000000)
 __AARCH64_INSN_FUNCS(svc,       0xFFE0001F, 0xD4000001)
 __AARCH64_INSN_FUNCS(hvc,       0xFFE0001F, 0xD4000002)
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 9e5543e08955..ac6fafb95fe7 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -129,6 +129,9 @@
  * 40 bits wide (T0SZ = 24).  Systems with a PARange smaller than 40 bits are
  * not known to exist and will break with this configuration.
  *
+ * VTCR_EL2.PS is extracted from ID_AA64MMFR0_EL1.PARange at boot time
+ * (see hyp-init.S).
+ *
  * Note that when using 4K pages, we concatenate two first level page tables
  * together.
  *
@@ -138,7 +141,6 @@
 #ifdef CONFIG_ARM64_64K_PAGES
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 64kB pages (TG0 = 1)
  * 2 level page tables (SL = 1)
@@ -150,7 +152,6 @@
 #else
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 4kB pages (TG0 = 0)
  * 3 level page tables (SL = 1)
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 6458b5373142..bbfb600fa822 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -158,6 +158,8 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define PTRS_PER_S2_PGD         (1 << PTRS_PER_S2_PGD_SHIFT)
 #define S2_PGD_ORDER            get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
 
+#define kvm_pgd_index(addr)     (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
+
 /*
  * If we are concatenating first level stage-2 page tables, we would have less
  * than or equal to 16 pointers in the fake PGD, because that's what the
@@ -171,43 +173,6 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define KVM_PREALLOC_LEVEL      (0)
 #endif
 
-/**
- * kvm_prealloc_hwpgd - allocate inital table for VTTBR
- * @kvm:        The KVM struct pointer for the VM.
- * @pgd:        The kernel pseudo pgd
- *
- * When the kernel uses more levels of page tables than the guest, we allocate
- * a fake PGD and pre-populate it to point to the next-level page table, which
- * will be the real initial page table pointed to by the VTTBR.
- *
- * When KVM_PREALLOC_LEVEL==2, we allocate a single page for the PMD and
- * the kernel will use folded pud.  When KVM_PREALLOC_LEVEL==1, we
- * allocate 2 consecutive PUD pages.
- */
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
-{
-        unsigned int i;
-        unsigned long hwpgd;
-
-        if (KVM_PREALLOC_LEVEL == 0)
-                return 0;
-
-        hwpgd = __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTRS_PER_S2_PGD_SHIFT);
-        if (!hwpgd)
-                return -ENOMEM;
-
-        for (i = 0; i < PTRS_PER_S2_PGD; i++) {
-                if (KVM_PREALLOC_LEVEL == 1)
-                        pgd_populate(NULL, pgd + i,
-                                     (pud_t *)hwpgd + i * PTRS_PER_PUD);
-                else if (KVM_PREALLOC_LEVEL == 2)
-                        pud_populate(NULL, pud_offset(pgd, 0) + i,
-                                     (pmd_t *)hwpgd + i * PTRS_PER_PMD);
-        }
-
-        return 0;
-}
-
 static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
         pgd_t *pgd = kvm->arch.pgd;
@@ -224,12 +189,11 @@ static inline void *kvm_get_hwpgd(struct kvm *kvm)
         return pmd_offset(pud, 0);
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        if (KVM_PREALLOC_LEVEL > 0) {
-                unsigned long hwpgd = (unsigned long)kvm_get_hwpgd(kvm);
-                free_pages(hwpgd, PTRS_PER_S2_PGD_SHIFT);
-        }
+        if (KVM_PREALLOC_LEVEL > 0)
+                return PTRS_PER_S2_PGD * PAGE_SIZE;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 16449c535e50..800ec0e87ed9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -460,7 +460,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long addr)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY |
-                              PTE_PROT_NONE | PTE_VALID | PTE_WRITE;
+                              PTE_PROT_NONE | PTE_WRITE | PTE_TYPE_MASK;
         pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
         return pte;
 }
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index f9be30ea1cbd..20e9591a60cf 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -45,7 +45,8 @@
 #define STACK_TOP               STACK_TOP_MAX
 #endif /* CONFIG_COMPAT */
 
-#define ARCH_LOW_ADDRESS_LIMIT  PHYS_MASK
+extern phys_addr_t arm64_dma_phys_limit;
+#define ARCH_LOW_ADDRESS_LIMIT  (arm64_dma_phys_limit - 1)
 #endif /* __KERNEL__ */
 
 struct debug_info {
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index 73f0ce570fb3..4abe9b945f77 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -24,11 +24,6 @@
 #include <linux/sched.h>
 #include <asm/cputype.h>
 
-extern void __cpu_flush_user_tlb_range(unsigned long, unsigned long, struct vm_area_struct *);
-extern void __cpu_flush_kern_tlb_range(unsigned long, unsigned long);
-
-extern struct cpu_tlb_fns cpu_tlb;
-
 /*
  *      TLB Management
  *      ==============
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index bef04afd6031..5ee07eee80c2 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -15,8 +15,9 @@ CFLAGS_REMOVE_return_address.o = -pg
 arm64-obj-y             := cputable.o debug-monitors.o entry.o irq.o fpsimd.o   \
                            entry-fpsimd.o process.o ptrace.o setup.o signal.o   \
                            sys.o stacktrace.o time.o traps.o io.o vdso.o        \
-                           hyp-stub.o psci.o cpu_ops.o insn.o return_address.o  \
-                           cpuinfo.o cpu_errata.o alternative.o cacheinfo.o
+                           hyp-stub.o psci.o psci-call.o cpu_ops.o insn.o       \
+                           return_address.o cpuinfo.o cpu_errata.o              \
+                           alternative.o cacheinfo.o
 
 arm64-obj-$(CONFIG_COMPAT)              += sys32.o kuser32.o signal32.o         \
                                            sys_compat.o entry32.o               \
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index cf8556ae09d0..c851be795080 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -156,7 +156,7 @@ static int ftrace_modify_graph_caller(bool enable)
 
         branch = aarch64_insn_gen_branch_imm(pc,
                                              (unsigned long)ftrace_graph_caller,
-                                             AARCH64_INSN_BRANCH_LINK);
+                                             AARCH64_INSN_BRANCH_NOLINK);
         nop = aarch64_insn_gen_nop();
 
         if (enable)
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
index 27d4864577e5..c8eca88f12e6 100644
--- a/arch/arm64/kernel/insn.c
+++ b/arch/arm64/kernel/insn.c
@@ -87,8 +87,10 @@ static void __kprobes *patch_map(void *addr, int fixmap)
 
         if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX))
                 page = vmalloc_to_page(addr);
-        else
+        else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA))
                 page = virt_to_page(addr);
+        else
+                return addr;
 
         BUG_ON(!page);
         set_fixmap(fixmap, page_to_phys(page));
diff --git a/arch/arm64/kernel/psci-call.S b/arch/arm64/kernel/psci-call.S
new file mode 100644
index 000000000000..cf83e61cd3b5
--- /dev/null
+++ b/arch/arm64/kernel/psci-call.S
@@ -0,0 +1,28 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * Copyright (C) 2015 ARM Limited
+ *
+ * Author: Will Deacon <will.deacon@arm.com>
+ */
+
+#include <linux/linkage.h>
+
+/* int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
+ENTRY(__invoke_psci_fn_hvc)
+        hvc     #0
+        ret
+ENDPROC(__invoke_psci_fn_hvc)
+
+/* int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1, u64 arg2) */
+ENTRY(__invoke_psci_fn_smc)
+        smc     #0
+        ret
+ENDPROC(__invoke_psci_fn_smc)
diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 3425f311c49e..9b8a70ae64a1 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -57,6 +57,9 @@ static struct psci_operations psci_ops;
 static int (*invoke_psci_fn)(u64, u64, u64, u64);
 typedef int (*psci_initcall_t)(const struct device_node *);
 
+asmlinkage int __invoke_psci_fn_hvc(u64, u64, u64, u64);
+asmlinkage int __invoke_psci_fn_smc(u64, u64, u64, u64);
+
 enum psci_function {
         PSCI_FN_CPU_SUSPEND,
         PSCI_FN_CPU_ON,
@@ -109,40 +112,6 @@ static void psci_power_state_unpack(u32 power_state,
                         PSCI_0_2_POWER_STATE_AFFL_SHIFT;
 }
 
-/*
- * The following two functions are invoked via the invoke_psci_fn pointer
- * and will not be inlined, allowing us to piggyback on the AAPCS.
- */
-static noinline int __invoke_psci_fn_hvc(u64 function_id, u64 arg0, u64 arg1,
-                                         u64 arg2)
-{
-        asm volatile(
-                        __asmeq("%0", "x0")
-                        __asmeq("%1", "x1")
-                        __asmeq("%2", "x2")
-                        __asmeq("%3", "x3")
-                        "hvc    #0\n"
-                : "+r" (function_id)
-                : "r" (arg0), "r" (arg1), "r" (arg2));
-
-        return function_id;
-}
-
-static noinline int __invoke_psci_fn_smc(u64 function_id, u64 arg0, u64 arg1,
-                                         u64 arg2)
-{
-        asm volatile(
-                        __asmeq("%0", "x0")
-                        __asmeq("%1", "x1")
-                        __asmeq("%2", "x2")
-                        __asmeq("%3", "x3")
-                        "smc    #0\n"
-                : "+r" (function_id)
-                : "r" (arg0), "r" (arg1), "r" (arg2));
-
-        return function_id;
-}
-
 static int psci_get_version(void)
 {
         int err;
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index c20a300e2213..d26fcd4cd6e6 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -154,8 +154,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
         case __SI_TIMER:
                  err |= __put_user(from->si_tid, &to->si_tid);
                  err |= __put_user(from->si_overrun, &to->si_overrun);
-                 err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr,
-                                   &to->si_ptr);
+                 err |= __put_user(from->si_int, &to->si_int);
                 break;
         case __SI_POLL:
                 err |= __put_user(from->si_band, &to->si_band);
@@ -184,7 +183,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
         case __SI_MESGQ: /* But this is */
                 err |= __put_user(from->si_pid, &to->si_pid);
                 err |= __put_user(from->si_uid, &to->si_uid);
-                err |= __put_user((compat_uptr_t)(unsigned long)from->si_ptr, &to->si_ptr);
+                err |= __put_user(from->si_int, &to->si_int);
                 break;
         case __SI_SYS:
                 err |= __put_user((compat_uptr_t)(unsigned long)
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index fe652ffd34c2..efa79e8d4196 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -174,8 +174,6 @@ ENDPROC(__kernel_clock_gettime)
 /* int __kernel_clock_getres(clockid_t clock_id, struct timespec *res); */
 ENTRY(__kernel_clock_getres)
         .cfi_startproc
-        cbz     w1, 3f
-
         cmp     w0, #CLOCK_REALTIME
         ccmp    w0, #CLOCK_MONOTONIC, #0x4, ne
         b.ne    1f
@@ -188,6 +186,7 @@ ENTRY(__kernel_clock_getres)
         b.ne    4f
         ldr     x2, 6f
 2:
+        cbz     w1, 3f
         stp     xzr, x2, [x1]
 
 3:      /* res == NULL. */
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 0a24b9b8c698..58e0c2bdde04 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -348,8 +348,6 @@ static struct dma_map_ops swiotlb_dma_ops = {
         .mapping_error = swiotlb_dma_mapping_error,
 };
 
-extern int swiotlb_late_init_with_default_size(size_t default_size);
-
 static int __init atomic_pool_init(void)
 {
         pgprot_t prot = __pgprot(PROT_NORMAL_NC);
@@ -411,21 +409,13 @@ out:
         return -ENOMEM;
 }
 
-static int __init swiotlb_late_init(void)
+static int __init arm64_dma_init(void)
 {
-        size_t swiotlb_size = min(SZ_64M, MAX_ORDER_NR_PAGES << PAGE_SHIFT);
+        int ret;
 
         dma_ops = &swiotlb_dma_ops;
 
-        return swiotlb_late_init_with_default_size(swiotlb_size);
-}
-
-static int __init arm64_dma_init(void)
-{
-        int ret = 0;
-
-        ret |= swiotlb_late_init();
-        ret |= atomic_pool_init();
+        ret = atomic_pool_init();
 
         return ret;
 }
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 71145f952070..ae85da6307bb 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -33,6 +33,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/dma-contiguous.h>
 #include <linux/efi.h>
+#include <linux/swiotlb.h>
 
 #include <asm/fixmap.h>
 #include <asm/memory.h>
@@ -45,6 +46,7 @@
 #include "mm.h"
 
 phys_addr_t memstart_addr __read_mostly = 0;
+phys_addr_t arm64_dma_phys_limit __read_mostly;
 
 #ifdef CONFIG_BLK_DEV_INITRD
 static int __init early_initrd(char *p)
@@ -85,7 +87,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 
         /* 4GB maximum for 32-bit only capable devices */
         if (IS_ENABLED(CONFIG_ZONE_DMA)) {
-                max_dma = PFN_DOWN(max_zone_dma_phys());
+                max_dma = PFN_DOWN(arm64_dma_phys_limit);
                 zone_size[ZONE_DMA] = max_dma - min;
         }
         zone_size[ZONE_NORMAL] = max - max_dma;
@@ -156,8 +158,6 @@ early_param("mem", early_mem);
 
 void __init arm64_memblock_init(void)
 {
-        phys_addr_t dma_phys_limit = 0;
-
         memblock_enforce_memory_limit(memory_limit);
 
         /*
@@ -174,8 +174,10 @@ void __init arm64_memblock_init(void)
 
         /* 4GB maximum for 32-bit only capable devices */
         if (IS_ENABLED(CONFIG_ZONE_DMA))
-                dma_phys_limit = max_zone_dma_phys();
-        dma_contiguous_reserve(dma_phys_limit);
+                arm64_dma_phys_limit = max_zone_dma_phys();
+        else
+                arm64_dma_phys_limit = PHYS_MASK + 1;
+        dma_contiguous_reserve(arm64_dma_phys_limit);
 
         memblock_allow_resize();
         memblock_dump_all();
@@ -276,6 +278,8 @@ static void __init free_unused_memmap(void)
  */
 void __init mem_init(void)
 {
+        swiotlb_init(1);
+
         set_max_mapnr(pfn_to_page(max_pfn) - mem_map);
 
 #ifndef CONFIG_SPARSEMEM_VMEMMAP
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index bb0ea94c4ba1..1d3ec3ddd84b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -51,7 +51,10 @@ static int change_memory_common(unsigned long addr, int numpages,
                 WARN_ON_ONCE(1);
         }
 
-        if (!is_module_address(start) || !is_module_address(end - 1))
+        if (start < MODULES_VADDR || start >= MODULES_END)
+                return -EINVAL;
+
+        if (end < MODULES_VADDR || end >= MODULES_END)
                 return -EINVAL;
 
         data.set_mask = set_mask;
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index 93bcf2abd1a1..07d7a7ef8bd5 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -123,12 +123,14 @@ extern unsigned long empty_zero_page;
 #define PGDIR_MASK              (~(PGDIR_SIZE - 1))
 #define PTRS_PER_PGD            64
 
+#define __PAGETABLE_PUD_FOLDED
 #define PUD_SHIFT               26
 #define PTRS_PER_PUD            1
 #define PUD_SIZE                (1UL << PUD_SHIFT)
 #define PUD_MASK                (~(PUD_SIZE - 1))
 #define PUE_SIZE                256
 
+#define __PAGETABLE_PMD_FOLDED
 #define PMD_SHIFT               26
 #define PMD_SIZE                (1UL << PMD_SHIFT)
 #define PMD_MASK                (~(PMD_SIZE - 1))
diff --git a/arch/m32r/include/asm/pgtable-2level.h b/arch/m32r/include/asm/pgtable-2level.h
index 8fd8ee70266a..421e6ba3a173 100644
--- a/arch/m32r/include/asm/pgtable-2level.h
+++ b/arch/m32r/include/asm/pgtable-2level.h
@@ -13,6 +13,7 @@
  * the M32R is two-level, so we don't really have any
  * PMD directory physically.
  */
+#define __PAGETABLE_PMD_FOLDED
 #define PMD_SHIFT       22
 #define PTRS_PER_PMD    1
 
diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
index 28a145bfbb71..35ed4a9981ae 100644
--- a/arch/m68k/include/asm/pgtable_mm.h
+++ b/arch/m68k/include/asm/pgtable_mm.h
@@ -54,10 +54,12 @@
  */
 #ifdef CONFIG_SUN3
 #define PTRS_PER_PTE   16
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PMD   1
 #define PTRS_PER_PGD   2048
 #elif defined(CONFIG_COLDFIRE)
 #define PTRS_PER_PTE    512
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PMD    1
 #define PTRS_PER_PGD    1024
 #else
diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
index 881071c07942..13272fd5a5ba 100644
--- a/arch/metag/include/asm/processor.h
+++ b/arch/metag/include/asm/processor.h
@@ -149,8 +149,8 @@ extern void exit_thread(void);
 
 unsigned long get_wchan(struct task_struct *p);
 
-#define KSTK_EIP(tsk)   ((tsk)->thread.kernel_context->CurrPC)
-#define KSTK_ESP(tsk)   ((tsk)->thread.kernel_context->AX[0].U0)
+#define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ctx.CurrPC)
+#define KSTK_ESP(tsk)   (task_pt_regs(tsk)->ctx.AX[0].U0)
 
 #define user_stack_pointer(regs)        ((regs)->ctx.AX[0].U0)
 
diff --git a/arch/mips/include/asm/asmmacro-32.h b/arch/mips/include/asm/asmmacro-32.h
index cdac7b3eeaf7..80386470d3a4 100644
--- a/arch/mips/include/asm/asmmacro-32.h
+++ b/arch/mips/include/asm/asmmacro-32.h
@@ -16,38 +16,38 @@
         .set push
         SET_HARDFLOAT
         cfc1    \tmp,  fcr31
-        swc1    $f0,  THREAD_FPR0_LS64(\thread)
-        swc1    $f1,  THREAD_FPR1_LS64(\thread)
-        swc1    $f2,  THREAD_FPR2_LS64(\thread)
-        swc1    $f3,  THREAD_FPR3_LS64(\thread)
-        swc1    $f4,  THREAD_FPR4_LS64(\thread)
-        swc1    $f5,  THREAD_FPR5_LS64(\thread)
-        swc1    $f6,  THREAD_FPR6_LS64(\thread)
-        swc1    $f7,  THREAD_FPR7_LS64(\thread)
-        swc1    $f8,  THREAD_FPR8_LS64(\thread)
-        swc1    $f9,  THREAD_FPR9_LS64(\thread)
-        swc1    $f10, THREAD_FPR10_LS64(\thread)
-        swc1    $f11, THREAD_FPR11_LS64(\thread)
-        swc1    $f12, THREAD_FPR12_LS64(\thread)
-        swc1    $f13, THREAD_FPR13_LS64(\thread)
-        swc1    $f14, THREAD_FPR14_LS64(\thread)
-        swc1    $f15, THREAD_FPR15_LS64(\thread)
-        swc1    $f16, THREAD_FPR16_LS64(\thread)
-        swc1    $f17, THREAD_FPR17_LS64(\thread)
-        swc1    $f18, THREAD_FPR18_LS64(\thread)
-        swc1    $f19, THREAD_FPR19_LS64(\thread)
-        swc1    $f20, THREAD_FPR20_LS64(\thread)
-        swc1    $f21, THREAD_FPR21_LS64(\thread)
-        swc1    $f22, THREAD_FPR22_LS64(\thread)
-        swc1    $f23, THREAD_FPR23_LS64(\thread)
-        swc1    $f24, THREAD_FPR24_LS64(\thread)
-        swc1    $f25, THREAD_FPR25_LS64(\thread)
-        swc1    $f26, THREAD_FPR26_LS64(\thread)
-        swc1    $f27, THREAD_FPR27_LS64(\thread)
-        swc1    $f28, THREAD_FPR28_LS64(\thread)
-        swc1    $f29, THREAD_FPR29_LS64(\thread)
-        swc1    $f30, THREAD_FPR30_LS64(\thread)
-        swc1    $f31, THREAD_FPR31_LS64(\thread)
+        swc1    $f0,  THREAD_FPR0(\thread)
+        swc1    $f1,  THREAD_FPR1(\thread)
+        swc1    $f2,  THREAD_FPR2(\thread)
+        swc1    $f3,  THREAD_FPR3(\thread)
+        swc1    $f4,  THREAD_FPR4(\thread)
+        swc1    $f5,  THREAD_FPR5(\thread)
+        swc1    $f6,  THREAD_FPR6(\thread)
+        swc1    $f7,  THREAD_FPR7(\thread)
+        swc1    $f8,  THREAD_FPR8(\thread)
+        swc1    $f9,  THREAD_FPR9(\thread)
+        swc1    $f10, THREAD_FPR10(\thread)
+        swc1    $f11, THREAD_FPR11(\thread)
+        swc1    $f12, THREAD_FPR12(\thread)
+        swc1    $f13, THREAD_FPR13(\thread)
+        swc1    $f14, THREAD_FPR14(\thread)
+        swc1    $f15, THREAD_FPR15(\thread)
+        swc1    $f16, THREAD_FPR16(\thread)
+        swc1    $f17, THREAD_FPR17(\thread)
+        swc1    $f18, THREAD_FPR18(\thread)
+        swc1    $f19, THREAD_FPR19(\thread)
+        swc1    $f20, THREAD_FPR20(\thread)
+        swc1    $f21, THREAD_FPR21(\thread)
+        swc1    $f22, THREAD_FPR22(\thread)
+        swc1    $f23, THREAD_FPR23(\thread)
+        swc1    $f24, THREAD_FPR24(\thread)
+        swc1    $f25, THREAD_FPR25(\thread)
+        swc1    $f26, THREAD_FPR26(\thread)
+        swc1    $f27, THREAD_FPR27(\thread)
+        swc1    $f28, THREAD_FPR28(\thread)
+        swc1    $f29, THREAD_FPR29(\thread)
+        swc1    $f30, THREAD_FPR30(\thread)
+        swc1    $f31, THREAD_FPR31(\thread)
         sw      \tmp, THREAD_FCR31(\thread)
         .set pop
         .endm
@@ -56,38 +56,38 @@
         .set push
         SET_HARDFLOAT
         lw      \tmp, THREAD_FCR31(\thread)
-        lwc1    $f0,  THREAD_FPR0_LS64(\thread)
-        lwc1    $f1,  THREAD_FPR1_LS64(\thread)
-        lwc1    $f2,  THREAD_FPR2_LS64(\thread)
-        lwc1    $f3,  THREAD_FPR3_LS64(\thread)
-        lwc1    $f4,  THREAD_FPR4_LS64(\thread)
-        lwc1    $f5,  THREAD_FPR5_LS64(\thread)
-        lwc1    $f6,  THREAD_FPR6_LS64(\thread)
-        lwc1    $f7,  THREAD_FPR7_LS64(\thread)
-        lwc1    $f8,  THREAD_FPR8_LS64(\thread)
-        lwc1    $f9,  THREAD_FPR9_LS64(\thread)
-        lwc1    $f10, THREAD_FPR10_LS64(\thread)
-        lwc1    $f11, THREAD_FPR11_LS64(\thread)
-        lwc1    $f12, THREAD_FPR12_LS64(\thread)
-        lwc1    $f13, THREAD_FPR13_LS64(\thread)
-        lwc1    $f14, THREAD_FPR14_LS64(\thread)
-        lwc1    $f15, THREAD_FPR15_LS64(\thread)
-        lwc1    $f16, THREAD_FPR16_LS64(\thread)
-        lwc1    $f17, THREAD_FPR17_LS64(\thread)
-        lwc1    $f18, THREAD_FPR18_LS64(\thread)
-        lwc1    $f19, THREAD_FPR19_LS64(\thread)
-        lwc1    $f20, THREAD_FPR20_LS64(\thread)
-        lwc1    $f21, THREAD_FPR21_LS64(\thread)
-        lwc1    $f22, THREAD_FPR22_LS64(\thread)
-        lwc1    $f23, THREAD_FPR23_LS64(\thread)
-        lwc1    $f24, THREAD_FPR24_LS64(\thread)
-        lwc1    $f25, THREAD_FPR25_LS64(\thread)
-        lwc1    $f26, THREAD_FPR26_LS64(\thread)
-        lwc1    $f27, THREAD_FPR27_LS64(\thread)
-        lwc1    $f28, THREAD_FPR28_LS64(\thread)
-        lwc1    $f29, THREAD_FPR29_LS64(\thread)
-        lwc1    $f30, THREAD_FPR30_LS64(\thread)
-        lwc1    $f31, THREAD_FPR31_LS64(\thread)
+        lwc1    $f0,  THREAD_FPR0(\thread)
+        lwc1    $f1,  THREAD_FPR1(\thread)
+        lwc1    $f2,  THREAD_FPR2(\thread)
+        lwc1    $f3,  THREAD_FPR3(\thread)
+        lwc1    $f4,  THREAD_FPR4(\thread)
+        lwc1    $f5,  THREAD_FPR5(\thread)
+        lwc1    $f6,  THREAD_FPR6(\thread)
+        lwc1    $f7,  THREAD_FPR7(\thread)
+        lwc1    $f8,  THREAD_FPR8(\thread)
+        lwc1    $f9,  THREAD_FPR9(\thread)
+        lwc1    $f10, THREAD_FPR10(\thread)
+        lwc1    $f11, THREAD_FPR11(\thread)
+        lwc1    $f12, THREAD_FPR12(\thread)
+        lwc1    $f13, THREAD_FPR13(\thread)
+        lwc1    $f14, THREAD_FPR14(\thread)
+        lwc1    $f15, THREAD_FPR15(\thread)
+        lwc1    $f16, THREAD_FPR16(\thread)
+        lwc1    $f17, THREAD_FPR17(\thread)
+        lwc1    $f18, THREAD_FPR18(\thread)
+        lwc1    $f19, THREAD_FPR19(\thread)
+        lwc1    $f20, THREAD_FPR20(\thread)
+        lwc1    $f21, THREAD_FPR21(\thread)
+        lwc1    $f22, THREAD_FPR22(\thread)
+        lwc1    $f23, THREAD_FPR23(\thread)
+        lwc1    $f24, THREAD_FPR24(\thread)
+        lwc1    $f25, THREAD_FPR25(\thread)
+        lwc1    $f26, THREAD_FPR26(\thread)
+        lwc1    $f27, THREAD_FPR27(\thread)
+        lwc1    $f28, THREAD_FPR28(\thread)
+        lwc1    $f29, THREAD_FPR29(\thread)
+        lwc1    $f30, THREAD_FPR30(\thread)
+        lwc1    $f31, THREAD_FPR31(\thread)
         ctc1    \tmp, fcr31
         .set pop
         .endm
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index 0cae4595e985..6156ac8c4cfb 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -60,22 +60,22 @@
         .set    push
         SET_HARDFLOAT
         cfc1    \tmp, fcr31
-        sdc1    $f0,  THREAD_FPR0_LS64(\thread)
-        sdc1    $f2,  THREAD_FPR2_LS64(\thread)
-        sdc1    $f4,  THREAD_FPR4_LS64(\thread)
-        sdc1    $f6,  THREAD_FPR6_LS64(\thread)
-        sdc1    $f8,  THREAD_FPR8_LS64(\thread)
-        sdc1    $f10, THREAD_FPR10_LS64(\thread)
-        sdc1    $f12, THREAD_FPR12_LS64(\thread)
-        sdc1    $f14, THREAD_FPR14_LS64(\thread)
-        sdc1    $f16, THREAD_FPR16_LS64(\thread)
-        sdc1    $f18, THREAD_FPR18_LS64(\thread)
-        sdc1    $f20, THREAD_FPR20_LS64(\thread)
-        sdc1    $f22, THREAD_FPR22_LS64(\thread)
-        sdc1    $f24, THREAD_FPR24_LS64(\thread)
-        sdc1    $f26, THREAD_FPR26_LS64(\thread)
-        sdc1    $f28, THREAD_FPR28_LS64(\thread)
-        sdc1    $f30, THREAD_FPR30_LS64(\thread)
+        sdc1    $f0,  THREAD_FPR0(\thread)
+        sdc1    $f2,  THREAD_FPR2(\thread)
+        sdc1    $f4,  THREAD_FPR4(\thread)
+        sdc1    $f6,  THREAD_FPR6(\thread)
+        sdc1    $f8,  THREAD_FPR8(\thread)
+        sdc1    $f10, THREAD_FPR10(\thread)
+        sdc1    $f12, THREAD_FPR12(\thread)
+        sdc1    $f14, THREAD_FPR14(\thread)
+        sdc1    $f16, THREAD_FPR16(\thread)
+        sdc1    $f18, THREAD_FPR18(\thread)
+        sdc1    $f20, THREAD_FPR20(\thread)
+        sdc1    $f22, THREAD_FPR22(\thread)
+        sdc1    $f24, THREAD_FPR24(\thread)
+        sdc1    $f26, THREAD_FPR26(\thread)
+        sdc1    $f28, THREAD_FPR28(\thread)
+        sdc1    $f30, THREAD_FPR30(\thread)
         sw      \tmp, THREAD_FCR31(\thread)
         .set    pop
         .endm
@@ -84,22 +84,22 @@
         .set    push
         .set    mips64r2
         SET_HARDFLOAT
-        sdc1    $f1,  THREAD_FPR1_LS64(\thread)
-        sdc1    $f3,  THREAD_FPR3_LS64(\thread)
-        sdc1    $f5,  THREAD_FPR5_LS64(\thread)
-        sdc1    $f7,  THREAD_FPR7_LS64(\thread)
-        sdc1    $f9,  THREAD_FPR9_LS64(\thread)
-        sdc1    $f11, THREAD_FPR11_LS64(\thread)
-        sdc1    $f13, THREAD_FPR13_LS64(\thread)
-        sdc1    $f15, THREAD_FPR15_LS64(\thread)
-        sdc1    $f17, THREAD_FPR17_LS64(\thread)
-        sdc1    $f19, THREAD_FPR19_LS64(\thread)
-        sdc1    $f21, THREAD_FPR21_LS64(\thread)
-        sdc1    $f23, THREAD_FPR23_LS64(\thread)
-        sdc1    $f25, THREAD_FPR25_LS64(\thread)
-        sdc1    $f27, THREAD_FPR27_LS64(\thread)
-        sdc1    $f29, THREAD_FPR29_LS64(\thread)
-        sdc1    $f31, THREAD_FPR31_LS64(\thread)
+        sdc1    $f1,  THREAD_FPR1(\thread)
+        sdc1    $f3,  THREAD_FPR3(\thread)
+        sdc1    $f5,  THREAD_FPR5(\thread)
+        sdc1    $f7,  THREAD_FPR7(\thread)
+        sdc1    $f9,  THREAD_FPR9(\thread)
+        sdc1    $f11, THREAD_FPR11(\thread)
+        sdc1    $f13, THREAD_FPR13(\thread)
+        sdc1    $f15, THREAD_FPR15(\thread)
+        sdc1    $f17, THREAD_FPR17(\thread)
+        sdc1    $f19, THREAD_FPR19(\thread)
+        sdc1    $f21, THREAD_FPR21(\thread)
+        sdc1    $f23, THREAD_FPR23(\thread)
+        sdc1    $f25, THREAD_FPR25(\thread)
+        sdc1    $f27, THREAD_FPR27(\thread)
+        sdc1    $f29, THREAD_FPR29(\thread)
+        sdc1    $f31, THREAD_FPR31(\thread)
         .set    pop
         .endm
 
@@ -118,22 +118,22 @@
         .set    push
         SET_HARDFLOAT
         lw      \tmp, THREAD_FCR31(\thread)
-        ldc1    $f0,  THREAD_FPR0_LS64(\thread)
-        ldc1    $f2,  THREAD_FPR2_LS64(\thread)
-        ldc1    $f4,  THREAD_FPR4_LS64(\thread)
-        ldc1    $f6,  THREAD_FPR6_LS64(\thread)
-        ldc1    $f8,  THREAD_FPR8_LS64(\thread)
-        ldc1    $f10, THREAD_FPR10_LS64(\thread)
-        ldc1    $f12, THREAD_FPR12_LS64(\thread)
-        ldc1    $f14, THREAD_FPR14_LS64(\thread)
-        ldc1    $f16, THREAD_FPR16_LS64(\thread)
-        ldc1    $f18, THREAD_FPR18_LS64(\thread)
-        ldc1    $f20, THREAD_FPR20_LS64(\thread)
-        ldc1    $f22, THREAD_FPR22_LS64(\thread)
-        ldc1    $f24, THREAD_FPR24_LS64(\thread)
-        ldc1    $f26, THREAD_FPR26_LS64(\thread)
-        ldc1    $f28, THREAD_FPR28_LS64(\thread)
-        ldc1    $f30, THREAD_FPR30_LS64(\thread)
+        ldc1    $f0,  THREAD_FPR0(\thread)
+        ldc1    $f2,  THREAD_FPR2(\thread)
+        ldc1    $f4,  THREAD_FPR4(\thread)
+        ldc1    $f6,  THREAD_FPR6(\thread)
+        ldc1    $f8,  THREAD_FPR8(\thread)
+        ldc1    $f10, THREAD_FPR10(\thread)
+        ldc1    $f12, THREAD_FPR12(\thread)
+        ldc1    $f14, THREAD_FPR14(\thread)
+        ldc1    $f16, THREAD_FPR16(\thread)
+        ldc1    $f18, THREAD_FPR18(\thread)
+        ldc1    $f20, THREAD_FPR20(\thread)
+        ldc1    $f22, THREAD_FPR22(\thread)
+        ldc1    $f24, THREAD_FPR24(\thread)
+        ldc1    $f26, THREAD_FPR26(\thread)
+        ldc1    $f28, THREAD_FPR28(\thread)
+        ldc1    $f30, THREAD_FPR30(\thread)
         ctc1    \tmp, fcr31
         .endm
 
@@ -141,22 +141,22 @@
         .set    push
         .set    mips64r2
         SET_HARDFLOAT
-        ldc1    $f1,  THREAD_FPR1_LS64(\thread)
-        ldc1    $f3,  THREAD_FPR3_LS64(\thread)
-        ldc1    $f5,  THREAD_FPR5_LS64(\thread)
-        ldc1    $f7,  THREAD_FPR7_LS64(\thread)
-        ldc1    $f9,  THREAD_FPR9_LS64(\thread)
-        ldc1    $f11, THREAD_FPR11_LS64(\thread)
-        ldc1    $f13, THREAD_FPR13_LS64(\thread)
-        ldc1    $f15, THREAD_FPR15_LS64(\thread)
-        ldc1    $f17, THREAD_FPR17_LS64(\thread)
-        ldc1    $f19, THREAD_FPR19_LS64(\thread)
-        ldc1    $f21, THREAD_FPR21_LS64(\thread)
-        ldc1    $f23, THREAD_FPR23_LS64(\thread)
-        ldc1    $f25, THREAD_FPR25_LS64(\thread)
-        ldc1    $f27, THREAD_FPR27_LS64(\thread)
-        ldc1    $f29, THREAD_FPR29_LS64(\thread)
-        ldc1    $f31, THREAD_FPR31_LS64(\thread)
+        ldc1    $f1,  THREAD_FPR1(\thread)
+        ldc1    $f3,  THREAD_FPR3(\thread)
+        ldc1    $f5,  THREAD_FPR5(\thread)
+        ldc1    $f7,  THREAD_FPR7(\thread)
+        ldc1    $f9,  THREAD_FPR9(\thread)
+        ldc1    $f11, THREAD_FPR11(\thread)
+        ldc1    $f13, THREAD_FPR13(\thread)
+        ldc1    $f15, THREAD_FPR15(\thread)
+        ldc1    $f17, THREAD_FPR17(\thread)
+        ldc1    $f19, THREAD_FPR19(\thread)
+        ldc1    $f21, THREAD_FPR21(\thread)
+        ldc1    $f23, THREAD_FPR23(\thread)
+        ldc1    $f25, THREAD_FPR25(\thread)
+        ldc1    $f27, THREAD_FPR27(\thread)
+        ldc1    $f29, THREAD_FPR29(\thread)
+        ldc1    $f31, THREAD_FPR31(\thread)
         .set    pop
         .endm
 
@@ -211,6 +211,22 @@
         .endm
 
 #ifdef TOOLCHAIN_SUPPORTS_MSA
+        .macro  _cfcmsa rd, cs
+        .set    push
+        .set    mips32r2
+        .set    msa
+        cfcmsa  \rd, $\cs
+        .set    pop
+        .endm
+
+        .macro  _ctcmsa cd, rs
+        .set    push
+        .set    mips32r2
+        .set    msa
+        ctcmsa  $\cd, \rs
+        .set    pop
+        .endm
+
         .macro  ld_d    wd, off, base
         .set    push
         .set    mips32r2
@@ -227,35 +243,35 @@
         .set    pop
         .endm
 
-        .macro  copy_u_w        rd, ws, n
+        .macro  copy_u_w        ws, n
         .set    push
         .set    mips32r2
         .set    msa
-        copy_u.w \rd, $w\ws[\n]
+        copy_u.w $1, $w\ws[\n]
         .set    pop
         .endm
 
-        .macro  copy_u_d        rd, ws, n
+        .macro  copy_u_d        ws, n
         .set    push
         .set    mips64r2
         .set    msa
-        copy_u.d \rd, $w\ws[\n]
+        copy_u.d $1, $w\ws[\n]
         .set    pop
         .endm
 
-        .macro  insert_w        wd, n, rs
+        .macro  insert_w        wd, n
         .set    push
         .set    mips32r2
         .set    msa
-        insert.w $w\wd[\n], \rs
+        insert.w $w\wd[\n], $1
         .set    pop
         .endm
 
-        .macro  insert_d        wd, n, rs
+        .macro  insert_d        wd, n
         .set    push
         .set    mips64r2
         .set    msa
-        insert.d $w\wd[\n], \rs
+        insert.d $w\wd[\n], $1
         .set    pop
         .endm
 #else
@@ -283,7 +299,7 @@
         /*
          * Temporary until all toolchains in use include MSA support.
          */
-        .macro  cfcmsa  rd, cs
+        .macro  _cfcmsa rd, cs
         .set    push
         .set    noat
         SET_HARDFLOAT
@@ -293,7 +309,7 @@
         .set    pop
         .endm
 
-        .macro  ctcmsa  cd, rs
+        .macro  _ctcmsa cd, rs
         .set    push
         .set    noat
         SET_HARDFLOAT
@@ -320,44 +336,36 @@
         .set    pop
         .endm
 
-        .macro  copy_u_w        rd, ws, n
+        .macro  copy_u_w        ws, n
         .set    push
         .set    noat
         SET_HARDFLOAT
         .insn
         .word   COPY_UW_MSA_INSN | (\n << 16) | (\ws << 11)
-        /* move triggers an assembler bug... */
-        or      \rd, $1, zero
         .set    pop
         .endm
 
-        .macro  copy_u_d        rd, ws, n
+        .macro  copy_u_d        ws, n
         .set    push
         .set    noat
         SET_HARDFLOAT
         .insn
         .word   COPY_UD_MSA_INSN | (\n << 16) | (\ws << 11)
-        /* move triggers an assembler bug... */
-        or      \rd, $1, zero
         .set    pop
         .endm
 
-        .macro  insert_w        wd, n, rs
+        .macro  insert_w        wd, n
         .set    push
         .set    noat
         SET_HARDFLOAT
-        /* move triggers an assembler bug... */
-        or      $1, \rs, zero
         .word   INSERT_W_MSA_INSN | (\n << 16) | (\wd << 6)
         .set    pop
         .endm
 
-        .macro  insert_d        wd, n, rs
+        .macro  insert_d        wd, n
         .set    push
         .set    noat
         SET_HARDFLOAT
-        /* move triggers an assembler bug... */
-        or      $1, \rs, zero
         .word   INSERT_D_MSA_INSN | (\n << 16) | (\wd << 6)
         .set    pop
         .endm
@@ -399,7 +407,7 @@
         .set    push
         .set    noat
         SET_HARDFLOAT
-        cfcmsa  $1, MSA_CSR
+        _cfcmsa $1, MSA_CSR
         sw      $1, THREAD_MSA_CSR(\thread)
         .set    pop
         .endm
@@ -409,7 +417,7 @@
         .set    noat
         SET_HARDFLOAT
         lw      $1, THREAD_MSA_CSR(\thread)
-        ctcmsa  MSA_CSR, $1
+        _ctcmsa MSA_CSR, $1
         .set    pop
         ld_d    0, THREAD_FPR0, \thread
         ld_d    1, THREAD_FPR1, \thread
@@ -452,9 +460,6 @@
         insert_w \wd, 2
         insert_w \wd, 3
 #endif
-        .if     31-\wd
-        msa_init_upper  (\wd+1)
-        .endif
         .endm
 
         .macro  msa_init_all_upper
@@ -463,6 +468,37 @@
         SET_HARDFLOAT
         not     $1, zero
         msa_init_upper  0
+        msa_init_upper  1
+        msa_init_upper  2
+        msa_init_upper  3
+        msa_init_upper  4
+        msa_init_upper  5
+        msa_init_upper  6
+        msa_init_upper  7
+        msa_init_upper  8
+        msa_init_upper  9
+        msa_init_upper  10
+        msa_init_upper  11
+        msa_init_upper  12
+        msa_init_upper  13
+        msa_init_upper  14
+        msa_init_upper  15
+        msa_init_upper  16
+        msa_init_upper  17
+        msa_init_upper  18
+        msa_init_upper  19
+        msa_init_upper  20
+        msa_init_upper  21
+        msa_init_upper  22
+        msa_init_upper  23
+        msa_init_upper  24
+        msa_init_upper  25
+        msa_init_upper  26
+        msa_init_upper  27
+        msa_init_upper  28
+        msa_init_upper  29
+        msa_init_upper  30
+        msa_init_upper  31
         .set    pop
         .endm
 
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index dd083e999b08..b104ad9d655f 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -48,6 +48,12 @@ enum fpu_mode {
 #define FPU_FR_MASK             0x1
 };
 
+#define __disable_fpu()                                                 \
+do {                                                                    \
+        clear_c0_status(ST0_CU1);                                       \
+        disable_fpu_hazard();                                           \
+} while (0)
+
 static inline int __enable_fpu(enum fpu_mode mode)
 {
         int fr;
@@ -86,7 +92,12 @@ fr_common:
                 enable_fpu_hazard();
 
                 /* check FR has the desired value */
-                return (!!(read_c0_status() & ST0_FR) == !!fr) ? 0 : SIGFPE;
+                if (!!(read_c0_status() & ST0_FR) == !!fr)
+                        return 0;
+
+                /* unsupported FR value */
+                __disable_fpu();
+                return SIGFPE;
 
         default:
                 BUG();
@@ -95,12 +106,6 @@ fr_common:
         return SIGFPE;
 }
 
-#define __disable_fpu()                                                 \
-do {                                                                    \
-        clear_c0_status(ST0_CU1);                                       \
-        disable_fpu_hazard();                                           \
-} while (0)
-
 #define clear_fpu_owner()       clear_thread_flag(TIF_USEDFPU)
 
 static inline int __is_fpu_owner(void)
@@ -170,6 +175,7 @@ static inline void lose_fpu(int save)
                 }
                 disable_msa();
                 clear_thread_flag(TIF_USEDMSA);
+                __disable_fpu();
         } else if (is_fpu_owner()) {
                 if (save)
                         _save_fp(current);
diff --git a/arch/mips/include/asm/kdebug.h b/arch/mips/include/asm/kdebug.h
index 6a9af5fcb5d7..cba22ab7ad4d 100644
--- a/arch/mips/include/asm/kdebug.h
+++ b/arch/mips/include/asm/kdebug.h
@@ -10,7 +10,8 @@ enum die_val {
         DIE_RI,
         DIE_PAGE_FAULT,
         DIE_BREAK,
-        DIE_SSTEPBP
+        DIE_SSTEPBP,
+        DIE_MSAFP
 };
 
 #endif /* _ASM_MIPS_KDEBUG_H */
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index ac4fc716062b..4c25823563fe 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -21,10 +21,10 @@
 
 /* MIPS KVM register ids */
 #define MIPS_CP0_32(_R, _S)                                     \
-        (KVM_REG_MIPS | KVM_REG_SIZE_U32 | 0x10000 | (8 * (_R) + (_S)))
+        (KVM_REG_MIPS_CP0 | KVM_REG_SIZE_U32 | (8 * (_R) + (_S)))
 
 #define MIPS_CP0_64(_R, _S)                                     \
-        (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 0x10000 | (8 * (_R) + (_S)))
+        (KVM_REG_MIPS_CP0 | KVM_REG_SIZE_U64 | (8 * (_R) + (_S)))
 
 #define KVM_REG_MIPS_CP0_INDEX          MIPS_CP0_32(0, 0)
 #define KVM_REG_MIPS_CP0_ENTRYLO0       MIPS_CP0_64(2, 0)
@@ -42,11 +42,14 @@
 #define KVM_REG_MIPS_CP0_STATUS         MIPS_CP0_32(12, 0)
 #define KVM_REG_MIPS_CP0_CAUSE          MIPS_CP0_32(13, 0)
 #define KVM_REG_MIPS_CP0_EPC            MIPS_CP0_64(14, 0)
+#define KVM_REG_MIPS_CP0_PRID           MIPS_CP0_32(15, 0)
 #define KVM_REG_MIPS_CP0_EBASE          MIPS_CP0_64(15, 1)
 #define KVM_REG_MIPS_CP0_CONFIG         MIPS_CP0_32(16, 0)
 #define KVM_REG_MIPS_CP0_CONFIG1        MIPS_CP0_32(16, 1)
 #define KVM_REG_MIPS_CP0_CONFIG2        MIPS_CP0_32(16, 2)
 #define KVM_REG_MIPS_CP0_CONFIG3        MIPS_CP0_32(16, 3)
+#define KVM_REG_MIPS_CP0_CONFIG4        MIPS_CP0_32(16, 4)
+#define KVM_REG_MIPS_CP0_CONFIG5        MIPS_CP0_32(16, 5)
 #define KVM_REG_MIPS_CP0_CONFIG7        MIPS_CP0_32(16, 7)
 #define KVM_REG_MIPS_CP0_XCONTEXT       MIPS_CP0_64(20, 0)
 #define KVM_REG_MIPS_CP0_ERROREPC       MIPS_CP0_64(30, 0)
@@ -119,6 +122,10 @@ struct kvm_vcpu_stat {
         u32 syscall_exits;
         u32 resvd_inst_exits;
         u32 break_inst_exits;
+        u32 trap_inst_exits;
+        u32 msa_fpe_exits;
+        u32 fpe_exits;
+        u32 msa_disabled_exits;
         u32 flush_dcache_exits;
         u32 halt_successful_poll;
         u32 halt_wakeup;
@@ -138,6 +145,10 @@ enum kvm_mips_exit_types {
         SYSCALL_EXITS,
         RESVD_INST_EXITS,
         BREAK_INST_EXITS,
+        TRAP_INST_EXITS,
+        MSA_FPE_EXITS,
+        FPE_EXITS,
+        MSA_DISABLED_EXITS,
         FLUSH_DCACHE_EXITS,
         MAX_KVM_MIPS_EXIT_TYPES
 };
@@ -206,6 +217,8 @@ struct mips_coproc {
 #define MIPS_CP0_CONFIG1_SEL    1
 #define MIPS_CP0_CONFIG2_SEL    2
 #define MIPS_CP0_CONFIG3_SEL    3
+#define MIPS_CP0_CONFIG4_SEL    4
+#define MIPS_CP0_CONFIG5_SEL    5
 
 /* Config0 register bits */
 #define CP0C0_M                 31
@@ -262,31 +275,6 @@ struct mips_coproc {
 #define CP0C3_SM                1
 #define CP0C3_TL                0
 
-/* Have config1, Cacheable, noncoherent, write-back, write allocate*/
-#define MIPS_CONFIG0                                            \
-  ((1 << CP0C0_M) | (0x3 << CP0C0_K0))
-
-/* Have config2, no coprocessor2 attached, no MDMX support attached,
-   no performance counters, watch registers present,
-   no code compression, EJTAG present, no FPU, no watch registers */
-#define MIPS_CONFIG1                                            \
-((1 << CP0C1_M) |                                               \
- (0 << CP0C1_C2) | (0 << CP0C1_MD) | (0 << CP0C1_PC) |          \
- (0 << CP0C1_WR) | (0 << CP0C1_CA) | (1 << CP0C1_EP) |          \
- (0 << CP0C1_FP))
-
-/* Have config3, no tertiary/secondary caches implemented */
-#define MIPS_CONFIG2                                            \
-((1 << CP0C2_M))
-
-/* No config4, no DSP ASE, no large physaddr (PABITS),
-   no external interrupt controller, no vectored interrupts,
-   no 1kb pages, no SmartMIPS ASE, no trace logic */
-#define MIPS_CONFIG3                                            \
-((0 << CP0C3_M) | (0 << CP0C3_DSPP) | (0 << CP0C3_LPA) |        \
- (0 << CP0C3_VEIC) | (0 << CP0C3_VInt) | (0 << CP0C3_SP) |      \
- (0 << CP0C3_SM) | (0 << CP0C3_TL))
-
 /* MMU types, the first four entries have the same layout as the
    CP0C0_MT field.  */
 enum mips_mmu_types {
@@ -321,7 +309,9 @@ enum mips_mmu_types {
  */
 #define T_TRAP                  13      /* Trap instruction */
 #define T_VCEI                  14      /* Virtual coherency exception */
+#define T_MSAFPE                14      /* MSA floating point exception */
 #define T_FPE                   15      /* Floating point exception */
+#define T_MSADIS                21      /* MSA disabled exception */
 #define T_WATCH                 23      /* Watch address reference */
 #define T_VCED                  31      /* Virtual coherency data */
 
@@ -374,6 +364,9 @@ struct kvm_mips_tlb {
         long tlb_lo1;
 };
 
+#define KVM_MIPS_FPU_FPU        0x1
+#define KVM_MIPS_FPU_MSA        0x2
+
 #define KVM_MIPS_GUEST_TLB_SIZE 64
 struct kvm_vcpu_arch {
         void *host_ebase, *guest_ebase;
@@ -395,6 +388,8 @@ struct kvm_vcpu_arch {
 
         /* FPU State */
         struct mips_fpu_struct fpu;
+        /* Which FPU state is loaded (KVM_MIPS_FPU_*) */
+        unsigned int fpu_inuse;
 
         /* COP0 State */
         struct mips_coproc *cop0;
@@ -441,6 +436,9 @@ struct kvm_vcpu_arch {
 
         /* WAIT executed */
         int wait;
+
+        u8 fpu_enabled;
+        u8 msa_enabled;
 };
 
 
@@ -482,11 +480,15 @@ struct kvm_vcpu_arch {
 #define kvm_read_c0_guest_config1(cop0)         (cop0->reg[MIPS_CP0_CONFIG][1])
 #define kvm_read_c0_guest_config2(cop0)         (cop0->reg[MIPS_CP0_CONFIG][2])
 #define kvm_read_c0_guest_config3(cop0)         (cop0->reg[MIPS_CP0_CONFIG][3])
+#define kvm_read_c0_guest_config4(cop0)         (cop0->reg[MIPS_CP0_CONFIG][4])
+#define kvm_read_c0_guest_config5(cop0)         (cop0->reg[MIPS_CP0_CONFIG][5])
 #define kvm_read_c0_guest_config7(cop0)         (cop0->reg[MIPS_CP0_CONFIG][7])
 #define kvm_write_c0_guest_config(cop0, val)    (cop0->reg[MIPS_CP0_CONFIG][0] = (val))
 #define kvm_write_c0_guest_config1(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][1] = (val))
 #define kvm_write_c0_guest_config2(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][2] = (val))
 #define kvm_write_c0_guest_config3(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][3] = (val))
+#define kvm_write_c0_guest_config4(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][4] = (val))
+#define kvm_write_c0_guest_config5(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][5] = (val))
 #define kvm_write_c0_guest_config7(cop0, val)   (cop0->reg[MIPS_CP0_CONFIG][7] = (val))
 #define kvm_read_c0_guest_errorepc(cop0)        (cop0->reg[MIPS_CP0_ERROR_PC][0])
 #define kvm_write_c0_guest_errorepc(cop0, val)  (cop0->reg[MIPS_CP0_ERROR_PC][0] = (val))
@@ -567,6 +569,31 @@ static inline void _kvm_atomic_change_c0_guest_reg(unsigned long *reg,
         kvm_set_c0_guest_ebase(cop0, ((val) & (change)));               \
 }
 
+/* Helpers */
+
+static inline bool kvm_mips_guest_can_have_fpu(struct kvm_vcpu_arch *vcpu)
+{
+        return (!__builtin_constant_p(cpu_has_fpu) || cpu_has_fpu) &&
+                vcpu->fpu_enabled;
+}
+
+static inline bool kvm_mips_guest_has_fpu(struct kvm_vcpu_arch *vcpu)
+{
+        return kvm_mips_guest_can_have_fpu(vcpu) &&
+                kvm_read_c0_guest_config1(vcpu->cop0) & MIPS_CONF1_FP;
+}
+
+static inline bool kvm_mips_guest_can_have_msa(struct kvm_vcpu_arch *vcpu)
+{
+        return (!__builtin_constant_p(cpu_has_msa) || cpu_has_msa) &&
+                vcpu->msa_enabled;
+}
+
+static inline bool kvm_mips_guest_has_msa(struct kvm_vcpu_arch *vcpu)
+{
+        return kvm_mips_guest_can_have_msa(vcpu) &&
+                kvm_read_c0_guest_config3(vcpu->cop0) & MIPS_CONF3_MSA;
+}
 
 struct kvm_mips_callbacks {
         int (*handle_cop_unusable)(struct kvm_vcpu *vcpu);
@@ -578,6 +605,10 @@ struct kvm_mips_callbacks {
         int (*handle_syscall)(struct kvm_vcpu *vcpu);
         int (*handle_res_inst)(struct kvm_vcpu *vcpu);
         int (*handle_break)(struct kvm_vcpu *vcpu);
+        int (*handle_trap)(struct kvm_vcpu *vcpu);
+        int (*handle_msa_fpe)(struct kvm_vcpu *vcpu);
+        int (*handle_fpe)(struct kvm_vcpu *vcpu);
+        int (*handle_msa_disabled)(struct kvm_vcpu *vcpu);
         int (*vm_init)(struct kvm *kvm);
         int (*vcpu_init)(struct kvm_vcpu *vcpu);
         int (*vcpu_setup)(struct kvm_vcpu *vcpu);
@@ -596,6 +627,8 @@ struct kvm_mips_callbacks {
                            const struct kvm_one_reg *reg, s64 *v);
         int (*set_one_reg)(struct kvm_vcpu *vcpu,
                            const struct kvm_one_reg *reg, s64 v);
+        int (*vcpu_get_regs)(struct kvm_vcpu *vcpu);
+        int (*vcpu_set_regs)(struct kvm_vcpu *vcpu);
 };
 extern struct kvm_mips_callbacks *kvm_mips_callbacks;
 int kvm_mips_emulation_init(struct kvm_mips_callbacks **install_callbacks);
@@ -606,6 +639,19 @@ int kvm_arch_vcpu_dump_regs(struct kvm_vcpu *vcpu);
 /* Trampoline ASM routine to start running in "Guest" context */
 extern int __kvm_mips_vcpu_run(struct kvm_run *run, struct kvm_vcpu *vcpu);
 
+/* FPU/MSA context management */
+void __kvm_save_fpu(struct kvm_vcpu_arch *vcpu);
+void __kvm_restore_fpu(struct kvm_vcpu_arch *vcpu);
+void __kvm_restore_fcsr(struct kvm_vcpu_arch *vcpu);
+void __kvm_save_msa(struct kvm_vcpu_arch *vcpu);
+void __kvm_restore_msa(struct kvm_vcpu_arch *vcpu);
+void __kvm_restore_msa_upper(struct kvm_vcpu_arch *vcpu);
+void __kvm_restore_msacsr(struct kvm_vcpu_arch *vcpu);
+void kvm_own_fpu(struct kvm_vcpu *vcpu);
+void kvm_own_msa(struct kvm_vcpu *vcpu);
+void kvm_drop_fpu(struct kvm_vcpu *vcpu);
+void kvm_lose_fpu(struct kvm_vcpu *vcpu);
+
 /* TLB handling */
 uint32_t kvm_get_kernel_asid(struct kvm_vcpu *vcpu);
 
@@ -711,6 +757,26 @@ extern enum emulation_result kvm_mips_emulate_bp_exc(unsigned long cause,
                                                      struct kvm_run *run,
                                                      struct kvm_vcpu *vcpu);
 
+extern enum emulation_result kvm_mips_emulate_trap_exc(unsigned long cause,
+                                                       uint32_t *opc,
+                                                       struct kvm_run *run,
+                                                       struct kvm_vcpu *vcpu);
+
+extern enum emulation_result kvm_mips_emulate_msafpe_exc(unsigned long cause,
+                                                         uint32_t *opc,
+                                                         struct kvm_run *run,
+                                                         struct kvm_vcpu *vcpu);
+
+extern enum emulation_result kvm_mips_emulate_fpe_exc(unsigned long cause,
+                                                      uint32_t *opc,
+                                                      struct kvm_run *run,
+                                                      struct kvm_vcpu *vcpu);
+
+extern enum emulation_result kvm_mips_emulate_msadis_exc(unsigned long cause,
+                                                         uint32_t *opc,
+                                                         struct kvm_run *run,
+                                                         struct kvm_vcpu *vcpu);
+
 extern enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
                                                          struct kvm_run *run);
 
@@ -749,6 +815,11 @@ enum emulation_result kvm_mips_emulate_load(uint32_t inst,
                                             struct kvm_run *run,
                                             struct kvm_vcpu *vcpu);
 
+unsigned int kvm_mips_config1_wrmask(struct kvm_vcpu *vcpu);
+unsigned int kvm_mips_config3_wrmask(struct kvm_vcpu *vcpu);
+unsigned int kvm_mips_config4_wrmask(struct kvm_vcpu *vcpu);
+unsigned int kvm_mips_config5_wrmask(struct kvm_vcpu *vcpu);
+
 /* Dynamic binary translation */
 extern int kvm_mips_trans_cache_index(uint32_t inst, uint32_t *opc,
                                       struct kvm_vcpu *vcpu);
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index b5dcbee01fd7..9b3b48e21c22 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -105,7 +105,7 @@ union fpureg {
 #ifdef CONFIG_CPU_LITTLE_ENDIAN
 # define FPR_IDX(width, idx)    (idx)
 #else
-# define FPR_IDX(width, idx)    ((FPU_REG_WIDTH / (width)) - 1 - (idx))
+# define FPR_IDX(width, idx)    ((idx) ^ ((64 / (width)) - 1))
 #endif
 
 #define BUILD_FPR_ACCESS(width) \
diff --git a/arch/mips/include/uapi/asm/kvm.h b/arch/mips/include/uapi/asm/kvm.h
index 2c04b6d9ff85..6985eb59b085 100644
--- a/arch/mips/include/uapi/asm/kvm.h
+++ b/arch/mips/include/uapi/asm/kvm.h
@@ -36,77 +36,85 @@ struct kvm_regs {
 
 /*
  * for KVM_GET_FPU and KVM_SET_FPU
- *
- * If Status[FR] is zero (32-bit FPU), the upper 32-bits of the FPRs
- * are zero filled.
  */
 struct kvm_fpu {
-        __u64 fpr[32];
-        __u32 fir;
-        __u32 fccr;
-        __u32 fexr;
-        __u32 fenr;
-        __u32 fcsr;
-        __u32 pad;
 };
 
 
 /*
- * For MIPS, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access CP0
+ * For MIPS, we use KVM_SET_ONE_REG and KVM_GET_ONE_REG to access various
  * registers.  The id field is broken down as follows:
  *
- *  bits[2..0]   - Register 'sel' index.
- *  bits[7..3]   - Register 'rd'  index.
- *  bits[15..8]  - Must be zero.
- *  bits[31..16] - 1 -> CP0 registers.
- *  bits[51..32] - Must be zero.
  *  bits[63..52] - As per linux/kvm.h
+ *  bits[51..32] - Must be zero.
+ *  bits[31..16] - Register set.
+ *
+ * Register set = 0: GP registers from kvm_regs (see definitions below).
+ *
+ * Register set = 1: CP0 registers.
+ *  bits[15..8]  - Must be zero.
+ *  bits[7..3]   - Register 'rd'  index.
+ *  bits[2..0]   - Register 'sel' index.
+ *
+ * Register set = 2: KVM specific registers (see definitions below).
+ *
+ * Register set = 3: FPU / MSA registers (see definitions below).
  *
  * Other sets registers may be added in the future.  Each set would
  * have its own identifier in bits[31..16].
- *
- * The registers defined in struct kvm_regs are also accessible, the
- * id values for these are below.
  */
 
-#define KVM_REG_MIPS_R0 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 0)
-#define KVM_REG_MIPS_R1 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 1)
-#define KVM_REG_MIPS_R2 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 2)
-#define KVM_REG_MIPS_R3 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 3)
-#define KVM_REG_MIPS_R4 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 4)
-#define KVM_REG_MIPS_R5 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 5)
-#define KVM_REG_MIPS_R6 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 6)
-#define KVM_REG_MIPS_R7 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 7)
-#define KVM_REG_MIPS_R8 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 8)
-#define KVM_REG_MIPS_R9 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 9)
-#define KVM_REG_MIPS_R10 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 10)
-#define KVM_REG_MIPS_R11 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 11)
-#define KVM_REG_MIPS_R12 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 12)
-#define KVM_REG_MIPS_R13 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 13)
-#define KVM_REG_MIPS_R14 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 14)
-#define KVM_REG_MIPS_R15 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 15)
-#define KVM_REG_MIPS_R16 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 16)
-#define KVM_REG_MIPS_R17 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 17)
-#define KVM_REG_MIPS_R18 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 18)
-#define KVM_REG_MIPS_R19 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 19)
-#define KVM_REG_MIPS_R20 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 20)
-#define KVM_REG_MIPS_R21 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 21)
-#define KVM_REG_MIPS_R22 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 22)
-#define KVM_REG_MIPS_R23 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 23)
-#define KVM_REG_MIPS_R24 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 24)
-#define KVM_REG_MIPS_R25 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 25)
-#define KVM_REG_MIPS_R26 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 26)
-#define KVM_REG_MIPS_R27 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 27)
-#define KVM_REG_MIPS_R28 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 28)
-#define KVM_REG_MIPS_R29 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 29)
-#define KVM_REG_MIPS_R30 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 30)
-#define KVM_REG_MIPS_R31 (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 31)
-
-#define KVM_REG_MIPS_HI (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 32)
-#define KVM_REG_MIPS_LO (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 33)
-#define KVM_REG_MIPS_PC (KVM_REG_MIPS | KVM_REG_SIZE_U64 | 34)
-
-/* KVM specific control registers */
+#define KVM_REG_MIPS_GP         (KVM_REG_MIPS | 0x0000000000000000ULL)
+#define KVM_REG_MIPS_CP0        (KVM_REG_MIPS | 0x0000000000010000ULL)
+#define KVM_REG_MIPS_KVM        (KVM_REG_MIPS | 0x0000000000020000ULL)
+#define KVM_REG_MIPS_FPU        (KVM_REG_MIPS | 0x0000000000030000ULL)
+
+
+/*
+ * KVM_REG_MIPS_GP - General purpose registers from kvm_regs.
+ */
+
+#define KVM_REG_MIPS_R0         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  0)
+#define KVM_REG_MIPS_R1         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  1)
+#define KVM_REG_MIPS_R2         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  2)
+#define KVM_REG_MIPS_R3         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  3)
+#define KVM_REG_MIPS_R4         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  4)
+#define KVM_REG_MIPS_R5         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  5)
+#define KVM_REG_MIPS_R6         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  6)
+#define KVM_REG_MIPS_R7         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  7)
+#define KVM_REG_MIPS_R8         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  8)
+#define KVM_REG_MIPS_R9         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 |  9)
+#define KVM_REG_MIPS_R10        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 10)
+#define KVM_REG_MIPS_R11        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 11)
+#define KVM_REG_MIPS_R12        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 12)
+#define KVM_REG_MIPS_R13        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 13)
+#define KVM_REG_MIPS_R14        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 14)
+#define KVM_REG_MIPS_R15        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 15)
+#define KVM_REG_MIPS_R16        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 16)
+#define KVM_REG_MIPS_R17        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 17)
+#define KVM_REG_MIPS_R18        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 18)
+#define KVM_REG_MIPS_R19        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 19)
+#define KVM_REG_MIPS_R20        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 20)
+#define KVM_REG_MIPS_R21        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 21)
+#define KVM_REG_MIPS_R22        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 22)
+#define KVM_REG_MIPS_R23        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 23)
+#define KVM_REG_MIPS_R24        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 24)
+#define KVM_REG_MIPS_R25        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 25)
+#define KVM_REG_MIPS_R26        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 26)
+#define KVM_REG_MIPS_R27        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 27)
+#define KVM_REG_MIPS_R28        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 28)
+#define KVM_REG_MIPS_R29        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 29)
+#define KVM_REG_MIPS_R30        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 30)
+#define KVM_REG_MIPS_R31        (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 31)
+
+#define KVM_REG_MIPS_HI         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 32)
+#define KVM_REG_MIPS_LO         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 33)
+#define KVM_REG_MIPS_PC         (KVM_REG_MIPS_GP | KVM_REG_SIZE_U64 | 34)
+
+
+/*
+ * KVM_REG_MIPS_KVM - KVM specific control registers.
+ */
 
 /*
  * CP0_Count control
@@ -118,8 +126,7 @@ struct kvm_fpu {
  *        safely without losing time or guest timer interrupts.
  * Other: Reserved, do not change.
  */
-#define KVM_REG_MIPS_COUNT_CTL          (KVM_REG_MIPS | KVM_REG_SIZE_U64 | \
-                                         0x20000 | 0)
+#define KVM_REG_MIPS_COUNT_CTL      (KVM_REG_MIPS_KVM | KVM_REG_SIZE_U64 | 0)
 #define KVM_REG_MIPS_COUNT_CTL_DC       0x00000001
 
 /*
@@ -131,15 +138,46 @@ struct kvm_fpu {
  * emulated.
  * Modifications to times in the future are rejected.
  */
-#define KVM_REG_MIPS_COUNT_RESUME       (KVM_REG_MIPS | KVM_REG_SIZE_U64 | \
-                                         0x20000 | 1)
+#define KVM_REG_MIPS_COUNT_RESUME   (KVM_REG_MIPS_KVM | KVM_REG_SIZE_U64 | 1)
 /*
  * CP0_Count rate in Hz
  * Specifies the rate of the CP0_Count timer in Hz. Modifications occur without
  * discontinuities in CP0_Count.
  */
-#define KVM_REG_MIPS_COUNT_HZ           (KVM_REG_MIPS | KVM_REG_SIZE_U64 | \
-                                         0x20000 | 2)
+#define KVM_REG_MIPS_COUNT_HZ       (KVM_REG_MIPS_KVM | KVM_REG_SIZE_U64 | 2)
+
+
+/*
+ * KVM_REG_MIPS_FPU - Floating Point and MIPS SIMD Architecture (MSA) registers.
+ *
+ *  bits[15..8]  - Register subset (see definitions below).
+ *  bits[7..5]   - Must be zero.
+ *  bits[4..0]   - Register number within register subset.
+ */
+
+#define KVM_REG_MIPS_FPR        (KVM_REG_MIPS_FPU | 0x0000000000000000ULL)
+#define KVM_REG_MIPS_FCR        (KVM_REG_MIPS_FPU | 0x0000000000000100ULL)
+#define KVM_REG_MIPS_MSACR      (KVM_REG_MIPS_FPU | 0x0000000000000200ULL)
+
+/*
+ * KVM_REG_MIPS_FPR - Floating point / Vector registers.
+ */
+#define KVM_REG_MIPS_FPR_32(n)  (KVM_REG_MIPS_FPR | KVM_REG_SIZE_U32  | (n))
+#define KVM_REG_MIPS_FPR_64(n)  (KVM_REG_MIPS_FPR | KVM_REG_SIZE_U64  | (n))
+#define KVM_REG_MIPS_VEC_128(n) (KVM_REG_MIPS_FPR | KVM_REG_SIZE_U128 | (n))
+
+/*
+ * KVM_REG_MIPS_FCR - Floating point control registers.
+ */
+#define KVM_REG_MIPS_FCR_IR     (KVM_REG_MIPS_FCR | KVM_REG_SIZE_U32 |  0)
+#define KVM_REG_MIPS_FCR_CSR    (KVM_REG_MIPS_FCR | KVM_REG_SIZE_U32 | 31)
+
+/*
+ * KVM_REG_MIPS_MSACR - MIPS SIMD Architecture (MSA) control registers.
+ */
+#define KVM_REG_MIPS_MSA_IR      (KVM_REG_MIPS_MSACR | KVM_REG_SIZE_U32 |  0)
+#define KVM_REG_MIPS_MSA_CSR     (KVM_REG_MIPS_MSACR | KVM_REG_SIZE_U32 |  1)
+
 
 /*
  * KVM MIPS specific structures and definitions
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 750d67ac41e9..e59fd7cfac9e 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -167,72 +167,6 @@ void output_thread_fpu_defines(void)
         OFFSET(THREAD_FPR30, task_struct, thread.fpu.fpr[30]);
         OFFSET(THREAD_FPR31, task_struct, thread.fpu.fpr[31]);
 
-        /* the least significant 64 bits of each FP register */
-        OFFSET(THREAD_FPR0_LS64, task_struct,
-               thread.fpu.fpr[0].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR1_LS64, task_struct,
-               thread.fpu.fpr[1].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR2_LS64, task_struct,
-               thread.fpu.fpr[2].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR3_LS64, task_struct,
-               thread.fpu.fpr[3].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR4_LS64, task_struct,
-               thread.fpu.fpr[4].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR5_LS64, task_struct,
-               thread.fpu.fpr[5].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR6_LS64, task_struct,
-               thread.fpu.fpr[6].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR7_LS64, task_struct,
-               thread.fpu.fpr[7].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR8_LS64, task_struct,
-               thread.fpu.fpr[8].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR9_LS64, task_struct,
-               thread.fpu.fpr[9].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR10_LS64, task_struct,
-               thread.fpu.fpr[10].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR11_LS64, task_struct,
-               thread.fpu.fpr[11].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR12_LS64, task_struct,
-               thread.fpu.fpr[12].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR13_LS64, task_struct,
-               thread.fpu.fpr[13].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR14_LS64, task_struct,
-               thread.fpu.fpr[14].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR15_LS64, task_struct,
-               thread.fpu.fpr[15].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR16_LS64, task_struct,
-               thread.fpu.fpr[16].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR17_LS64, task_struct,
-               thread.fpu.fpr[17].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR18_LS64, task_struct,
-               thread.fpu.fpr[18].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR19_LS64, task_struct,
-               thread.fpu.fpr[19].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR20_LS64, task_struct,
-               thread.fpu.fpr[20].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR21_LS64, task_struct,
-               thread.fpu.fpr[21].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR22_LS64, task_struct,
-               thread.fpu.fpr[22].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR23_LS64, task_struct,
-               thread.fpu.fpr[23].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR24_LS64, task_struct,
-               thread.fpu.fpr[24].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR25_LS64, task_struct,
-               thread.fpu.fpr[25].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR26_LS64, task_struct,
-               thread.fpu.fpr[26].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR27_LS64, task_struct,
-               thread.fpu.fpr[27].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR28_LS64, task_struct,
-               thread.fpu.fpr[28].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR29_LS64, task_struct,
-               thread.fpu.fpr[29].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR30_LS64, task_struct,
-               thread.fpu.fpr[30].val64[FPR_IDX(64, 0)]);
-        OFFSET(THREAD_FPR31_LS64, task_struct,
-               thread.fpu.fpr[31].val64[FPR_IDX(64, 0)]);
-
         OFFSET(THREAD_FCR31, task_struct, thread.fpu.fcr31);
         OFFSET(THREAD_MSA_CSR, task_struct, thread.fpu.msacsr);
         BLANK();
@@ -470,6 +404,45 @@ void output_kvm_defines(void)
         OFFSET(VCPU_LO, kvm_vcpu_arch, lo);
         OFFSET(VCPU_HI, kvm_vcpu_arch, hi);
         OFFSET(VCPU_PC, kvm_vcpu_arch, pc);
+        BLANK();
+
+        OFFSET(VCPU_FPR0, kvm_vcpu_arch, fpu.fpr[0]);
+        OFFSET(VCPU_FPR1, kvm_vcpu_arch, fpu.fpr[1]);
+        OFFSET(VCPU_FPR2, kvm_vcpu_arch, fpu.fpr[2]);
+        OFFSET(VCPU_FPR3, kvm_vcpu_arch, fpu.fpr[3]);
+        OFFSET(VCPU_FPR4, kvm_vcpu_arch, fpu.fpr[4]);
+        OFFSET(VCPU_FPR5, kvm_vcpu_arch, fpu.fpr[5]);
+        OFFSET(VCPU_FPR6, kvm_vcpu_arch, fpu.fpr[6]);
+        OFFSET(VCPU_FPR7, kvm_vcpu_arch, fpu.fpr[7]);
+        OFFSET(VCPU_FPR8, kvm_vcpu_arch, fpu.fpr[8]);
+        OFFSET(VCPU_FPR9, kvm_vcpu_arch, fpu.fpr[9]);
+        OFFSET(VCPU_FPR10, kvm_vcpu_arch, fpu.fpr[10]);
+        OFFSET(VCPU_FPR11, kvm_vcpu_arch, fpu.fpr[11]);
+        OFFSET(VCPU_FPR12, kvm_vcpu_arch, fpu.fpr[12]);
+        OFFSET(VCPU_FPR13, kvm_vcpu_arch, fpu.fpr[13]);
+        OFFSET(VCPU_FPR14, kvm_vcpu_arch, fpu.fpr[14]);
+        OFFSET(VCPU_FPR15, kvm_vcpu_arch, fpu.fpr[15]);
+        OFFSET(VCPU_FPR16, kvm_vcpu_arch, fpu.fpr[16]);
+        OFFSET(VCPU_FPR17, kvm_vcpu_arch, fpu.fpr[17]);
+        OFFSET(VCPU_FPR18, kvm_vcpu_arch, fpu.fpr[18]);
+        OFFSET(VCPU_FPR19, kvm_vcpu_arch, fpu.fpr[19]);
+        OFFSET(VCPU_FPR20, kvm_vcpu_arch, fpu.fpr[20]);
+        OFFSET(VCPU_FPR21, kvm_vcpu_arch, fpu.fpr[21]);
+        OFFSET(VCPU_FPR22, kvm_vcpu_arch, fpu.fpr[22]);
+        OFFSET(VCPU_FPR23, kvm_vcpu_arch, fpu.fpr[23]);
+        OFFSET(VCPU_FPR24, kvm_vcpu_arch, fpu.fpr[24]);
+        OFFSET(VCPU_FPR25, kvm_vcpu_arch, fpu.fpr[25]);
+        OFFSET(VCPU_FPR26, kvm_vcpu_arch, fpu.fpr[26]);
+        OFFSET(VCPU_FPR27, kvm_vcpu_arch, fpu.fpr[27]);
+        OFFSET(VCPU_FPR28, kvm_vcpu_arch, fpu.fpr[28]);
+        OFFSET(VCPU_FPR29, kvm_vcpu_arch, fpu.fpr[29]);
+        OFFSET(VCPU_FPR30, kvm_vcpu_arch, fpu.fpr[30]);
+        OFFSET(VCPU_FPR31, kvm_vcpu_arch, fpu.fpr[31]);
+
+        OFFSET(VCPU_FCR31, kvm_vcpu_arch, fpu.fcr31);
+        OFFSET(VCPU_MSA_CSR, kvm_vcpu_arch, fpu.msacsr);
+        BLANK();
+
         OFFSET(VCPU_COP0, kvm_vcpu_arch, cop0);
         OFFSET(VCPU_GUEST_KERNEL_ASID, kvm_vcpu_arch, guest_kernel_asid);
         OFFSET(VCPU_GUEST_USER_ASID, kvm_vcpu_arch, guest_user_asid);
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 2ebaabe3af15..af42e7003f12 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -360,12 +360,15 @@ NESTED(nmi_handler, PT_SIZE, sp)
         .set    mips1
         SET_HARDFLOAT
         cfc1    a1, fcr31
-        li      a2, ~(0x3f << 12)
-        and     a2, a1
-        ctc1    a2, fcr31
         .set    pop
-        TRACE_IRQS_ON
-        STI
+        CLI
+        TRACE_IRQS_OFF
+        .endm
+
+        .macro  __build_clear_msa_fpe
+        _cfcmsa a1, MSA_CSR
+        CLI
+        TRACE_IRQS_OFF
         .endm
 
         .macro  __build_clear_ade
@@ -426,7 +429,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         BUILD_HANDLER cpu cpu sti silent                /* #11 */
         BUILD_HANDLER ov ov sti silent                  /* #12 */
         BUILD_HANDLER tr tr sti silent                  /* #13 */
-        BUILD_HANDLER msa_fpe msa_fpe sti silent        /* #14 */
+        BUILD_HANDLER msa_fpe msa_fpe msa_fpe silent    /* #14 */
         BUILD_HANDLER fpe fpe fpe silent                /* #15 */
         BUILD_HANDLER ftlb ftlb none silent             /* #16 */
         BUILD_HANDLER msa msa sti silent                /* #21 */
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 510452812594..7da6e324dd35 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -46,6 +46,26 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
 
+static void init_fp_ctx(struct task_struct *target)
+{
+        /* If FP has been used then the target already has context */
+        if (tsk_used_math(target))
+                return;
+
+        /* Begin with data registers set to all 1s... */
+        memset(&target->thread.fpu.fpr, ~0, sizeof(target->thread.fpu.fpr));
+
+        /* ...and FCSR zeroed */
+        target->thread.fpu.fcr31 = 0;
+
+        /*
+         * Record that the target has "used" math, such that the context
+         * just initialised, and any modifications made by the caller,
+         * aren't discarded.
+         */
+        set_stopped_child_used_math(target);
+}
+
 /*
  * Called by kernel/ptrace.c when detaching..
  *
@@ -142,6 +162,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data)
         if (!access_ok(VERIFY_READ, data, 33 * 8))
                 return -EIO;
 
+        init_fp_ctx(child);
         fregs = get_fpu_regs(child);
 
         for (i = 0; i < 32; i++) {
@@ -439,6 +460,8 @@ static int fpr_set(struct task_struct *target,
 
         /* XXX fcr31  */
 
+        init_fp_ctx(target);
+
         if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t))
                 return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                           &target->thread.fpu,
@@ -660,12 +683,7 @@ long arch_ptrace(struct task_struct *child, long request,
                 case FPR_BASE ... FPR_BASE + 31: {
                         union fpureg *fregs = get_fpu_regs(child);
 
-                        if (!tsk_used_math(child)) {
-                                /* FP not yet used  */
-                                memset(&child->thread.fpu, ~0,
-                                       sizeof(child->thread.fpu));
-                                child->thread.fpu.fcr31 = 0;
-                        }
+                        init_fp_ctx(child);
 #ifdef CONFIG_32BIT
                         if (test_thread_flag(TIF_32BIT_FPREGS)) {
                                 /*
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 676c5030a953..1d88af26ba82 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -34,7 +34,6 @@
         .endm
 
         .set    noreorder
-        .set    MIPS_ISA_ARCH_LEVEL_RAW
 
 LEAF(_save_fp_context)
         .set    push
@@ -103,6 +102,7 @@ LEAF(_save_fp_context)
         /* Save 32-bit process floating point context */
 LEAF(_save_fp_context32)
         .set push
+        .set MIPS_ISA_ARCH_LEVEL_RAW
         SET_HARDFLOAT
         cfc1    t1, fcr31
 
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 33984c04b60b..5b4d711f878d 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -701,6 +701,13 @@ asmlinkage void do_ov(struct pt_regs *regs)
 
 int process_fpemu_return(int sig, void __user *fault_addr)
 {
+        /*
+         * We can't allow the emulated instruction to leave any of the cause
+         * bits set in FCSR. If they were then the kernel would take an FP
+         * exception when restoring FP context.
+         */
+        current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+
         if (sig == SIGSEGV || sig == SIGBUS) {
                 struct siginfo si = {0};
                 si.si_addr = fault_addr;
@@ -781,6 +788,11 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
         if (notify_die(DIE_FP, "FP exception", regs, 0, regs_to_trapnr(regs),
                        SIGFPE) == NOTIFY_STOP)
                 goto out;
+
+        /* Clear FCSR.Cause before enabling interrupts */
+        write_32bit_cp1_register(CP1_STATUS, fcr31 & ~FPU_CSR_ALL_X);
+        local_irq_enable();
+
         die_if_kernel("FP exception in kernel code", regs);
 
         if (fcr31 & FPU_CSR_UNI_X) {
@@ -804,18 +816,12 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 sig = fpu_emulator_cop1Handler(regs, &current->thread.fpu, 1,
                                                &fault_addr);
 
-                /*
-                 * We can't allow the emulated instruction to leave any of
-                 * the cause bit set in $fcr31.
-                 */
-                current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+                /* If something went wrong, signal */
+                process_fpemu_return(sig, fault_addr);
 
                 /* Restore the hardware register state */
                 own_fpu(1);     /* Using the FPU again.  */
 
-                /* If something went wrong, signal */
-                process_fpemu_return(sig, fault_addr);
-
                 goto out;
         } else if (fcr31 & FPU_CSR_INV_X)
                 info.si_code = FPE_FLTINV;
@@ -1392,13 +1398,22 @@ out:
         exception_exit(prev_state);
 }
 
-asmlinkage void do_msa_fpe(struct pt_regs *regs)
+asmlinkage void do_msa_fpe(struct pt_regs *regs, unsigned int msacsr)
 {
         enum ctx_state prev_state;
 
         prev_state = exception_enter();
+        if (notify_die(DIE_MSAFP, "MSA FP exception", regs, 0,
+                       regs_to_trapnr(regs), SIGFPE) == NOTIFY_STOP)
+                goto out;
+
+        /* Clear MSACSR.Cause before enabling interrupts */
+        write_msa_csr(msacsr & ~MSA_CSR_CAUSEF);
+        local_irq_enable();
+
         die_if_kernel("do_msa_fpe invoked from kernel context!", regs);
         force_sig(SIGFPE, current);
+out:
         exception_exit(prev_state);
 }
 
diff --git a/arch/mips/kvm/Makefile b/arch/mips/kvm/Makefile
index 401fe027c261..637ebbebd549 100644
--- a/arch/mips/kvm/Makefile
+++ b/arch/mips/kvm/Makefile
@@ -1,13 +1,15 @@
 # Makefile for KVM support for MIPS
 #
 
-common-objs = $(addprefix ../../../virt/kvm/, kvm_main.o coalesced_mmio.o)
+common-objs-y = $(addprefix ../../../virt/kvm/, kvm_main.o coalesced_mmio.o)
 
 EXTRA_CFLAGS += -Ivirt/kvm -Iarch/mips/kvm
 
-kvm-objs := $(common-objs) mips.o emulate.o locore.o \
+common-objs-$(CONFIG_CPU_HAS_MSA) += msa.o
+
+kvm-objs := $(common-objs-y) mips.o emulate.o locore.o \
             interrupt.o stats.o commpage.o \
-            dyntrans.o trap_emul.o
+            dyntrans.o trap_emul.o fpu.o
 
 obj-$(CONFIG_KVM)       += kvm.o
 obj-y                   += callback.o tlb.o
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index fb3e8dfd1ff6..6230f376a44e 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -884,6 +884,84 @@ enum emulation_result kvm_mips_emul_tlbp(struct kvm_vcpu *vcpu)
         return EMULATE_DONE;
 }
 
+/**
+ * kvm_mips_config1_wrmask() - Find mask of writable bits in guest Config1
+ * @vcpu:       Virtual CPU.
+ *
+ * Finds the mask of bits which are writable in the guest's Config1 CP0
+ * register, by userland (currently read-only to the guest).
+ */
+unsigned int kvm_mips_config1_wrmask(struct kvm_vcpu *vcpu)
+{
+        unsigned int mask = 0;
+
+        /* Permit FPU to be present if FPU is supported */
+        if (kvm_mips_guest_can_have_fpu(&vcpu->arch))
+                mask |= MIPS_CONF1_FP;
+
+        return mask;
+}
+
+/**
+ * kvm_mips_config3_wrmask() - Find mask of writable bits in guest Config3
+ * @vcpu:       Virtual CPU.
+ *
+ * Finds the mask of bits which are writable in the guest's Config3 CP0
+ * register, by userland (currently read-only to the guest).
+ */
+unsigned int kvm_mips_config3_wrmask(struct kvm_vcpu *vcpu)
+{
+        /* Config4 is optional */
+        unsigned int mask = MIPS_CONF_M;
+
+        /* Permit MSA to be present if MSA is supported */
+        if (kvm_mips_guest_can_have_msa(&vcpu->arch))
+                mask |= MIPS_CONF3_MSA;
+
+        return mask;
+}
+
+/**
+ * kvm_mips_config4_wrmask() - Find mask of writable bits in guest Config4
+ * @vcpu:       Virtual CPU.
+ *
+ * Finds the mask of bits which are writable in the guest's Config4 CP0
+ * register, by userland (currently read-only to the guest).
+ */
+unsigned int kvm_mips_config4_wrmask(struct kvm_vcpu *vcpu)
+{
+        /* Config5 is optional */
+        return MIPS_CONF_M;
+}
+
+/**
+ * kvm_mips_config5_wrmask() - Find mask of writable bits in guest Config5
+ * @vcpu:       Virtual CPU.
+ *
+ * Finds the mask of bits which are writable in the guest's Config5 CP0
+ * register, by the guest itself.
+ */
+unsigned int kvm_mips_config5_wrmask(struct kvm_vcpu *vcpu)
+{
+        unsigned int mask = 0;
+
+        /* Permit MSAEn changes if MSA supported and enabled */
+        if (kvm_mips_guest_has_msa(&vcpu->arch))
+                mask |= MIPS_CONF5_MSAEN;
+
+        /*
+         * Permit guest FPU mode changes if FPU is enabled and the relevant
+         * feature exists according to FIR register.
+         */
+        if (kvm_mips_guest_has_fpu(&vcpu->arch)) {
+                if (cpu_has_fre)
+                        mask |= MIPS_CONF5_FRE;
+                /* We don't support UFR or UFE */
+        }
+
+        return mask;
+}
+
 enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
                                            uint32_t cause, struct kvm_run *run,
                                            struct kvm_vcpu *vcpu)
@@ -1021,18 +1099,114 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
                                 kvm_mips_write_compare(vcpu,
                                                        vcpu->arch.gprs[rt]);
                         } else if ((rd == MIPS_CP0_STATUS) && (sel == 0)) {
-                                kvm_write_c0_guest_status(cop0,
-                                                          vcpu->arch.gprs[rt]);
+                                unsigned int old_val, val, change;
+
+                                old_val = kvm_read_c0_guest_status(cop0);
+                                val = vcpu->arch.gprs[rt];
+                                change = val ^ old_val;
+
+                                /* Make sure that the NMI bit is never set */
+                                val &= ~ST0_NMI;
+
+                                /*
+                                 * Don't allow CU1 or FR to be set unless FPU
+                                 * capability enabled and exists in guest
+                                 * configuration.
+                                 */
+                                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                                        val &= ~(ST0_CU1 | ST0_FR);
+
+                                /*
+                                 * Also don't allow FR to be set if host doesn't
+                                 * support it.
+                                 */
+                                if (!(current_cpu_data.fpu_id & MIPS_FPIR_F64))
+                                        val &= ~ST0_FR;
+
+
+                                /* Handle changes in FPU mode */
+                                preempt_disable();
+
+                                /*
+                                 * FPU and Vector register state is made
+                                 * UNPREDICTABLE by a change of FR, so don't
+                                 * even bother saving it.
+                                 */
+                                if (change & ST0_FR)
+                                        kvm_drop_fpu(vcpu);
+
+                                /*
+                                 * If MSA state is already live, it is undefined
+                                 * how it interacts with FR=0 FPU state, and we
+                                 * don't want to hit reserved instruction
+                                 * exceptions trying to save the MSA state later
+                                 * when CU=1 && FR=1, so play it safe and save
+                                 * it first.
+                                 */
+                                if (change & ST0_CU1 && !(val & ST0_FR) &&
+                                    vcpu->arch.fpu_inuse & KVM_MIPS_FPU_MSA)
+                                        kvm_lose_fpu(vcpu);
+
                                 /*
-                                 * Make sure that CU1 and NMI bits are
-                                 * never set
+                                 * Propagate CU1 (FPU enable) changes
+                                 * immediately if the FPU context is already
+                                 * loaded. When disabling we leave the context
+                                 * loaded so it can be quickly enabled again in
+                                 * the near future.
                                  */
-                                kvm_clear_c0_guest_status(cop0,
-                                                          (ST0_CU1 | ST0_NMI));
+                                if (change & ST0_CU1 &&
+                                    vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU)
+                                        change_c0_status(ST0_CU1, val);
+
+                                preempt_enable();
+
+                                kvm_write_c0_guest_status(cop0, val);
 
 #ifdef CONFIG_KVM_MIPS_DYN_TRANS
-                                kvm_mips_trans_mtc0(inst, opc, vcpu);
+                                /*
+                                 * If FPU present, we need CU1/FR bits to take
+                                 * effect fairly soon.
+                                 */
+                                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                                        kvm_mips_trans_mtc0(inst, opc, vcpu);
 #endif
+                        } else if ((rd == MIPS_CP0_CONFIG) && (sel == 5)) {
+                                unsigned int old_val, val, change, wrmask;
+
+                                old_val = kvm_read_c0_guest_config5(cop0);
+                                val = vcpu->arch.gprs[rt];
+
+                                /* Only a few bits are writable in Config5 */
+                                wrmask = kvm_mips_config5_wrmask(vcpu);
+                                change = (val ^ old_val) & wrmask;
+                                val = old_val ^ change;
+
+
+                                /* Handle changes in FPU/MSA modes */
+                                preempt_disable();
+
+                                /*
+                                 * Propagate FRE changes immediately if the FPU
+                                 * context is already loaded.
+                                 */
+                                if (change & MIPS_CONF5_FRE &&
+                                    vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU)
+                                        change_c0_config5(MIPS_CONF5_FRE, val);
+
+                                /*
+                                 * Propagate MSAEn changes immediately if the
+                                 * MSA context is already loaded. When disabling
+                                 * we leave the context loaded so it can be
+                                 * quickly enabled again in the near future.
+                                 */
+                                if (change & MIPS_CONF5_MSAEN &&
+                                    vcpu->arch.fpu_inuse & KVM_MIPS_FPU_MSA)
+                                        change_c0_config5(MIPS_CONF5_MSAEN,
+                                                          val);
+
+                                preempt_enable();
+
+                                kvm_write_c0_guest_config5(cop0, val);
                         } else if ((rd == MIPS_CP0_CAUSE) && (sel == 0)) {
                                 uint32_t old_cause, new_cause;
 
@@ -1970,6 +2144,146 @@ enum emulation_result kvm_mips_emulate_bp_exc(unsigned long cause,
         return er;
 }
 
+enum emulation_result kvm_mips_emulate_trap_exc(unsigned long cause,
+                                                uint32_t *opc,
+                                                struct kvm_run *run,
+                                                struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct kvm_vcpu_arch *arch = &vcpu->arch;
+        enum emulation_result er = EMULATE_DONE;
+
+        if ((kvm_read_c0_guest_status(cop0) & ST0_EXL) == 0) {
+                /* save old pc */
+                kvm_write_c0_guest_epc(cop0, arch->pc);
+                kvm_set_c0_guest_status(cop0, ST0_EXL);
+
+                if (cause & CAUSEF_BD)
+                        kvm_set_c0_guest_cause(cop0, CAUSEF_BD);
+                else
+                        kvm_clear_c0_guest_cause(cop0, CAUSEF_BD);
+
+                kvm_debug("Delivering TRAP @ pc %#lx\n", arch->pc);
+
+                kvm_change_c0_guest_cause(cop0, (0xff),
+                                          (T_TRAP << CAUSEB_EXCCODE));
+
+                /* Set PC to the exception entry point */
+                arch->pc = KVM_GUEST_KSEG0 + 0x180;
+
+        } else {
+                kvm_err("Trying to deliver TRAP when EXL is already set\n");
+                er = EMULATE_FAIL;
+        }
+
+        return er;
+}
+
+enum emulation_result kvm_mips_emulate_msafpe_exc(unsigned long cause,
+                                                  uint32_t *opc,
+                                                  struct kvm_run *run,
+                                                  struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct kvm_vcpu_arch *arch = &vcpu->arch;
+        enum emulation_result er = EMULATE_DONE;
+
+        if ((kvm_read_c0_guest_status(cop0) & ST0_EXL) == 0) {
+                /* save old pc */
+                kvm_write_c0_guest_epc(cop0, arch->pc);
+                kvm_set_c0_guest_status(cop0, ST0_EXL);
+
+                if (cause & CAUSEF_BD)
+                        kvm_set_c0_guest_cause(cop0, CAUSEF_BD);
+                else
+                        kvm_clear_c0_guest_cause(cop0, CAUSEF_BD);
+
+                kvm_debug("Delivering MSAFPE @ pc %#lx\n", arch->pc);
+
+                kvm_change_c0_guest_cause(cop0, (0xff),
+                                          (T_MSAFPE << CAUSEB_EXCCODE));
+
+                /* Set PC to the exception entry point */
+                arch->pc = KVM_GUEST_KSEG0 + 0x180;
+
+        } else {
+                kvm_err("Trying to deliver MSAFPE when EXL is already set\n");
+                er = EMULATE_FAIL;
+        }
+
+        return er;
+}
+
+enum emulation_result kvm_mips_emulate_fpe_exc(unsigned long cause,
+                                               uint32_t *opc,
+                                               struct kvm_run *run,
+                                               struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct kvm_vcpu_arch *arch = &vcpu->arch;
+        enum emulation_result er = EMULATE_DONE;
+
+        if ((kvm_read_c0_guest_status(cop0) & ST0_EXL) == 0) {
+                /* save old pc */
+                kvm_write_c0_guest_epc(cop0, arch->pc);
+                kvm_set_c0_guest_status(cop0, ST0_EXL);
+
+                if (cause & CAUSEF_BD)
+                        kvm_set_c0_guest_cause(cop0, CAUSEF_BD);
+                else
+                        kvm_clear_c0_guest_cause(cop0, CAUSEF_BD);
+
+                kvm_debug("Delivering FPE @ pc %#lx\n", arch->pc);
+
+                kvm_change_c0_guest_cause(cop0, (0xff),
+                                          (T_FPE << CAUSEB_EXCCODE));
+
+                /* Set PC to the exception entry point */
+                arch->pc = KVM_GUEST_KSEG0 + 0x180;
+
+        } else {
+                kvm_err("Trying to deliver FPE when EXL is already set\n");
+                er = EMULATE_FAIL;
+        }
+
+        return er;
+}
+
+enum emulation_result kvm_mips_emulate_msadis_exc(unsigned long cause,
+                                                  uint32_t *opc,
+                                                  struct kvm_run *run,
+                                                  struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct kvm_vcpu_arch *arch = &vcpu->arch;
+        enum emulation_result er = EMULATE_DONE;
+
+        if ((kvm_read_c0_guest_status(cop0) & ST0_EXL) == 0) {
+                /* save old pc */
+                kvm_write_c0_guest_epc(cop0, arch->pc);
+                kvm_set_c0_guest_status(cop0, ST0_EXL);
+
+                if (cause & CAUSEF_BD)
+                        kvm_set_c0_guest_cause(cop0, CAUSEF_BD);
+                else
+                        kvm_clear_c0_guest_cause(cop0, CAUSEF_BD);
+
+                kvm_debug("Delivering MSADIS @ pc %#lx\n", arch->pc);
+
+                kvm_change_c0_guest_cause(cop0, (0xff),
+                                          (T_MSADIS << CAUSEB_EXCCODE));
+
+                /* Set PC to the exception entry point */
+                arch->pc = KVM_GUEST_KSEG0 + 0x180;
+
+        } else {
+                kvm_err("Trying to deliver MSADIS when EXL is already set\n");
+                er = EMULATE_FAIL;
+        }
+
+        return er;
+}
+
 /* ll/sc, rdhwr, sync emulation */
 
 #define OPCODE 0xfc000000
@@ -2176,6 +2490,10 @@ enum emulation_result kvm_mips_check_privilege(unsigned long cause,
                 case T_SYSCALL:
                 case T_BREAK:
                 case T_RES_INST:
+                case T_TRAP:
+                case T_MSAFPE:
+                case T_FPE:
+                case T_MSADIS:
                         break;
 
                 case T_COP_UNUSABLE:
diff --git a/arch/mips/kvm/fpu.S b/arch/mips/kvm/fpu.S
new file mode 100644
index 000000000000..531fbf5131c0
--- /dev/null
+++ b/arch/mips/kvm/fpu.S
@@ -0,0 +1,122 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * FPU context handling code for KVM.
+ *
+ * Copyright (C) 2015 Imagination Technologies Ltd.
+ */
+
+#include <asm/asm.h>
+#include <asm/asm-offsets.h>
+#include <asm/fpregdef.h>
+#include <asm/mipsregs.h>
+#include <asm/regdef.h>
+
+        .set    noreorder
+        .set    noat
+
+LEAF(__kvm_save_fpu)
+        .set    push
+        .set    mips64r2
+        SET_HARDFLOAT
+        mfc0    t0, CP0_STATUS
+        sll     t0, t0, 5                       # is Status.FR set?
+        bgez    t0, 1f                          # no: skip odd doubles
+         nop
+        sdc1    $f1,  VCPU_FPR1(a0)
+        sdc1    $f3,  VCPU_FPR3(a0)
+        sdc1    $f5,  VCPU_FPR5(a0)
+        sdc1    $f7,  VCPU_FPR7(a0)
+        sdc1    $f9,  VCPU_FPR9(a0)
+        sdc1    $f11, VCPU_FPR11(a0)
+        sdc1    $f13, VCPU_FPR13(a0)
+        sdc1    $f15, VCPU_FPR15(a0)
+        sdc1    $f17, VCPU_FPR17(a0)
+        sdc1    $f19, VCPU_FPR19(a0)
+        sdc1    $f21, VCPU_FPR21(a0)
+        sdc1    $f23, VCPU_FPR23(a0)
+        sdc1    $f25, VCPU_FPR25(a0)
+        sdc1    $f27, VCPU_FPR27(a0)
+        sdc1    $f29, VCPU_FPR29(a0)
+        sdc1    $f31, VCPU_FPR31(a0)
+1:      sdc1    $f0,  VCPU_FPR0(a0)
+        sdc1    $f2,  VCPU_FPR2(a0)
+        sdc1    $f4,  VCPU_FPR4(a0)
+        sdc1    $f6,  VCPU_FPR6(a0)
+        sdc1    $f8,  VCPU_FPR8(a0)
+        sdc1    $f10, VCPU_FPR10(a0)
+        sdc1    $f12, VCPU_FPR12(a0)
+        sdc1    $f14, VCPU_FPR14(a0)
+        sdc1    $f16, VCPU_FPR16(a0)
+        sdc1    $f18, VCPU_FPR18(a0)
+        sdc1    $f20, VCPU_FPR20(a0)
+        sdc1    $f22, VCPU_FPR22(a0)
+        sdc1    $f24, VCPU_FPR24(a0)
+        sdc1    $f26, VCPU_FPR26(a0)
+        sdc1    $f28, VCPU_FPR28(a0)
+        jr      ra
+         sdc1   $f30, VCPU_FPR30(a0)
+        .set    pop
+        END(__kvm_save_fpu)
+
+LEAF(__kvm_restore_fpu)
+        .set    push
+        .set    mips64r2
+        SET_HARDFLOAT
+        mfc0    t0, CP0_STATUS
+        sll     t0, t0, 5                       # is Status.FR set?
+        bgez    t0, 1f                          # no: skip odd doubles
+         nop
+        ldc1    $f1,  VCPU_FPR1(a0)
+        ldc1    $f3,  VCPU_FPR3(a0)
+        ldc1    $f5,  VCPU_FPR5(a0)
+        ldc1    $f7,  VCPU_FPR7(a0)
+        ldc1    $f9,  VCPU_FPR9(a0)
+        ldc1    $f11, VCPU_FPR11(a0)
+        ldc1    $f13, VCPU_FPR13(a0)
+        ldc1    $f15, VCPU_FPR15(a0)
+        ldc1    $f17, VCPU_FPR17(a0)
+        ldc1    $f19, VCPU_FPR19(a0)
+        ldc1    $f21, VCPU_FPR21(a0)
+        ldc1    $f23, VCPU_FPR23(a0)
+        ldc1    $f25, VCPU_FPR25(a0)
+        ldc1    $f27, VCPU_FPR27(a0)
+        ldc1    $f29, VCPU_FPR29(a0)
+        ldc1    $f31, VCPU_FPR31(a0)
+1:      ldc1    $f0,  VCPU_FPR0(a0)
+        ldc1    $f2,  VCPU_FPR2(a0)
+        ldc1    $f4,  VCPU_FPR4(a0)
+        ldc1    $f6,  VCPU_FPR6(a0)
+        ldc1    $f8,  VCPU_FPR8(a0)
+        ldc1    $f10, VCPU_FPR10(a0)
+        ldc1    $f12, VCPU_FPR12(a0)
+        ldc1    $f14, VCPU_FPR14(a0)
+        ldc1    $f16, VCPU_FPR16(a0)
+        ldc1    $f18, VCPU_FPR18(a0)
+        ldc1    $f20, VCPU_FPR20(a0)
+        ldc1    $f22, VCPU_FPR22(a0)
+        ldc1    $f24, VCPU_FPR24(a0)
+        ldc1    $f26, VCPU_FPR26(a0)
+        ldc1    $f28, VCPU_FPR28(a0)
+        jr      ra
+         ldc1   $f30, VCPU_FPR30(a0)
+        .set    pop
+        END(__kvm_restore_fpu)
+
+LEAF(__kvm_restore_fcsr)
+        .set    push
+        SET_HARDFLOAT
+        lw      t0, VCPU_FCR31(a0)
+        /*
+         * The ctc1 must stay at this offset in __kvm_restore_fcsr.
+         * See kvm_mips_csr_die_notify() which handles t0 containing a value
+         * which triggers an FP Exception, which must be stepped over and
+         * ignored since the set cause bits must remain there for the guest.
+         */
+        ctc1    t0, fcr31
+        jr      ra
+         nop
+        .set    pop
+        END(__kvm_restore_fcsr)
diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
index 4a68b176d6e4..c567240386a0 100644
--- a/arch/mips/kvm/locore.S
+++ b/arch/mips/kvm/locore.S
@@ -36,6 +36,8 @@
 #define PT_HOST_USERLOCAL   PT_EPC
 
 #define CP0_DDATA_LO        $28,3
+#define CP0_CONFIG3         $16,3
+#define CP0_CONFIG5         $16,5
 #define CP0_EBASE           $15,1
 
 #define CP0_INTCTL          $12,1
@@ -353,6 +355,42 @@ NESTED (MIPSX(GuestException), CALLFRAME_SIZ, ra)
         LONG_L  k0, VCPU_HOST_EBASE(k1)
         mtc0    k0,CP0_EBASE
 
+        /*
+         * If FPU is enabled, save FCR31 and clear it so that later ctc1's don't
+         * trigger FPE for pending exceptions.
+         */
+        .set    at
+        and     v1, v0, ST0_CU1
+        beqz    v1, 1f
+         nop
+        .set    push
+        SET_HARDFLOAT
+        cfc1    t0, fcr31
+        sw      t0, VCPU_FCR31(k1)
+        ctc1    zero,fcr31
+        .set    pop
+        .set    noat
+1:
+
+#ifdef CONFIG_CPU_HAS_MSA
+        /*
+         * If MSA is enabled, save MSACSR and clear it so that later
+         * instructions don't trigger MSAFPE for pending exceptions.
+         */
+        mfc0    t0, CP0_CONFIG3
+        ext     t0, t0, 28, 1 /* MIPS_CONF3_MSAP */
+        beqz    t0, 1f
+         nop
+        mfc0    t0, CP0_CONFIG5
+        ext     t0, t0, 27, 1 /* MIPS_CONF5_MSAEN */
+        beqz    t0, 1f
+         nop
+        _cfcmsa t0, MSA_CSR
+        sw      t0, VCPU_MSA_CSR(k1)
+        _ctcmsa MSA_CSR, zero
+1:
+#endif
+
         /* Now that the new EBASE has been loaded, unset BEV and KSU_USER */
         .set    at
         and     v0, v0, ~(ST0_EXL | KSU_USER | ST0_IE)
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index c9eccf5df912..bb68e8d520e8 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -11,6 +11,7 @@
 
 #include <linux/errno.h>
 #include <linux/err.h>
+#include <linux/kdebug.h>
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
@@ -48,6 +49,10 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "syscall",      VCPU_STAT(syscall_exits),      KVM_STAT_VCPU },
         { "resvd_inst",   VCPU_STAT(resvd_inst_exits),   KVM_STAT_VCPU },
         { "break_inst",   VCPU_STAT(break_inst_exits),   KVM_STAT_VCPU },
+        { "trap_inst",    VCPU_STAT(trap_inst_exits),    KVM_STAT_VCPU },
+        { "msa_fpe",      VCPU_STAT(msa_fpe_exits),      KVM_STAT_VCPU },
+        { "fpe",          VCPU_STAT(fpe_exits),          KVM_STAT_VCPU },
+        { "msa_disabled", VCPU_STAT(msa_disabled_exits), KVM_STAT_VCPU },
         { "flush_dcache", VCPU_STAT(flush_dcache_exits), KVM_STAT_VCPU },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll), KVM_STAT_VCPU },
         { "halt_wakeup",  VCPU_STAT(halt_wakeup),        KVM_STAT_VCPU },
@@ -504,10 +509,13 @@ static u64 kvm_mips_get_one_regs[] = {
         KVM_REG_MIPS_CP0_STATUS,
         KVM_REG_MIPS_CP0_CAUSE,
         KVM_REG_MIPS_CP0_EPC,
+        KVM_REG_MIPS_CP0_PRID,
         KVM_REG_MIPS_CP0_CONFIG,
         KVM_REG_MIPS_CP0_CONFIG1,
         KVM_REG_MIPS_CP0_CONFIG2,
         KVM_REG_MIPS_CP0_CONFIG3,
+        KVM_REG_MIPS_CP0_CONFIG4,
+        KVM_REG_MIPS_CP0_CONFIG5,
         KVM_REG_MIPS_CP0_CONFIG7,
         KVM_REG_MIPS_CP0_ERROREPC,
 
@@ -520,10 +528,14 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
                             const struct kvm_one_reg *reg)
 {
         struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct mips_fpu_struct *fpu = &vcpu->arch.fpu;
         int ret;
         s64 v;
+        s64 vs[2];
+        unsigned int idx;
 
         switch (reg->id) {
+        /* General purpose registers */
         case KVM_REG_MIPS_R0 ... KVM_REG_MIPS_R31:
                 v = (long)vcpu->arch.gprs[reg->id - KVM_REG_MIPS_R0];
                 break;
@@ -537,6 +549,67 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
                 v = (long)vcpu->arch.pc;
                 break;
 
+        /* Floating point registers */
+        case KVM_REG_MIPS_FPR_32(0) ... KVM_REG_MIPS_FPR_32(31):
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_FPR_32(0);
+                /* Odd singles in top of even double when FR=0 */
+                if (kvm_read_c0_guest_status(cop0) & ST0_FR)
+                        v = get_fpr32(&fpu->fpr[idx], 0);
+                else
+                        v = get_fpr32(&fpu->fpr[idx & ~1], idx & 1);
+                break;
+        case KVM_REG_MIPS_FPR_64(0) ... KVM_REG_MIPS_FPR_64(31):
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_FPR_64(0);
+                /* Can't access odd doubles in FR=0 mode */
+                if (idx & 1 && !(kvm_read_c0_guest_status(cop0) & ST0_FR))
+                        return -EINVAL;
+                v = get_fpr64(&fpu->fpr[idx], 0);
+                break;
+        case KVM_REG_MIPS_FCR_IR:
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                v = boot_cpu_data.fpu_id;
+                break;
+        case KVM_REG_MIPS_FCR_CSR:
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                v = fpu->fcr31;
+                break;
+
+        /* MIPS SIMD Architecture (MSA) registers */
+        case KVM_REG_MIPS_VEC_128(0) ... KVM_REG_MIPS_VEC_128(31):
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                /* Can't access MSA registers in FR=0 mode */
+                if (!(kvm_read_c0_guest_status(cop0) & ST0_FR))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_VEC_128(0);
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+                /* least significant byte first */
+                vs[0] = get_fpr64(&fpu->fpr[idx], 0);
+                vs[1] = get_fpr64(&fpu->fpr[idx], 1);
+#else
+                /* most significant byte first */
+                vs[0] = get_fpr64(&fpu->fpr[idx], 1);
+                vs[1] = get_fpr64(&fpu->fpr[idx], 0);
+#endif
+                break;
+        case KVM_REG_MIPS_MSA_IR:
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                v = boot_cpu_data.msa_id;
+                break;
+        case KVM_REG_MIPS_MSA_CSR:
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                v = fpu->msacsr;
+                break;
+
+        /* Co-processor 0 registers */
         case KVM_REG_MIPS_CP0_INDEX:
                 v = (long)kvm_read_c0_guest_index(cop0);
                 break;
@@ -573,8 +646,8 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
         case KVM_REG_MIPS_CP0_EPC:
                 v = (long)kvm_read_c0_guest_epc(cop0);
                 break;
-        case KVM_REG_MIPS_CP0_ERROREPC:
-                v = (long)kvm_read_c0_guest_errorepc(cop0);
+        case KVM_REG_MIPS_CP0_PRID:
+                v = (long)kvm_read_c0_guest_prid(cop0);
                 break;
         case KVM_REG_MIPS_CP0_CONFIG:
                 v = (long)kvm_read_c0_guest_config(cop0);
@@ -588,9 +661,18 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
         case KVM_REG_MIPS_CP0_CONFIG3:
                 v = (long)kvm_read_c0_guest_config3(cop0);
                 break;
+        case KVM_REG_MIPS_CP0_CONFIG4:
+                v = (long)kvm_read_c0_guest_config4(cop0);
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG5:
+                v = (long)kvm_read_c0_guest_config5(cop0);
+                break;
         case KVM_REG_MIPS_CP0_CONFIG7:
                 v = (long)kvm_read_c0_guest_config7(cop0);
                 break;
+        case KVM_REG_MIPS_CP0_ERROREPC:
+                v = (long)kvm_read_c0_guest_errorepc(cop0);
+                break;
         /* registers to be handled specially */
         case KVM_REG_MIPS_CP0_COUNT:
         case KVM_REG_MIPS_COUNT_CTL:
@@ -612,6 +694,10 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu,
                 u32 v32 = (u32)v;
 
                 return put_user(v32, uaddr32);
+        } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+
+                return copy_to_user(uaddr, vs, 16);
         } else {
                 return -EINVAL;
         }
@@ -621,7 +707,10 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
                             const struct kvm_one_reg *reg)
 {
         struct mips_coproc *cop0 = vcpu->arch.cop0;
-        u64 v;
+        struct mips_fpu_struct *fpu = &vcpu->arch.fpu;
+        s64 v;
+        s64 vs[2];
+        unsigned int idx;
 
         if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64) {
                 u64 __user *uaddr64 = (u64 __user *)(long)reg->addr;
@@ -635,11 +724,16 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
                 if (get_user(v32, uaddr32) != 0)
                         return -EFAULT;
                 v = (s64)v32;
+        } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+
+                return copy_from_user(vs, uaddr, 16);
         } else {
                 return -EINVAL;
         }
 
         switch (reg->id) {
+        /* General purpose registers */
         case KVM_REG_MIPS_R0:
                 /* Silently ignore requests to set $0 */
                 break;
@@ -656,6 +750,64 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
                 vcpu->arch.pc = v;
                 break;
 
+        /* Floating point registers */
+        case KVM_REG_MIPS_FPR_32(0) ... KVM_REG_MIPS_FPR_32(31):
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_FPR_32(0);
+                /* Odd singles in top of even double when FR=0 */
+                if (kvm_read_c0_guest_status(cop0) & ST0_FR)
+                        set_fpr32(&fpu->fpr[idx], 0, v);
+                else
+                        set_fpr32(&fpu->fpr[idx & ~1], idx & 1, v);
+                break;
+        case KVM_REG_MIPS_FPR_64(0) ... KVM_REG_MIPS_FPR_64(31):
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_FPR_64(0);
+                /* Can't access odd doubles in FR=0 mode */
+                if (idx & 1 && !(kvm_read_c0_guest_status(cop0) & ST0_FR))
+                        return -EINVAL;
+                set_fpr64(&fpu->fpr[idx], 0, v);
+                break;
+        case KVM_REG_MIPS_FCR_IR:
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                /* Read-only */
+                break;
+        case KVM_REG_MIPS_FCR_CSR:
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch))
+                        return -EINVAL;
+                fpu->fcr31 = v;
+                break;
+
+        /* MIPS SIMD Architecture (MSA) registers */
+        case KVM_REG_MIPS_VEC_128(0) ... KVM_REG_MIPS_VEC_128(31):
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                idx = reg->id - KVM_REG_MIPS_VEC_128(0);
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+                /* least significant byte first */
+                set_fpr64(&fpu->fpr[idx], 0, vs[0]);
+                set_fpr64(&fpu->fpr[idx], 1, vs[1]);
+#else
+                /* most significant byte first */
+                set_fpr64(&fpu->fpr[idx], 1, vs[0]);
+                set_fpr64(&fpu->fpr[idx], 0, vs[1]);
+#endif
+                break;
+        case KVM_REG_MIPS_MSA_IR:
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                /* Read-only */
+                break;
+        case KVM_REG_MIPS_MSA_CSR:
+                if (!kvm_mips_guest_has_msa(&vcpu->arch))
+                        return -EINVAL;
+                fpu->msacsr = v;
+                break;
+
+        /* Co-processor 0 registers */
         case KVM_REG_MIPS_CP0_INDEX:
                 kvm_write_c0_guest_index(cop0, v);
                 break;
@@ -686,6 +838,9 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
         case KVM_REG_MIPS_CP0_EPC:
                 kvm_write_c0_guest_epc(cop0, v);
                 break;
+        case KVM_REG_MIPS_CP0_PRID:
+                kvm_write_c0_guest_prid(cop0, v);
+                break;
         case KVM_REG_MIPS_CP0_ERROREPC:
                 kvm_write_c0_guest_errorepc(cop0, v);
                 break;
@@ -693,6 +848,12 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
         case KVM_REG_MIPS_CP0_COUNT:
         case KVM_REG_MIPS_CP0_COMPARE:
         case KVM_REG_MIPS_CP0_CAUSE:
+        case KVM_REG_MIPS_CP0_CONFIG:
+        case KVM_REG_MIPS_CP0_CONFIG1:
+        case KVM_REG_MIPS_CP0_CONFIG2:
+        case KVM_REG_MIPS_CP0_CONFIG3:
+        case KVM_REG_MIPS_CP0_CONFIG4:
+        case KVM_REG_MIPS_CP0_CONFIG5:
         case KVM_REG_MIPS_COUNT_CTL:
         case KVM_REG_MIPS_COUNT_RESUME:
         case KVM_REG_MIPS_COUNT_HZ:
@@ -703,6 +864,33 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu,
         return 0;
 }
 
+static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
+                                     struct kvm_enable_cap *cap)
+{
+        int r = 0;
+
+        if (!kvm_vm_ioctl_check_extension(vcpu->kvm, cap->cap))
+                return -EINVAL;
+        if (cap->flags)
+                return -EINVAL;
+        if (cap->args[0])
+                return -EINVAL;
+
+        switch (cap->cap) {
+        case KVM_CAP_MIPS_FPU:
+                vcpu->arch.fpu_enabled = true;
+                break;
+        case KVM_CAP_MIPS_MSA:
+                vcpu->arch.msa_enabled = true;
+                break;
+        default:
+                r = -EINVAL;
+                break;
+        }
+
+        return r;
+}
+
 long kvm_arch_vcpu_ioctl(struct file *filp, unsigned int ioctl,
                          unsigned long arg)
 {
@@ -760,6 +948,15 @@ long kvm_arch_vcpu_ioctl(struct file *filp, unsigned int ioctl,
                         r = kvm_vcpu_ioctl_interrupt(vcpu, &irq);
                         break;
                 }
+        case KVM_ENABLE_CAP: {
+                struct kvm_enable_cap cap;
+
+                r = -EFAULT;
+                if (copy_from_user(&cap, argp, sizeof(cap)))
+                        goto out;
+                r = kvm_vcpu_ioctl_enable_cap(vcpu, &cap);
+                break;
+        }
         default:
                 r = -ENOIOCTLCMD;
         }
@@ -868,11 +1065,30 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 
         switch (ext) {
         case KVM_CAP_ONE_REG:
+        case KVM_CAP_ENABLE_CAP:
                 r = 1;
                 break;
         case KVM_CAP_COALESCED_MMIO:
                 r = KVM_COALESCED_MMIO_PAGE_OFFSET;
                 break;
+        case KVM_CAP_MIPS_FPU:
+                r = !!cpu_has_fpu;
+                break;
+        case KVM_CAP_MIPS_MSA:
+                /*
+                 * We don't support MSA vector partitioning yet:
+                 * 1) It would require explicit support which can't be tested
+                 *    yet due to lack of support in current hardware.
+                 * 2) It extends the state that would need to be saved/restored
+                 *    by e.g. QEMU for migration.
+                 *
+                 * When vector partitioning hardware becomes available, support
+                 * could be added by requiring a flag when enabling
+                 * KVM_CAP_MIPS_MSA capability to indicate that userland knows
+                 * to save/restore the appropriate extra state.
+                 */
+                r = cpu_has_msa && !(boot_cpu_data.msa_id & MSA_IR_WRPF);
+                break;
         default:
                 r = 0;
                 break;
@@ -1119,6 +1335,30 @@ int kvm_mips_handle_exit(struct kvm_run *run, struct kvm_vcpu *vcpu)
                 ret = kvm_mips_callbacks->handle_break(vcpu);
                 break;
 
+        case T_TRAP:
+                ++vcpu->stat.trap_inst_exits;
+                trace_kvm_exit(vcpu, TRAP_INST_EXITS);
+                ret = kvm_mips_callbacks->handle_trap(vcpu);
+                break;
+
+        case T_MSAFPE:
+                ++vcpu->stat.msa_fpe_exits;
+                trace_kvm_exit(vcpu, MSA_FPE_EXITS);
+                ret = kvm_mips_callbacks->handle_msa_fpe(vcpu);
+                break;
+
+        case T_FPE:
+                ++vcpu->stat.fpe_exits;
+                trace_kvm_exit(vcpu, FPE_EXITS);
+                ret = kvm_mips_callbacks->handle_fpe(vcpu);
+                break;
+
+        case T_MSADIS:
+                ++vcpu->stat.msa_disabled_exits;
+                trace_kvm_exit(vcpu, MSA_DISABLED_EXITS);
+                ret = kvm_mips_callbacks->handle_msa_disabled(vcpu);
+                break;
+
         default:
                 kvm_err("Exception Code: %d, not yet handled, @ PC: %p, inst: 0x%08x  BadVaddr: %#lx Status: %#lx\n",
                         exccode, opc, kvm_get_inst(opc, vcpu), badvaddr,
@@ -1146,12 +1386,233 @@ skip_emul:
                 }
         }
 
+        if (ret == RESUME_GUEST) {
+                /*
+                 * If FPU / MSA are enabled (i.e. the guest's FPU / MSA context
+                 * is live), restore FCR31 / MSACSR.
+                 *
+                 * This should be before returning to the guest exception
+                 * vector, as it may well cause an [MSA] FP exception if there
+                 * are pending exception bits unmasked. (see
+                 * kvm_mips_csr_die_notifier() for how that is handled).
+                 */
+                if (kvm_mips_guest_has_fpu(&vcpu->arch) &&
+                    read_c0_status() & ST0_CU1)
+                        __kvm_restore_fcsr(&vcpu->arch);
+
+                if (kvm_mips_guest_has_msa(&vcpu->arch) &&
+                    read_c0_config5() & MIPS_CONF5_MSAEN)
+                        __kvm_restore_msacsr(&vcpu->arch);
+        }
+
         /* Disable HTW before returning to guest or host */
         htw_stop();
 
         return ret;
 }
 
+/* Enable FPU for guest and restore context */
+void kvm_own_fpu(struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        unsigned int sr, cfg5;
+
+        preempt_disable();
+
+        sr = kvm_read_c0_guest_status(cop0);
+
+        /*
+         * If MSA state is already live, it is undefined how it interacts with
+         * FR=0 FPU state, and we don't want to hit reserved instruction
+         * exceptions trying to save the MSA state later when CU=1 && FR=1, so
+         * play it safe and save it first.
+         *
+         * In theory we shouldn't ever hit this case since kvm_lose_fpu() should
+         * get called when guest CU1 is set, however we can't trust the guest
+         * not to clobber the status register directly via the commpage.
+         */
+        if (cpu_has_msa && sr & ST0_CU1 && !(sr & ST0_FR) &&
+            vcpu->arch.fpu_inuse & KVM_MIPS_FPU_MSA)
+                kvm_lose_fpu(vcpu);
+
+        /*
+         * Enable FPU for guest
+         * We set FR and FRE according to guest context
+         */
+        change_c0_status(ST0_CU1 | ST0_FR, sr);
+        if (cpu_has_fre) {
+                cfg5 = kvm_read_c0_guest_config5(cop0);
+                change_c0_config5(MIPS_CONF5_FRE, cfg5);
+        }
+        enable_fpu_hazard();
+
+        /* If guest FPU state not active, restore it now */
+        if (!(vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU)) {
+                __kvm_restore_fpu(&vcpu->arch);
+                vcpu->arch.fpu_inuse |= KVM_MIPS_FPU_FPU;
+        }
+
+        preempt_enable();
+}
+
+#ifdef CONFIG_CPU_HAS_MSA
+/* Enable MSA for guest and restore context */
+void kvm_own_msa(struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        unsigned int sr, cfg5;
+
+        preempt_disable();
+
+        /*
+         * Enable FPU if enabled in guest, since we're restoring FPU context
+         * anyway. We set FR and FRE according to guest context.
+         */
+        if (kvm_mips_guest_has_fpu(&vcpu->arch)) {
+                sr = kvm_read_c0_guest_status(cop0);
+
+                /*
+                 * If FR=0 FPU state is already live, it is undefined how it
+                 * interacts with MSA state, so play it safe and save it first.
+                 */
+                if (!(sr & ST0_FR) &&
+                    (vcpu->arch.fpu_inuse & (KVM_MIPS_FPU_FPU |
+                                KVM_MIPS_FPU_MSA)) == KVM_MIPS_FPU_FPU)
+                        kvm_lose_fpu(vcpu);
+
+                change_c0_status(ST0_CU1 | ST0_FR, sr);
+                if (sr & ST0_CU1 && cpu_has_fre) {
+                        cfg5 = kvm_read_c0_guest_config5(cop0);
+                        change_c0_config5(MIPS_CONF5_FRE, cfg5);
+                }
+        }
+
+        /* Enable MSA for guest */
+        set_c0_config5(MIPS_CONF5_MSAEN);
+        enable_fpu_hazard();
+
+        switch (vcpu->arch.fpu_inuse & (KVM_MIPS_FPU_FPU | KVM_MIPS_FPU_MSA)) {
+        case KVM_MIPS_FPU_FPU:
+                /*
+                 * Guest FPU state already loaded, only restore upper MSA state
+                 */
+                __kvm_restore_msa_upper(&vcpu->arch);
+                vcpu->arch.fpu_inuse |= KVM_MIPS_FPU_MSA;
+                break;
+        case 0:
+                /* Neither FPU or MSA already active, restore full MSA state */
+                __kvm_restore_msa(&vcpu->arch);
+                vcpu->arch.fpu_inuse |= KVM_MIPS_FPU_MSA;
+                if (kvm_mips_guest_has_fpu(&vcpu->arch))
+                        vcpu->arch.fpu_inuse |= KVM_MIPS_FPU_FPU;
+                break;
+        default:
+                break;
+        }
+
+        preempt_enable();
+}
+#endif
+
+/* Drop FPU & MSA without saving it */
+void kvm_drop_fpu(struct kvm_vcpu *vcpu)
+{
+        preempt_disable();
+        if (cpu_has_msa && vcpu->arch.fpu_inuse & KVM_MIPS_FPU_MSA) {
+                disable_msa();
+                vcpu->arch.fpu_inuse &= ~KVM_MIPS_FPU_MSA;
+        }
+        if (vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU) {
+                clear_c0_status(ST0_CU1 | ST0_FR);
+                vcpu->arch.fpu_inuse &= ~KVM_MIPS_FPU_FPU;
+        }
+        preempt_enable();
+}
+
+/* Save and disable FPU & MSA */
+void kvm_lose_fpu(struct kvm_vcpu *vcpu)
+{
+        /*
+         * FPU & MSA get disabled in root context (hardware) when it is disabled
+         * in guest context (software), but the register state in the hardware
+         * may still be in use. This is why we explicitly re-enable the hardware
+         * before saving.
+         */
+
+        preempt_disable();
+        if (cpu_has_msa && vcpu->arch.fpu_inuse & KVM_MIPS_FPU_MSA) {
+                set_c0_config5(MIPS_CONF5_MSAEN);
+                enable_fpu_hazard();
+
+                __kvm_save_msa(&vcpu->arch);
+
+                /* Disable MSA & FPU */
+                disable_msa();
+                if (vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU)
+                        clear_c0_status(ST0_CU1 | ST0_FR);
+                vcpu->arch.fpu_inuse &= ~(KVM_MIPS_FPU_FPU | KVM_MIPS_FPU_MSA);
+        } else if (vcpu->arch.fpu_inuse & KVM_MIPS_FPU_FPU) {
+                set_c0_status(ST0_CU1);
+                enable_fpu_hazard();
+
+                __kvm_save_fpu(&vcpu->arch);
+                vcpu->arch.fpu_inuse &= ~KVM_MIPS_FPU_FPU;
+
+                /* Disable FPU */
+                clear_c0_status(ST0_CU1 | ST0_FR);
+        }
+        preempt_enable();
+}
+
+/*
+ * Step over a specific ctc1 to FCSR and a specific ctcmsa to MSACSR which are
+ * used to restore guest FCSR/MSACSR state and may trigger a "harmless" FP/MSAFP
+ * exception if cause bits are set in the value being written.
+ */
+static int kvm_mips_csr_die_notify(struct notifier_block *self,
+                                   unsigned long cmd, void *ptr)
+{
+        struct die_args *args = (struct die_args *)ptr;
+        struct pt_regs *regs = args->regs;
+        unsigned long pc;
+
+        /* Only interested in FPE and MSAFPE */
+        if (cmd != DIE_FP && cmd != DIE_MSAFP)
+                return NOTIFY_DONE;
+
+        /* Return immediately if guest context isn't active */
+        if (!(current->flags & PF_VCPU))
+                return NOTIFY_DONE;
+
+        /* Should never get here from user mode */
+        BUG_ON(user_mode(regs));
+
+        pc = instruction_pointer(regs);
+        switch (cmd) {
+        case DIE_FP:
+                /* match 2nd instruction in __kvm_restore_fcsr */
+                if (pc != (unsigned long)&__kvm_restore_fcsr + 4)
+                        return NOTIFY_DONE;
+                break;
+        case DIE_MSAFP:
+                /* match 2nd/3rd instruction in __kvm_restore_msacsr */
+                if (!cpu_has_msa ||
+                    pc < (unsigned long)&__kvm_restore_msacsr + 4 ||
+                    pc > (unsigned long)&__kvm_restore_msacsr + 8)
+                        return NOTIFY_DONE;
+                break;
+        }
+
+        /* Move PC forward a little and continue executing */
+        instruction_pointer(regs) += 4;
+
+        return NOTIFY_STOP;
+}
+
+static struct notifier_block kvm_mips_csr_die_notifier = {
+        .notifier_call = kvm_mips_csr_die_notify,
+};
+
 int __init kvm_mips_init(void)
 {
         int ret;
@@ -1161,6 +1622,8 @@ int __init kvm_mips_init(void)
         if (ret)
                 return ret;
 
+        register_die_notifier(&kvm_mips_csr_die_notifier);
+
         /*
          * On MIPS, kernel modules are executed from "mapped space", which
          * requires TLBs. The TLB handling code is statically linked with
@@ -1173,7 +1636,6 @@ int __init kvm_mips_init(void)
         kvm_mips_release_pfn_clean = kvm_release_pfn_clean;
         kvm_mips_is_error_pfn = is_error_pfn;
 
-        pr_info("KVM/MIPS Initialized\n");
         return 0;
 }
 
@@ -1185,7 +1647,7 @@ void __exit kvm_mips_exit(void)
         kvm_mips_release_pfn_clean = NULL;
         kvm_mips_is_error_pfn = NULL;
 
-        pr_info("KVM/MIPS unloaded\n");
+        unregister_die_notifier(&kvm_mips_csr_die_notifier);
 }
 
 module_init(kvm_mips_init);
diff --git a/arch/mips/kvm/msa.S b/arch/mips/kvm/msa.S
new file mode 100644
index 000000000000..d02f0c6cc2cc
--- /dev/null
+++ b/arch/mips/kvm/msa.S
@@ -0,0 +1,161 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * MIPS SIMD Architecture (MSA) context handling code for KVM.
+ *
+ * Copyright (C) 2015 Imagination Technologies Ltd.
+ */
+
+#include <asm/asm.h>
+#include <asm/asm-offsets.h>
+#include <asm/asmmacro.h>
+#include <asm/regdef.h>
+
+        .set    noreorder
+        .set    noat
+
+LEAF(__kvm_save_msa)
+        st_d    0,  VCPU_FPR0,  a0
+        st_d    1,  VCPU_FPR1,  a0
+        st_d    2,  VCPU_FPR2,  a0
+        st_d    3,  VCPU_FPR3,  a0
+        st_d    4,  VCPU_FPR4,  a0
+        st_d    5,  VCPU_FPR5,  a0
+        st_d    6,  VCPU_FPR6,  a0
+        st_d    7,  VCPU_FPR7,  a0
+        st_d    8,  VCPU_FPR8,  a0
+        st_d    9,  VCPU_FPR9,  a0
+        st_d    10, VCPU_FPR10, a0
+        st_d    11, VCPU_FPR11, a0
+        st_d    12, VCPU_FPR12, a0
+        st_d    13, VCPU_FPR13, a0
+        st_d    14, VCPU_FPR14, a0
+        st_d    15, VCPU_FPR15, a0
+        st_d    16, VCPU_FPR16, a0
+        st_d    17, VCPU_FPR17, a0
+        st_d    18, VCPU_FPR18, a0
+        st_d    19, VCPU_FPR19, a0
+        st_d    20, VCPU_FPR20, a0
+        st_d    21, VCPU_FPR21, a0
+        st_d    22, VCPU_FPR22, a0
+        st_d    23, VCPU_FPR23, a0
+        st_d    24, VCPU_FPR24, a0
+        st_d    25, VCPU_FPR25, a0
+        st_d    26, VCPU_FPR26, a0
+        st_d    27, VCPU_FPR27, a0
+        st_d    28, VCPU_FPR28, a0
+        st_d    29, VCPU_FPR29, a0
+        st_d    30, VCPU_FPR30, a0
+        st_d    31, VCPU_FPR31, a0
+        jr      ra
+         nop
+        END(__kvm_save_msa)
+
+LEAF(__kvm_restore_msa)
+        ld_d    0,  VCPU_FPR0,  a0
+        ld_d    1,  VCPU_FPR1,  a0
+        ld_d    2,  VCPU_FPR2,  a0
+        ld_d    3,  VCPU_FPR3,  a0
+        ld_d    4,  VCPU_FPR4,  a0
+        ld_d    5,  VCPU_FPR5,  a0
+        ld_d    6,  VCPU_FPR6,  a0
+        ld_d    7,  VCPU_FPR7,  a0
+        ld_d    8,  VCPU_FPR8,  a0
+        ld_d    9,  VCPU_FPR9,  a0
+        ld_d    10, VCPU_FPR10, a0
+        ld_d    11, VCPU_FPR11, a0
+        ld_d    12, VCPU_FPR12, a0
+        ld_d    13, VCPU_FPR13, a0
+        ld_d    14, VCPU_FPR14, a0
+        ld_d    15, VCPU_FPR15, a0
+        ld_d    16, VCPU_FPR16, a0
+        ld_d    17, VCPU_FPR17, a0
+        ld_d    18, VCPU_FPR18, a0
+        ld_d    19, VCPU_FPR19, a0
+        ld_d    20, VCPU_FPR20, a0
+        ld_d    21, VCPU_FPR21, a0
+        ld_d    22, VCPU_FPR22, a0
+        ld_d    23, VCPU_FPR23, a0
+        ld_d    24, VCPU_FPR24, a0
+        ld_d    25, VCPU_FPR25, a0
+        ld_d    26, VCPU_FPR26, a0
+        ld_d    27, VCPU_FPR27, a0
+        ld_d    28, VCPU_FPR28, a0
+        ld_d    29, VCPU_FPR29, a0
+        ld_d    30, VCPU_FPR30, a0
+        ld_d    31, VCPU_FPR31, a0
+        jr      ra
+         nop
+        END(__kvm_restore_msa)
+
+        .macro  kvm_restore_msa_upper   wr, off, base
+        .set    push
+        .set    noat
+#ifdef CONFIG_64BIT
+        ld      $1, \off(\base)
+        insert_d \wr, 1
+#elif defined(CONFIG_CPU_LITTLE_ENDIAN)
+        lw      $1, \off(\base)
+        insert_w \wr, 2
+        lw      $1, (\off+4)(\base)
+        insert_w \wr, 3
+#else /* CONFIG_CPU_BIG_ENDIAN */
+        lw      $1, (\off+4)(\base)
+        insert_w \wr, 2
+        lw      $1, \off(\base)
+        insert_w \wr, 3
+#endif
+        .set    pop
+        .endm
+
+LEAF(__kvm_restore_msa_upper)
+        kvm_restore_msa_upper   0,  VCPU_FPR0 +8, a0
+        kvm_restore_msa_upper   1,  VCPU_FPR1 +8, a0
+        kvm_restore_msa_upper   2,  VCPU_FPR2 +8, a0
+        kvm_restore_msa_upper   3,  VCPU_FPR3 +8, a0
+        kvm_restore_msa_upper   4,  VCPU_FPR4 +8, a0
+        kvm_restore_msa_upper   5,  VCPU_FPR5 +8, a0
+        kvm_restore_msa_upper   6,  VCPU_FPR6 +8, a0
+        kvm_restore_msa_upper   7,  VCPU_FPR7 +8, a0
+        kvm_restore_msa_upper   8,  VCPU_FPR8 +8, a0
+        kvm_restore_msa_upper   9,  VCPU_FPR9 +8, a0
+        kvm_restore_msa_upper   10, VCPU_FPR10+8, a0
+        kvm_restore_msa_upper   11, VCPU_FPR11+8, a0
+        kvm_restore_msa_upper   12, VCPU_FPR12+8, a0
+        kvm_restore_msa_upper   13, VCPU_FPR13+8, a0
+        kvm_restore_msa_upper   14, VCPU_FPR14+8, a0
+        kvm_restore_msa_upper   15, VCPU_FPR15+8, a0
+        kvm_restore_msa_upper   16, VCPU_FPR16+8, a0
+        kvm_restore_msa_upper   17, VCPU_FPR17+8, a0
+        kvm_restore_msa_upper   18, VCPU_FPR18+8, a0
+        kvm_restore_msa_upper   19, VCPU_FPR19+8, a0
+        kvm_restore_msa_upper   20, VCPU_FPR20+8, a0
+        kvm_restore_msa_upper   21, VCPU_FPR21+8, a0
+        kvm_restore_msa_upper   22, VCPU_FPR22+8, a0
+        kvm_restore_msa_upper   23, VCPU_FPR23+8, a0
+        kvm_restore_msa_upper   24, VCPU_FPR24+8, a0
+        kvm_restore_msa_upper   25, VCPU_FPR25+8, a0
+        kvm_restore_msa_upper   26, VCPU_FPR26+8, a0
+        kvm_restore_msa_upper   27, VCPU_FPR27+8, a0
+        kvm_restore_msa_upper   28, VCPU_FPR28+8, a0
+        kvm_restore_msa_upper   29, VCPU_FPR29+8, a0
+        kvm_restore_msa_upper   30, VCPU_FPR30+8, a0
+        kvm_restore_msa_upper   31, VCPU_FPR31+8, a0
+        jr      ra
+         nop
+        END(__kvm_restore_msa_upper)
+
+LEAF(__kvm_restore_msacsr)
+        lw      t0, VCPU_MSA_CSR(a0)
+        /*
+         * The ctcmsa must stay at this offset in __kvm_restore_msacsr.
+         * See kvm_mips_csr_die_notify() which handles t0 containing a value
+         * which triggers an MSA FP Exception, which must be stepped over and
+         * ignored since the set cause bits must remain there for the guest.
+         */
+        _ctcmsa MSA_CSR, t0
+        jr      ra
+         nop
+        END(__kvm_restore_msacsr)
diff --git a/arch/mips/kvm/stats.c b/arch/mips/kvm/stats.c
index a74d6024c5ad..888bb67070ac 100644
--- a/arch/mips/kvm/stats.c
+++ b/arch/mips/kvm/stats.c
@@ -25,6 +25,10 @@ char *kvm_mips_exit_types_str[MAX_KVM_MIPS_EXIT_TYPES] = {
         "System Call",
         "Reserved Inst",
         "Break Inst",
+        "Trap Inst",
+        "MSA FPE",
+        "FPE",
+        "MSA Disabled",
         "D-Cache Flushes",
 };
 
diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
index bbcd82242059..aed0ac2a4972 100644
--- a/arch/mips/kvm/tlb.c
+++ b/arch/mips/kvm/tlb.c
@@ -216,6 +216,7 @@ int kvm_mips_host_tlb_write(struct kvm_vcpu *vcpu, unsigned long entryhi,
         if (idx > current_cpu_data.tlbsize) {
                 kvm_err("%s: Invalid Index: %d\n", __func__, idx);
                 kvm_mips_dump_host_tlbs();
+                local_irq_restore(flags);
                 return -1;
         }
 
@@ -732,6 +733,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                 }
         }
 
+        /* restore guest state to registers */
+        kvm_mips_callbacks->vcpu_set_regs(vcpu);
+
         local_irq_restore(flags);
 
 }
@@ -750,6 +754,9 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
         vcpu->arch.preempt_entryhi = read_c0_entryhi();
         vcpu->arch.last_sched_cpu = cpu;
 
+        /* save guest state in registers */
+        kvm_mips_callbacks->vcpu_get_regs(vcpu);
+
         if (((cpu_context(cpu, current->mm) ^ asid_cache(cpu)) &
              ASID_VERSION_MASK)) {
                 kvm_debug("%s: Dropping MMU Context:  %#lx\n", __func__,
diff --git a/arch/mips/kvm/trace.h b/arch/mips/kvm/trace.h
index c1388d40663b..bd6437f67dc0 100644
--- a/arch/mips/kvm/trace.h
+++ b/arch/mips/kvm/trace.h
@@ -24,18 +24,18 @@ TRACE_EVENT(kvm_exit,
             TP_PROTO(struct kvm_vcpu *vcpu, unsigned int reason),
             TP_ARGS(vcpu, reason),
             TP_STRUCT__entry(
-                        __field(struct kvm_vcpu *, vcpu)
+                        __field(unsigned long, pc)
                         __field(unsigned int, reason)
             ),
 
             TP_fast_assign(
-                        __entry->vcpu = vcpu;
+                        __entry->pc = vcpu->arch.pc;
                         __entry->reason = reason;
             ),
 
             TP_printk("[%s]PC: 0x%08lx",
                       kvm_mips_exit_types_str[__entry->reason],
-                      __entry->vcpu->arch.pc)
+                      __entry->pc)
 );
 
 #endif /* _TRACE_KVM_H */
diff --git a/arch/mips/kvm/trap_emul.c b/arch/mips/kvm/trap_emul.c
index fd7257b70e65..d836ed5b0bc7 100644
--- a/arch/mips/kvm/trap_emul.c
+++ b/arch/mips/kvm/trap_emul.c
@@ -39,16 +39,30 @@ static gpa_t kvm_trap_emul_gva_to_gpa_cb(gva_t gva)
 
 static int kvm_trap_emul_handle_cop_unusable(struct kvm_vcpu *vcpu)
 {
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
         struct kvm_run *run = vcpu->run;
         uint32_t __user *opc = (uint32_t __user *) vcpu->arch.pc;
         unsigned long cause = vcpu->arch.host_cp0_cause;
         enum emulation_result er = EMULATE_DONE;
         int ret = RESUME_GUEST;
 
-        if (((cause & CAUSEF_CE) >> CAUSEB_CE) == 1)
-                er = kvm_mips_emulate_fpu_exc(cause, opc, run, vcpu);
-        else
+        if (((cause & CAUSEF_CE) >> CAUSEB_CE) == 1) {
+                /* FPU Unusable */
+                if (!kvm_mips_guest_has_fpu(&vcpu->arch) ||
+                    (kvm_read_c0_guest_status(cop0) & ST0_CU1) == 0) {
+                        /*
+                         * Unusable/no FPU in guest:
+                         * deliver guest COP1 Unusable Exception
+                         */
+                        er = kvm_mips_emulate_fpu_exc(cause, opc, run, vcpu);
+                } else {
+                        /* Restore FPU state */
+                        kvm_own_fpu(vcpu);
+                        er = EMULATE_DONE;
+                }
+        } else {
                 er = kvm_mips_emulate_inst(cause, opc, run, vcpu);
+        }
 
         switch (er) {
         case EMULATE_DONE:
@@ -330,6 +344,107 @@ static int kvm_trap_emul_handle_break(struct kvm_vcpu *vcpu)
         return ret;
 }
 
+static int kvm_trap_emul_handle_trap(struct kvm_vcpu *vcpu)
+{
+        struct kvm_run *run = vcpu->run;
+        uint32_t __user *opc = (uint32_t __user *)vcpu->arch.pc;
+        unsigned long cause = vcpu->arch.host_cp0_cause;
+        enum emulation_result er = EMULATE_DONE;
+        int ret = RESUME_GUEST;
+
+        er = kvm_mips_emulate_trap_exc(cause, opc, run, vcpu);
+        if (er == EMULATE_DONE) {
+                ret = RESUME_GUEST;
+        } else {
+                run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+                ret = RESUME_HOST;
+        }
+        return ret;
+}
+
+static int kvm_trap_emul_handle_msa_fpe(struct kvm_vcpu *vcpu)
+{
+        struct kvm_run *run = vcpu->run;
+        uint32_t __user *opc = (uint32_t __user *)vcpu->arch.pc;
+        unsigned long cause = vcpu->arch.host_cp0_cause;
+        enum emulation_result er = EMULATE_DONE;
+        int ret = RESUME_GUEST;
+
+        er = kvm_mips_emulate_msafpe_exc(cause, opc, run, vcpu);
+        if (er == EMULATE_DONE) {
+                ret = RESUME_GUEST;
+        } else {
+                run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+                ret = RESUME_HOST;
+        }
+        return ret;
+}
+
+static int kvm_trap_emul_handle_fpe(struct kvm_vcpu *vcpu)
+{
+        struct kvm_run *run = vcpu->run;
+        uint32_t __user *opc = (uint32_t __user *)vcpu->arch.pc;
+        unsigned long cause = vcpu->arch.host_cp0_cause;
+        enum emulation_result er = EMULATE_DONE;
+        int ret = RESUME_GUEST;
+
+        er = kvm_mips_emulate_fpe_exc(cause, opc, run, vcpu);
+        if (er == EMULATE_DONE) {
+                ret = RESUME_GUEST;
+        } else {
+                run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+                ret = RESUME_HOST;
+        }
+        return ret;
+}
+
+/**
+ * kvm_trap_emul_handle_msa_disabled() - Guest used MSA while disabled in root.
+ * @vcpu:       Virtual CPU context.
+ *
+ * Handle when the guest attempts to use MSA when it is disabled.
+ */
+static int kvm_trap_emul_handle_msa_disabled(struct kvm_vcpu *vcpu)
+{
+        struct mips_coproc *cop0 = vcpu->arch.cop0;
+        struct kvm_run *run = vcpu->run;
+        uint32_t __user *opc = (uint32_t __user *) vcpu->arch.pc;
+        unsigned long cause = vcpu->arch.host_cp0_cause;
+        enum emulation_result er = EMULATE_DONE;
+        int ret = RESUME_GUEST;
+
+        if (!kvm_mips_guest_has_msa(&vcpu->arch) ||
+            (kvm_read_c0_guest_status(cop0) & (ST0_CU1 | ST0_FR)) == ST0_CU1) {
+                /*
+                 * No MSA in guest, or FPU enabled and not in FR=1 mode,
+                 * guest reserved instruction exception
+                 */
+                er = kvm_mips_emulate_ri_exc(cause, opc, run, vcpu);
+        } else if (!(kvm_read_c0_guest_config5(cop0) & MIPS_CONF5_MSAEN)) {
+                /* MSA disabled by guest, guest MSA disabled exception */
+                er = kvm_mips_emulate_msadis_exc(cause, opc, run, vcpu);
+        } else {
+                /* Restore MSA/FPU state */
+                kvm_own_msa(vcpu);
+                er = EMULATE_DONE;
+        }
+
+        switch (er) {
+        case EMULATE_DONE:
+                ret = RESUME_GUEST;
+                break;
+
+        case EMULATE_FAIL:
+                run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+                ret = RESUME_HOST;
+                break;
+
+        default:
+                BUG();
+        }
+        return ret;
+}
+
 static int kvm_trap_emul_vm_init(struct kvm *kvm)
 {
         return 0;
@@ -351,8 +466,9 @@ static int kvm_trap_emul_vcpu_setup(struct kvm_vcpu *vcpu)
          * guest will come up as expected, for now we simulate a MIPS 24kc
          */
         kvm_write_c0_guest_prid(cop0, 0x00019300);
-        kvm_write_c0_guest_config(cop0,
-                                  MIPS_CONFIG0 | (0x1 << CP0C0_AR) |
+        /* Have config1, Cacheable, noncoherent, write-back, write allocate */
+        kvm_write_c0_guest_config(cop0, MIPS_CONF_M | (0x3 << CP0C0_K0) |
+                                  (0x1 << CP0C0_AR) |
                                   (MMU_TYPE_R4000 << CP0C0_MT));
 
         /* Read the cache characteristics from the host Config1 Register */
@@ -368,10 +484,18 @@ static int kvm_trap_emul_vcpu_setup(struct kvm_vcpu *vcpu)
               (1 << CP0C1_WR) | (1 << CP0C1_CA));
         kvm_write_c0_guest_config1(cop0, config1);
 
-        kvm_write_c0_guest_config2(cop0, MIPS_CONFIG2);
-        /* MIPS_CONFIG2 | (read_c0_config2() & 0xfff) */
-        kvm_write_c0_guest_config3(cop0, MIPS_CONFIG3 | (0 << CP0C3_VInt) |
-                                         (1 << CP0C3_ULRI));
+        /* Have config3, no tertiary/secondary caches implemented */
+        kvm_write_c0_guest_config2(cop0, MIPS_CONF_M);
+        /* MIPS_CONF_M | (read_c0_config2() & 0xfff) */
+
+        /* Have config4, UserLocal */
+        kvm_write_c0_guest_config3(cop0, MIPS_CONF_M | MIPS_CONF3_ULRI);
+
+        /* Have config5 */
+        kvm_write_c0_guest_config4(cop0, MIPS_CONF_M);
+
+        /* No config6 */
+        kvm_write_c0_guest_config5(cop0, 0);
 
         /* Set Wait IE/IXMT Ignore in Config7, IAR, AR */
         kvm_write_c0_guest_config7(cop0, (MIPS_CONF7_WII) | (1 << 10));
@@ -416,6 +540,7 @@ static int kvm_trap_emul_set_one_reg(struct kvm_vcpu *vcpu,
 {
         struct mips_coproc *cop0 = vcpu->arch.cop0;
         int ret = 0;
+        unsigned int cur, change;
 
         switch (reg->id) {
         case KVM_REG_MIPS_CP0_COUNT:
@@ -444,6 +569,44 @@ static int kvm_trap_emul_set_one_reg(struct kvm_vcpu *vcpu,
                         kvm_write_c0_guest_cause(cop0, v);
                 }
                 break;
+        case KVM_REG_MIPS_CP0_CONFIG:
+                /* read-only for now */
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG1:
+                cur = kvm_read_c0_guest_config1(cop0);
+                change = (cur ^ v) & kvm_mips_config1_wrmask(vcpu);
+                if (change) {
+                        v = cur ^ change;
+                        kvm_write_c0_guest_config1(cop0, v);
+                }
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG2:
+                /* read-only for now */
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG3:
+                cur = kvm_read_c0_guest_config3(cop0);
+                change = (cur ^ v) & kvm_mips_config3_wrmask(vcpu);
+                if (change) {
+                        v = cur ^ change;
+                        kvm_write_c0_guest_config3(cop0, v);
+                }
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG4:
+                cur = kvm_read_c0_guest_config4(cop0);
+                change = (cur ^ v) & kvm_mips_config4_wrmask(vcpu);
+                if (change) {
+                        v = cur ^ change;
+                        kvm_write_c0_guest_config4(cop0, v);
+                }
+                break;
+        case KVM_REG_MIPS_CP0_CONFIG5:
+                cur = kvm_read_c0_guest_config5(cop0);
+                change = (cur ^ v) & kvm_mips_config5_wrmask(vcpu);
+                if (change) {
+                        v = cur ^ change;
+                        kvm_write_c0_guest_config5(cop0, v);
+                }
+                break;
         case KVM_REG_MIPS_COUNT_CTL:
                 ret = kvm_mips_set_count_ctl(vcpu, v);
                 break;
@@ -459,6 +622,18 @@ static int kvm_trap_emul_set_one_reg(struct kvm_vcpu *vcpu,
         return ret;
 }
 
+static int kvm_trap_emul_vcpu_get_regs(struct kvm_vcpu *vcpu)
+{
+        kvm_lose_fpu(vcpu);
+
+        return 0;
+}
+
+static int kvm_trap_emul_vcpu_set_regs(struct kvm_vcpu *vcpu)
+{
+        return 0;
+}
+
 static struct kvm_mips_callbacks kvm_trap_emul_callbacks = {
         /* exit handlers */
         .handle_cop_unusable = kvm_trap_emul_handle_cop_unusable,
@@ -470,6 +645,10 @@ static struct kvm_mips_callbacks kvm_trap_emul_callbacks = {
         .handle_syscall = kvm_trap_emul_handle_syscall,
         .handle_res_inst = kvm_trap_emul_handle_res_inst,
         .handle_break = kvm_trap_emul_handle_break,
+        .handle_trap = kvm_trap_emul_handle_trap,
+        .handle_msa_fpe = kvm_trap_emul_handle_msa_fpe,
+        .handle_fpe = kvm_trap_emul_handle_fpe,
+        .handle_msa_disabled = kvm_trap_emul_handle_msa_disabled,
 
         .vm_init = kvm_trap_emul_vm_init,
         .vcpu_init = kvm_trap_emul_vcpu_init,
@@ -483,6 +662,8 @@ static struct kvm_mips_callbacks kvm_trap_emul_callbacks = {
         .irq_clear = kvm_mips_irq_clear_cb,
         .get_one_reg = kvm_trap_emul_get_one_reg,
         .set_one_reg = kvm_trap_emul_set_one_reg,
+        .vcpu_get_regs = kvm_trap_emul_vcpu_get_regs,
+        .vcpu_set_regs = kvm_trap_emul_vcpu_set_regs,
 };
 
 int kvm_mips_emulation_init(struct kvm_mips_callbacks **install_callbacks)
diff --git a/arch/mn10300/include/asm/pgtable.h b/arch/mn10300/include/asm/pgtable.h
index afab728ab65e..96d3f9deb59c 100644
--- a/arch/mn10300/include/asm/pgtable.h
+++ b/arch/mn10300/include/asm/pgtable.h
@@ -56,7 +56,9 @@ extern void paging_init(void);
 #define PGDIR_SHIFT     22
 #define PTRS_PER_PGD    1024
 #define PTRS_PER_PUD    1       /* we don't really have any PUD physically */
+#define __PAGETABLE_PUD_FOLDED
 #define PTRS_PER_PMD    1       /* we don't really have any PMD physically */
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PTE    1024
 
 #define PGD_SIZE        PAGE_SIZE
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index 8c966b2270aa..15207b9362bf 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -96,6 +96,7 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
 #if PT_NLEVELS == 3
 #define BITS_PER_PMD    (PAGE_SHIFT + PMD_ORDER - BITS_PER_PMD_ENTRY)
 #else
+#define __PAGETABLE_PMD_FOLDED
 #define BITS_PER_PMD    0
 #endif
 #define PTRS_PER_PMD    (1UL << BITS_PER_PMD)
diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
index 9cfa3706a1b8..f1ea5972f6ec 100644
--- a/arch/powerpc/include/asm/iommu.h
+++ b/arch/powerpc/include/asm/iommu.h
@@ -113,6 +113,7 @@ extern void iommu_register_group(struct iommu_table *tbl,
                                  int pci_domain_number, unsigned long pe_num);
 extern int iommu_add_device(struct device *dev);
 extern void iommu_del_device(struct device *dev);
+extern int __init tce_iommu_bus_notifier_init(void);
 #else
 static inline void iommu_register_group(struct iommu_table *tbl,
                                         int pci_domain_number,
@@ -128,6 +129,11 @@ static inline int iommu_add_device(struct device *dev)
 static inline void iommu_del_device(struct device *dev)
 {
 }
+
+static inline int __init tce_iommu_bus_notifier_init(void)
+{
+        return 0;
+}
 #endif /* !CONFIG_IOMMU_API */
 
 static inline void set_iommu_table_base_and_group(struct device *dev,
diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
new file mode 100644
index 000000000000..744fd54de374
--- /dev/null
+++ b/arch/powerpc/include/asm/irq_work.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_POWERPC_IRQ_WORK_H
+#define _ASM_POWERPC_IRQ_WORK_H
+
+static inline bool arch_irq_work_has_interrupt(void)
+{
+        return true;
+}
+
+#endif /* _ASM_POWERPC_IRQ_WORK_H */
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 5d3968c4d799..b054f33ab1fb 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1175,4 +1175,30 @@ void iommu_del_device(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(iommu_del_device);
 
+static int tce_iommu_bus_notifier(struct notifier_block *nb,
+                unsigned long action, void *data)
+{
+        struct device *dev = data;
+
+        switch (action) {
+        case BUS_NOTIFY_ADD_DEVICE:
+                return iommu_add_device(dev);
+        case BUS_NOTIFY_DEL_DEVICE:
+                if (dev->iommu_group)
+                        iommu_del_device(dev);
+                return 0;
+        default:
+                return 0;
+        }
+}
+
+static struct notifier_block tce_iommu_bus_nb = {
+        .notifier_call = tce_iommu_bus_notifier,
+};
+
+int __init tce_iommu_bus_notifier_init(void)
+{
+        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
+        return 0;
+}
 #endif /* CONFIG_IOMMU_API */
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 6e19afa35a15..ec9ec2058d2d 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -541,8 +541,8 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
         if (smp_ops->give_timebase)
                 smp_ops->give_timebase();
 
-        /* Wait until cpu puts itself in the online map */
-        while (!cpu_online(cpu))
+        /* Wait until cpu puts itself in the online & active maps */
+        while (!cpu_online(cpu) || !cpu_active(cpu))
                 cpu_relax();
 
         return 0;
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index e69142f4af08..54323d6b5166 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -836,30 +836,4 @@ void __init pnv_pci_init(void)
 #endif
 }
 
-static int tce_iommu_bus_notifier(struct notifier_block *nb,
-                unsigned long action, void *data)
-{
-        struct device *dev = data;
-
-        switch (action) {
-        case BUS_NOTIFY_ADD_DEVICE:
-                return iommu_add_device(dev);
-        case BUS_NOTIFY_DEL_DEVICE:
-                if (dev->iommu_group)
-                        iommu_del_device(dev);
-                return 0;
-        default:
-                return 0;
-        }
-}
-
-static struct notifier_block tce_iommu_bus_nb = {
-        .notifier_call = tce_iommu_bus_notifier,
-};
-
-static int __init tce_iommu_bus_notifier_init(void)
-{
-        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-        return 0;
-}
 machine_subsys_initcall_sync(powernv, tce_iommu_bus_notifier_init);
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 1d3d52dc3ff3..7803a19adb31 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -1340,3 +1340,5 @@ static int __init disable_multitce(char *str)
 }
 
 __setup("multitce=", disable_multitce);
+
+machine_subsys_initcall_sync(pseries, tce_iommu_bus_notifier_init);
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index d84559e31f32..b8d1e97fb201 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -172,7 +172,9 @@ struct kvm_s390_sie_block {
         __u32   fac;                    /* 0x01a0 */
         __u8    reserved1a4[20];        /* 0x01a4 */
         __u64   cbrlo;                  /* 0x01b8 */
-        __u8    reserved1c0[30];        /* 0x01c0 */
+        __u8    reserved1c0[8];         /* 0x01c0 */
+        __u32   ecd;                    /* 0x01c8 */
+        __u8    reserved1cc[18];        /* 0x01cc */
         __u64   pp;                     /* 0x01de */
         __u8    reserved1e6[2];         /* 0x01e6 */
         __u64   itdba;                  /* 0x01e8 */
@@ -183,11 +185,17 @@ struct kvm_s390_itdb {
         __u8    data[256];
 } __packed;
 
+struct kvm_s390_vregs {
+        __vector128 vrs[32];
+        __u8    reserved200[512];       /* for future vector expansion */
+} __packed;
+
 struct sie_page {
         struct kvm_s390_sie_block sie_block;
         __u8 reserved200[1024];         /* 0x0200 */
         struct kvm_s390_itdb itdb;      /* 0x0600 */
-        __u8 reserved700[2304];         /* 0x0700 */
+        __u8 reserved700[1280];         /* 0x0700 */
+        struct kvm_s390_vregs vregs;    /* 0x0c00 */
 } __packed;
 
 struct kvm_vcpu_stat {
@@ -238,6 +246,7 @@ struct kvm_vcpu_stat {
         u32 instruction_sigp_stop;
         u32 instruction_sigp_stop_store_status;
         u32 instruction_sigp_store_status;
+        u32 instruction_sigp_store_adtl_status;
         u32 instruction_sigp_arch;
         u32 instruction_sigp_prefix;
         u32 instruction_sigp_restart;
@@ -270,6 +279,7 @@ struct kvm_vcpu_stat {
 #define PGM_SPECIAL_OPERATION           0x13
 #define PGM_OPERAND                     0x15
 #define PGM_TRACE_TABEL                 0x16
+#define PGM_VECTOR_PROCESSING           0x1b
 #define PGM_SPACE_SWITCH                0x1c
 #define PGM_HFP_SQUARE_ROOT             0x1d
 #define PGM_PC_TRANSLATION_SPEC         0x1f
@@ -465,6 +475,7 @@ struct kvm_vcpu_arch {
         s390_fp_regs      host_fpregs;
         unsigned int      host_acrs[NUM_ACRS];
         s390_fp_regs      guest_fpregs;
+        struct kvm_s390_vregs   *host_vregs;
         struct kvm_s390_local_interrupt local_int;
         struct hrtimer    ckc_timer;
         struct kvm_s390_pgm_info pgm;
@@ -515,15 +526,15 @@ struct s390_io_adapter {
 #define S390_ARCH_FAC_MASK_SIZE_U64 \
         (S390_ARCH_FAC_MASK_SIZE_BYTE / sizeof(u64))
 
-struct s390_model_fac {
-        /* facilities used in SIE context */
-        __u64 sie[S390_ARCH_FAC_LIST_SIZE_U64];
-        /* subset enabled by kvm */
-        __u64 kvm[S390_ARCH_FAC_LIST_SIZE_U64];
+struct kvm_s390_fac {
+        /* facility list requested by guest */
+        __u64 list[S390_ARCH_FAC_LIST_SIZE_U64];
+        /* facility mask supported by kvm & hosting machine */
+        __u64 mask[S390_ARCH_FAC_LIST_SIZE_U64];
 };
 
 struct kvm_s390_cpu_model {
-        struct s390_model_fac *fac;
+        struct kvm_s390_fac *fac;
         struct cpuid cpu_id;
         unsigned short ibc;
 };
@@ -553,6 +564,7 @@ struct kvm_arch{
         int use_cmma;
         int user_cpu_state_ctrl;
         int user_sigp;
+        int user_stsi;
         struct s390_io_adapter *adapters[MAX_S390_IO_ADAPTERS];
         wait_queue_head_t ipte_wq;
         int ipte_lock_count;
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index f49b71954654..8fb3802f8fad 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -62,6 +62,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
         int cpu = smp_processor_id();
 
+        S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
         if (prev == next)
                 return;
         if (MACHINE_HAS_TLB_LC)
@@ -73,7 +74,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         atomic_dec(&prev->context.attach_count);
         if (MACHINE_HAS_TLB_LC)
                 cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
-        S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
 }
 
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 7b2ac6e44166..53eacbd4f09b 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -37,16 +37,7 @@ static inline void storage_key_init_range(unsigned long start, unsigned long end
 #endif
 }
 
-static inline void clear_page(void *page)
-{
-        register unsigned long reg1 asm ("1") = 0;
-        register void *reg2 asm ("2") = page;
-        register unsigned long reg3 asm ("3") = 4096;
-        asm volatile(
-                "       mvcl    2,0"
-                : "+d" (reg2), "+d" (reg3) : "d" (reg1)
-                : "memory", "cc");
-}
+#define clear_page(page)        memset((page), 0, PAGE_SIZE)
 
 /*
  * copy_page uses the mvcl instruction with 0xb0 padding byte in order to
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index fbb5ee3ae57c..e08ec38f8c6e 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -91,7 +91,9 @@ extern unsigned long zero_page_mask;
  */
 #define PTRS_PER_PTE    256
 #ifndef CONFIG_64BIT
+#define __PAGETABLE_PUD_FOLDED
 #define PTRS_PER_PMD    1
+#define __PAGETABLE_PMD_FOLDED
 #define PTRS_PER_PUD    1
 #else /* CONFIG_64BIT */
 #define PTRS_PER_PMD    2048
diff --git a/arch/s390/include/uapi/asm/kvm.h b/arch/s390/include/uapi/asm/kvm.h
index 9c77e60b9a26..ef1a5fcc6c66 100644
--- a/arch/s390/include/uapi/asm/kvm.h
+++ b/arch/s390/include/uapi/asm/kvm.h
@@ -150,6 +150,7 @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_CRS    (1UL << 3)
 #define KVM_SYNC_ARCH0  (1UL << 4)
 #define KVM_SYNC_PFAULT (1UL << 5)
+#define KVM_SYNC_VRS    (1UL << 6)
 /* definition of registers in kvm_run */
 struct kvm_sync_regs {
         __u64 prefix;   /* prefix register */
@@ -164,6 +165,9 @@ struct kvm_sync_regs {
         __u64 pft;      /* pfault token [PFAULT] */
         __u64 pfs;      /* pfault select [PFAULT] */
         __u64 pfc;      /* pfault compare [PFAULT] */
+        __u64 vrs[32][2];       /* vector registers */
+        __u8  reserved[512];    /* for future vector expansion */
+        __u32 fpc;      /* only valid with vector registers */
 };
 
 #define KVM_REG_S390_TODPR      (KVM_REG_S390 | KVM_REG_SIZE_U32 | 0x1)
diff --git a/arch/s390/include/uapi/asm/sie.h b/arch/s390/include/uapi/asm/sie.h
index d4096fdfc6ab..ee69c0854c88 100644
--- a/arch/s390/include/uapi/asm/sie.h
+++ b/arch/s390/include/uapi/asm/sie.h
@@ -230,7 +230,7 @@
  * and returns a key, which can be used to find a mnemonic name
  * of the instruction in the icpt_insn_codes table.
  */
-#define icpt_insn_decoder(insn)                 \
+#define icpt_insn_decoder(insn) (               \
         INSN_DECODE_IPA0(0x01, insn, 48, 0xff)  \
         INSN_DECODE_IPA0(0xaa, insn, 48, 0x0f)  \
         INSN_DECODE_IPA0(0xb2, insn, 48, 0xff)  \
@@ -239,6 +239,6 @@
         INSN_DECODE_IPA0(0xe5, insn, 48, 0xff)  \
         INSN_DECODE_IPA0(0xeb, insn, 16, 0xff)  \
         INSN_DECODE_IPA0(0xc8, insn, 48, 0x0f)  \
-        INSN_DECODE(insn)
+        INSN_DECODE(insn))
 
 #endif /* _UAPI_ASM_S390_SIE_H */
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index e07e91605353..8dc4db10d160 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -171,6 +171,7 @@ int main(void)
 #else /* CONFIG_32BIT */
         DEFINE(__LC_DATA_EXC_CODE, offsetof(struct _lowcore, data_exc_code));
         DEFINE(__LC_MCCK_FAIL_STOR_ADDR, offsetof(struct _lowcore, failing_storage_address));
+        DEFINE(__LC_VX_SAVE_AREA_ADDR, offsetof(struct _lowcore, vector_save_area_addr));
         DEFINE(__LC_EXT_PARAMS2, offsetof(struct _lowcore, ext_params2));
         DEFINE(SAVE_AREA_BASE, offsetof(struct _lowcore, floating_pt_save_area));
         DEFINE(__LC_PASTE, offsetof(struct _lowcore, paste));
diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index cb2d51e779df..830066f936c8 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -36,16 +36,20 @@ static void jump_label_make_branch(struct jump_entry *entry, struct insn *insn)
         insn->offset = (entry->target - entry->code) >> 1;
 }
 
-static void jump_label_bug(struct jump_entry *entry, struct insn *insn)
+static void jump_label_bug(struct jump_entry *entry, struct insn *expected,
+                           struct insn *new)
 {
         unsigned char *ipc = (unsigned char *)entry->code;
-        unsigned char *ipe = (unsigned char *)insn;
+        unsigned char *ipe = (unsigned char *)expected;
+        unsigned char *ipn = (unsigned char *)new;
 
         pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc);
         pr_emerg("Found:    %02x %02x %02x %02x %02x %02x\n",
                  ipc[0], ipc[1], ipc[2], ipc[3], ipc[4], ipc[5]);
         pr_emerg("Expected: %02x %02x %02x %02x %02x %02x\n",
                  ipe[0], ipe[1], ipe[2], ipe[3], ipe[4], ipe[5]);
+        pr_emerg("New:      %02x %02x %02x %02x %02x %02x\n",
+                 ipn[0], ipn[1], ipn[2], ipn[3], ipn[4], ipn[5]);
         panic("Corrupted kernel text");
 }
 
@@ -69,10 +73,10 @@ static void __jump_label_transform(struct jump_entry *entry,
         }
         if (init) {
                 if (memcmp((void *)entry->code, &orignop, sizeof(orignop)))
-                        jump_label_bug(entry, &old);
+                        jump_label_bug(entry, &orignop, &new);
         } else {
                 if (memcmp((void *)entry->code, &old, sizeof(old)))
-                        jump_label_bug(entry, &old);
+                        jump_label_bug(entry, &old, &new);
         }
         probe_kernel_write((void *)entry->code, &new, sizeof(new));
 }
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 36154a2f1814..2ca95862e336 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -436,6 +436,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                     const Elf_Shdr *sechdrs,
                     struct module *me)
 {
+        jump_label_apply_nops(me);
         vfree(me->arch.syminfo);
         me->arch.syminfo = NULL;
         return 0;
diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
index 26108232fcaa..dc488e13b7e3 100644
--- a/arch/s390/kernel/processor.c
+++ b/arch/s390/kernel/processor.c
@@ -18,7 +18,7 @@
 
 static DEFINE_PER_CPU(struct cpuid, cpu_id);
 
-void cpu_relax(void)
+void notrace cpu_relax(void)
 {
         if (!smp_cpu_mtid && MACHINE_HAS_DIAG44)
                 asm volatile("diag 0,0,0x44");
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index 329ec75e9214..fc7ec95848c3 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -77,7 +77,7 @@ static int __diag_page_ref_service(struct kvm_vcpu *vcpu)
 
         if (vcpu->run->s.regs.gprs[rx] & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-        rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], &parm, sizeof(parm));
+        rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], rx, &parm, sizeof(parm));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         if (parm.parm_version != 2 || parm.parm_len < 5 || parm.code != 0x258)
@@ -230,7 +230,7 @@ static int __diag_virtio_hypercall(struct kvm_vcpu *vcpu)
 
 int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
 {
-        int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+        int code = kvm_s390_get_base_disp_rs(vcpu, NULL) & 0xffff;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 267523cac6de..a7559f7207df 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -10,6 +10,7 @@
 #include <asm/pgtable.h>
 #include "kvm-s390.h"
 #include "gaccess.h"
+#include <asm/switch_to.h>
 
 union asce {
         unsigned long val;
@@ -207,6 +208,54 @@ union raddress {
         unsigned long pfra : 52; /* Page-Frame Real Address */
 };
 
+union alet {
+        u32 val;
+        struct {
+                u32 reserved : 7;
+                u32 p        : 1;
+                u32 alesn    : 8;
+                u32 alen     : 16;
+        };
+};
+
+union ald {
+        u32 val;
+        struct {
+                u32     : 1;
+                u32 alo : 24;
+                u32 all : 7;
+        };
+};
+
+struct ale {
+        unsigned long i      : 1; /* ALEN-Invalid Bit */
+        unsigned long        : 5;
+        unsigned long fo     : 1; /* Fetch-Only Bit */
+        unsigned long p      : 1; /* Private Bit */
+        unsigned long alesn  : 8; /* Access-List-Entry Sequence Number */
+        unsigned long aleax  : 16; /* Access-List-Entry Authorization Index */
+        unsigned long        : 32;
+        unsigned long        : 1;
+        unsigned long asteo  : 25; /* ASN-Second-Table-Entry Origin */
+        unsigned long        : 6;
+        unsigned long astesn : 32; /* ASTE Sequence Number */
+} __packed;
+
+struct aste {
+        unsigned long i      : 1; /* ASX-Invalid Bit */
+        unsigned long ato    : 29; /* Authority-Table Origin */
+        unsigned long        : 1;
+        unsigned long b      : 1; /* Base-Space Bit */
+        unsigned long ax     : 16; /* Authorization Index */
+        unsigned long atl    : 12; /* Authority-Table Length */
+        unsigned long        : 2;
+        unsigned long ca     : 1; /* Controlled-ASN Bit */
+        unsigned long ra     : 1; /* Reusable-ASN Bit */
+        unsigned long asce   : 64; /* Address-Space-Control Element */
+        unsigned long ald    : 32;
+        unsigned long astesn : 32;
+        /* .. more fields there */
+} __packed;
 
 int ipte_lock_held(struct kvm_vcpu *vcpu)
 {
@@ -307,15 +356,157 @@ void ipte_unlock(struct kvm_vcpu *vcpu)
                 ipte_unlock_simple(vcpu);
 }
 
-static unsigned long get_vcpu_asce(struct kvm_vcpu *vcpu)
+static int ar_translation(struct kvm_vcpu *vcpu, union asce *asce, ar_t ar,
+                          int write)
+{
+        union alet alet;
+        struct ale ale;
+        struct aste aste;
+        unsigned long ald_addr, authority_table_addr;
+        union ald ald;
+        int eax, rc;
+        u8 authority_table;
+
+        if (ar >= NUM_ACRS)
+                return -EINVAL;
+
+        save_access_regs(vcpu->run->s.regs.acrs);
+        alet.val = vcpu->run->s.regs.acrs[ar];
+
+        if (ar == 0 || alet.val == 0) {
+                asce->val = vcpu->arch.sie_block->gcr[1];
+                return 0;
+        } else if (alet.val == 1) {
+                asce->val = vcpu->arch.sie_block->gcr[7];
+                return 0;
+        }
+
+        if (alet.reserved)
+                return PGM_ALET_SPECIFICATION;
+
+        if (alet.p)
+                ald_addr = vcpu->arch.sie_block->gcr[5];
+        else
+                ald_addr = vcpu->arch.sie_block->gcr[2];
+        ald_addr &= 0x7fffffc0;
+
+        rc = read_guest_real(vcpu, ald_addr + 16, &ald.val, sizeof(union ald));
+        if (rc)
+                return rc;
+
+        if (alet.alen / 8 > ald.all)
+                return PGM_ALEN_TRANSLATION;
+
+        if (0x7fffffff - ald.alo * 128 < alet.alen * 16)
+                return PGM_ADDRESSING;
+
+        rc = read_guest_real(vcpu, ald.alo * 128 + alet.alen * 16, &ale,
+                             sizeof(struct ale));
+        if (rc)
+                return rc;
+
+        if (ale.i == 1)
+                return PGM_ALEN_TRANSLATION;
+        if (ale.alesn != alet.alesn)
+                return PGM_ALE_SEQUENCE;
+
+        rc = read_guest_real(vcpu, ale.asteo * 64, &aste, sizeof(struct aste));
+        if (rc)
+                return rc;
+
+        if (aste.i)
+                return PGM_ASTE_VALIDITY;
+        if (aste.astesn != ale.astesn)
+                return PGM_ASTE_SEQUENCE;
+
+        if (ale.p == 1) {
+                eax = (vcpu->arch.sie_block->gcr[8] >> 16) & 0xffff;
+                if (ale.aleax != eax) {
+                        if (eax / 16 > aste.atl)
+                                return PGM_EXTENDED_AUTHORITY;
+
+                        authority_table_addr = aste.ato * 4 + eax / 4;
+
+                        rc = read_guest_real(vcpu, authority_table_addr,
+                                             &authority_table,
+                                             sizeof(u8));
+                        if (rc)
+                                return rc;
+
+                        if ((authority_table & (0x40 >> ((eax & 3) * 2))) == 0)
+                                return PGM_EXTENDED_AUTHORITY;
+                }
+        }
+
+        if (ale.fo == 1 && write)
+                return PGM_PROTECTION;
+
+        asce->val = aste.asce;
+        return 0;
+}
+
+struct trans_exc_code_bits {
+        unsigned long addr : 52; /* Translation-exception Address */
+        unsigned long fsi  : 2;  /* Access Exception Fetch/Store Indication */
+        unsigned long      : 6;
+        unsigned long b60  : 1;
+        unsigned long b61  : 1;
+        unsigned long as   : 2;  /* ASCE Identifier */
+};
+
+enum {
+        FSI_UNKNOWN = 0, /* Unknown wether fetch or store */
+        FSI_STORE   = 1, /* Exception was due to store operation */
+        FSI_FETCH   = 2  /* Exception was due to fetch operation */
+};
+
+static int get_vcpu_asce(struct kvm_vcpu *vcpu, union asce *asce,
+                         ar_t ar, int write)
 {
+        int rc;
+        psw_t *psw = &vcpu->arch.sie_block->gpsw;
+        struct kvm_s390_pgm_info *pgm = &vcpu->arch.pgm;
+        struct trans_exc_code_bits *tec_bits;
+
+        memset(pgm, 0, sizeof(*pgm));
+        tec_bits = (struct trans_exc_code_bits *)&pgm->trans_exc_code;
+        tec_bits->fsi = write ? FSI_STORE : FSI_FETCH;
+        tec_bits->as = psw_bits(*psw).as;
+
+        if (!psw_bits(*psw).t) {
+                asce->val = 0;
+                asce->r = 1;
+                return 0;
+        }
+
         switch (psw_bits(vcpu->arch.sie_block->gpsw).as) {
         case PSW_AS_PRIMARY:
-                return vcpu->arch.sie_block->gcr[1];
+                asce->val = vcpu->arch.sie_block->gcr[1];
+                return 0;
         case PSW_AS_SECONDARY:
-                return vcpu->arch.sie_block->gcr[7];
+                asce->val = vcpu->arch.sie_block->gcr[7];
+                return 0;
         case PSW_AS_HOME:
-                return vcpu->arch.sie_block->gcr[13];
+                asce->val = vcpu->arch.sie_block->gcr[13];
+                return 0;
+        case PSW_AS_ACCREG:
+                rc = ar_translation(vcpu, asce, ar, write);
+                switch (rc) {
+                case PGM_ALEN_TRANSLATION:
+                case PGM_ALE_SEQUENCE:
+                case PGM_ASTE_VALIDITY:
+                case PGM_ASTE_SEQUENCE:
+                case PGM_EXTENDED_AUTHORITY:
+                        vcpu->arch.pgm.exc_access_id = ar;
+                        break;
+                case PGM_PROTECTION:
+                        tec_bits->b60 = 1;
+                        tec_bits->b61 = 1;
+                        break;
+                }
+                if (rc > 0)
+                        pgm->code = rc;
+                return rc;
         }
         return 0;
 }
@@ -330,10 +521,11 @@ static int deref_table(struct kvm *kvm, unsigned long gpa, unsigned long *val)
  * @vcpu: virtual cpu
  * @gva: guest virtual address
  * @gpa: points to where guest physical (absolute) address should be stored
+ * @asce: effective asce
  * @write: indicates if access is a write access
  *
  * Translate a guest virtual address into a guest absolute address by means
- * of dynamic address translation as specified by the architecuture.
+ * of dynamic address translation as specified by the architecture.
  * If the resulting absolute address is not available in the configuration
  * an addressing exception is indicated and @gpa will not be changed.
  *
@@ -345,7 +537,8 @@ static int deref_table(struct kvm *kvm, unsigned long gpa, unsigned long *val)
  *            by the architecture
  */
 static unsigned long guest_translate(struct kvm_vcpu *vcpu, unsigned long gva,
-                                     unsigned long *gpa, int write)
+                                     unsigned long *gpa, const union asce asce,
+                                     int write)
 {
         union vaddress vaddr = {.addr = gva};
         union raddress raddr = {.addr = gva};
@@ -354,12 +547,10 @@ static unsigned long guest_translate(struct kvm_vcpu *vcpu, unsigned long gva,
         union ctlreg0 ctlreg0;
         unsigned long ptr;
         int edat1, edat2;
-        union asce asce;
 
         ctlreg0.val = vcpu->arch.sie_block->gcr[0];
         edat1 = ctlreg0.edat && test_kvm_facility(vcpu->kvm, 8);
         edat2 = edat1 && test_kvm_facility(vcpu->kvm, 78);
-        asce.val = get_vcpu_asce(vcpu);
         if (asce.r)
                 goto real_address;
         ptr = asce.origin * 4096;
@@ -506,48 +697,30 @@ static inline int is_low_address(unsigned long ga)
         return (ga & ~0x11fful) == 0;
 }
 
-static int low_address_protection_enabled(struct kvm_vcpu *vcpu)
+static int low_address_protection_enabled(struct kvm_vcpu *vcpu,
+                                          const union asce asce)
 {
         union ctlreg0 ctlreg0 = {.val = vcpu->arch.sie_block->gcr[0]};
         psw_t *psw = &vcpu->arch.sie_block->gpsw;
-        union asce asce;
 
         if (!ctlreg0.lap)
                 return 0;
-        asce.val = get_vcpu_asce(vcpu);
         if (psw_bits(*psw).t && asce.p)
                 return 0;
         return 1;
 }
 
-struct trans_exc_code_bits {
-        unsigned long addr : 52; /* Translation-exception Address */
-        unsigned long fsi  : 2;  /* Access Exception Fetch/Store Indication */
-        unsigned long      : 7;
-        unsigned long b61  : 1;
-        unsigned long as   : 2;  /* ASCE Identifier */
-};
-
-enum {
-        FSI_UNKNOWN = 0, /* Unknown wether fetch or store */
-        FSI_STORE   = 1, /* Exception was due to store operation */
-        FSI_FETCH   = 2  /* Exception was due to fetch operation */
-};
-
 static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga,
                             unsigned long *pages, unsigned long nr_pages,
-                            int write)
+                            const union asce asce, int write)
 {
         struct kvm_s390_pgm_info *pgm = &vcpu->arch.pgm;
         psw_t *psw = &vcpu->arch.sie_block->gpsw;
         struct trans_exc_code_bits *tec_bits;
         int lap_enabled, rc;
 
-        memset(pgm, 0, sizeof(*pgm));
         tec_bits = (struct trans_exc_code_bits *)&pgm->trans_exc_code;
-        tec_bits->fsi = write ? FSI_STORE : FSI_FETCH;
-        tec_bits->as = psw_bits(*psw).as;
-        lap_enabled = low_address_protection_enabled(vcpu);
+        lap_enabled = low_address_protection_enabled(vcpu, asce);
         while (nr_pages) {
                 ga = kvm_s390_logical_to_effective(vcpu, ga);
                 tec_bits->addr = ga >> PAGE_SHIFT;
@@ -557,7 +730,7 @@ static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga,
                 }
                 ga &= PAGE_MASK;
                 if (psw_bits(*psw).t) {
-                        rc = guest_translate(vcpu, ga, pages, write);
+                        rc = guest_translate(vcpu, ga, pages, asce, write);
                         if (rc < 0)
                                 return rc;
                         if (rc == PGM_PROTECTION)
@@ -578,7 +751,7 @@ static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga,
         return 0;
 }
 
-int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
+int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, ar_t ar, void *data,
                  unsigned long len, int write)
 {
         psw_t *psw = &vcpu->arch.sie_block->gpsw;
@@ -591,20 +764,19 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
 
         if (!len)
                 return 0;
-        /* Access register mode is not supported yet. */
-        if (psw_bits(*psw).t && psw_bits(*psw).as == PSW_AS_ACCREG)
-                return -EOPNOTSUPP;
+        rc = get_vcpu_asce(vcpu, &asce, ar, write);
+        if (rc)
+                return rc;
         nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1;
         pages = pages_array;
         if (nr_pages > ARRAY_SIZE(pages_array))
                 pages = vmalloc(nr_pages * sizeof(unsigned long));
         if (!pages)
                 return -ENOMEM;
-        asce.val = get_vcpu_asce(vcpu);
         need_ipte_lock = psw_bits(*psw).t && !asce.r;
         if (need_ipte_lock)
                 ipte_lock(vcpu);
-        rc = guest_page_range(vcpu, ga, pages, nr_pages, write);
+        rc = guest_page_range(vcpu, ga, pages, nr_pages, asce, write);
         for (idx = 0; idx < nr_pages && !rc; idx++) {
                 gpa = *(pages + idx) + (ga & ~PAGE_MASK);
                 _len = min(PAGE_SIZE - (gpa & ~PAGE_MASK), len);
@@ -652,7 +824,7 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
  * Note: The IPTE lock is not taken during this function, so the caller
  * has to take care of this.
  */
-int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva,
+int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, ar_t ar,
                             unsigned long *gpa, int write)
 {
         struct kvm_s390_pgm_info *pgm = &vcpu->arch.pgm;
@@ -661,26 +833,21 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva,
         union asce asce;
         int rc;
 
-        /* Access register mode is not supported yet. */
-        if (psw_bits(*psw).t && psw_bits(*psw).as == PSW_AS_ACCREG)
-                return -EOPNOTSUPP;
-
         gva = kvm_s390_logical_to_effective(vcpu, gva);
-        memset(pgm, 0, sizeof(*pgm));
         tec = (struct trans_exc_code_bits *)&pgm->trans_exc_code;
-        tec->as = psw_bits(*psw).as;
-        tec->fsi = write ? FSI_STORE : FSI_FETCH;
+        rc = get_vcpu_asce(vcpu, &asce, ar, write);
         tec->addr = gva >> PAGE_SHIFT;
-        if (is_low_address(gva) && low_address_protection_enabled(vcpu)) {
+        if (rc)
+                return rc;
+        if (is_low_address(gva) && low_address_protection_enabled(vcpu, asce)) {
                 if (write) {
                         rc = pgm->code = PGM_PROTECTION;
                         return rc;
                 }
         }
 
-        asce.val = get_vcpu_asce(vcpu);
         if (psw_bits(*psw).t && !asce.r) {      /* Use DAT? */
-                rc = guest_translate(vcpu, gva, gpa, write);
+                rc = guest_translate(vcpu, gva, gpa, asce, write);
                 if (rc > 0) {
                         if (rc == PGM_PROTECTION)
                                 tec->b61 = 1;
@@ -697,28 +864,51 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva,
 }
 
 /**
- * kvm_s390_check_low_addr_protection - check for low-address protection
- * @ga: Guest address
+ * check_gva_range - test a range of guest virtual addresses for accessibility
+ */
+int check_gva_range(struct kvm_vcpu *vcpu, unsigned long gva, ar_t ar,
+                    unsigned long length, int is_write)
+{
+        unsigned long gpa;
+        unsigned long currlen;
+        int rc = 0;
+
+        ipte_lock(vcpu);
+        while (length > 0 && !rc) {
+                currlen = min(length, PAGE_SIZE - (gva % PAGE_SIZE));
+                rc = guest_translate_address(vcpu, gva, ar, &gpa, is_write);
+                gva += currlen;
+                length -= currlen;
+        }
+        ipte_unlock(vcpu);
+
+        return rc;
+}
+
+/**
+ * kvm_s390_check_low_addr_prot_real - check for low-address protection
+ * @gra: Guest real address
  *
  * Checks whether an address is subject to low-address protection and set
  * up vcpu->arch.pgm accordingly if necessary.
  *
  * Return: 0 if no protection exception, or PGM_PROTECTION if protected.
  */
-int kvm_s390_check_low_addr_protection(struct kvm_vcpu *vcpu, unsigned long ga)
+int kvm_s390_check_low_addr_prot_real(struct kvm_vcpu *vcpu, unsigned long gra)
 {
         struct kvm_s390_pgm_info *pgm = &vcpu->arch.pgm;
         psw_t *psw = &vcpu->arch.sie_block->gpsw;
         struct trans_exc_code_bits *tec_bits;
+        union ctlreg0 ctlreg0 = {.val = vcpu->arch.sie_block->gcr[0]};
 
-        if (!is_low_address(ga) || !low_address_protection_enabled(vcpu))
+        if (!ctlreg0.lap || !is_low_address(gra))
                 return 0;
 
         memset(pgm, 0, sizeof(*pgm));
         tec_bits = (struct trans_exc_code_bits *)&pgm->trans_exc_code;
         tec_bits->fsi = FSI_STORE;
         tec_bits->as = psw_bits(*psw).as;
-        tec_bits->addr = ga >> PAGE_SHIFT;
+        tec_bits->addr = gra >> PAGE_SHIFT;
         pgm->code = PGM_PROTECTION;
 
         return pgm->code;
diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index 0149cf15058a..ef03726cc661 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -156,9 +156,11 @@ int read_guest_lc(struct kvm_vcpu *vcpu, unsigned long gra, void *data,
 }
 
 int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva,
-                            unsigned long *gpa, int write);
+                            ar_t ar, unsigned long *gpa, int write);
+int check_gva_range(struct kvm_vcpu *vcpu, unsigned long gva, ar_t ar,
+                    unsigned long length, int is_write);
 
-int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
+int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, ar_t ar, void *data,
                  unsigned long len, int write);
 
 int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
@@ -168,6 +170,7 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
  * write_guest - copy data from kernel space to guest space
  * @vcpu: virtual cpu
  * @ga: guest address
+ * @ar: access register
  * @data: source address in kernel space
  * @len: number of bytes to copy
  *
@@ -176,8 +179,7 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
  * If DAT is off data will be copied to guest real or absolute memory.
  * If DAT is on data will be copied to the address space as specified by
  * the address space bits of the PSW:
- * Primary, secondory or home space (access register mode is currently not
- * implemented).
+ * Primary, secondary, home space or access register mode.
  * The addressing mode of the PSW is also inspected, so that address wrap
  * around is taken into account for 24-, 31- and 64-bit addressing mode,
  * if the to be copied data crosses page boundaries in guest address space.
@@ -210,16 +212,17 @@ int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra,
  *       if data has been changed in guest space in case of an exception.
  */
 static inline __must_check
-int write_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
+int write_guest(struct kvm_vcpu *vcpu, unsigned long ga, ar_t ar, void *data,
                 unsigned long len)
 {
-        return access_guest(vcpu, ga, data, len, 1);
+        return access_guest(vcpu, ga, ar, data, len, 1);
 }
 
 /**
  * read_guest - copy data from guest space to kernel space
  * @vcpu: virtual cpu
  * @ga: guest address
+ * @ar: access register
  * @data: destination address in kernel space
  * @len: number of bytes to copy
  *
@@ -229,10 +232,10 @@ int write_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
  * data will be copied from guest space to kernel space.
  */
 static inline __must_check
-int read_guest(struct kvm_vcpu *vcpu, unsigned long ga, void *data,
+int read_guest(struct kvm_vcpu *vcpu, unsigned long ga, ar_t ar, void *data,
                unsigned long len)
 {
-        return access_guest(vcpu, ga, data, len, 0);
+        return access_guest(vcpu, ga, ar, data, len, 0);
 }
 
 /**
@@ -330,6 +333,6 @@ int read_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, void *data,
 void ipte_lock(struct kvm_vcpu *vcpu);
 void ipte_unlock(struct kvm_vcpu *vcpu);
 int ipte_lock_held(struct kvm_vcpu *vcpu);
-int kvm_s390_check_low_addr_protection(struct kvm_vcpu *vcpu, unsigned long ga);
+int kvm_s390_check_low_addr_prot_real(struct kvm_vcpu *vcpu, unsigned long gra);
 
 #endif /* __KVM_S390_GACCESS_H */
diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
index 3e8d4092ce30..e97b3455d7e6 100644
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -191,8 +191,8 @@ static int __import_wp_info(struct kvm_vcpu *vcpu,
         if (!wp_info->old_data)
                 return -ENOMEM;
         /* try to backup the original value */
-        ret = read_guest(vcpu, wp_info->phys_addr, wp_info->old_data,
-                         wp_info->len);
+        ret = read_guest_abs(vcpu, wp_info->phys_addr, wp_info->old_data,
+                             wp_info->len);
         if (ret) {
                 kfree(wp_info->old_data);
                 wp_info->old_data = NULL;
@@ -362,8 +362,8 @@ static struct kvm_hw_wp_info_arch *any_wp_changed(struct kvm_vcpu *vcpu)
                         continue;
 
                 /* refetch the wp data and compare it to the old value */
-                if (!read_guest(vcpu, wp_info->phys_addr, temp,
-                                wp_info->len)) {
+                if (!read_guest_abs(vcpu, wp_info->phys_addr, temp,
+                                    wp_info->len)) {
                         if (memcmp(temp, wp_info->old_data, wp_info->len)) {
                                 kfree(temp);
                                 return wp_info;
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index bebd2157edd0..9e3779e3e496 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -165,6 +165,7 @@ static void __extract_prog_irq(struct kvm_vcpu *vcpu,
                 pgm_info->mon_class_nr = vcpu->arch.sie_block->mcn;
                 pgm_info->mon_code = vcpu->arch.sie_block->tecmc;
                 break;
+        case PGM_VECTOR_PROCESSING:
         case PGM_DATA:
                 pgm_info->data_exc_code = vcpu->arch.sie_block->dxc;
                 break;
@@ -319,7 +320,7 @@ static int handle_mvpg_pei(struct kvm_vcpu *vcpu)
 
         /* Make sure that the source is paged-in */
         rc = guest_translate_address(vcpu, vcpu->run->s.regs.gprs[reg2],
-                                     &srcaddr, 0);
+                                     reg2, &srcaddr, 0);
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         rc = kvm_arch_fault_in_page(vcpu, srcaddr, 0);
@@ -328,7 +329,7 @@ static int handle_mvpg_pei(struct kvm_vcpu *vcpu)
 
         /* Make sure that the destination is paged-in */
         rc = guest_translate_address(vcpu, vcpu->run->s.regs.gprs[reg1],
-                                     &dstaddr, 1);
+                                     reg1, &dstaddr, 1);
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         rc = kvm_arch_fault_in_page(vcpu, dstaddr, 1);
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 073b5f387d1d..2afec6006def 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1,7 +1,7 @@
 /*
  * handling kvm guest interrupts
  *
- * Copyright IBM Corp. 2008,2014
+ * Copyright IBM Corp. 2008, 2015
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License (version 2 only)
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/bitmap.h>
 #include <asm/asm-offsets.h>
+#include <asm/dis.h>
 #include <asm/uaccess.h>
 #include <asm/sclp.h>
 #include "kvm-s390.h"
@@ -265,8 +266,6 @@ static void __set_intercept_indicator(struct kvm_vcpu *vcpu,
 
 static u16 get_ilc(struct kvm_vcpu *vcpu)
 {
-        const unsigned short table[] = { 2, 4, 4, 6 };
-
         switch (vcpu->arch.sie_block->icptcode) {
         case ICPT_INST:
         case ICPT_INSTPROGI:
@@ -274,7 +273,7 @@ static u16 get_ilc(struct kvm_vcpu *vcpu)
         case ICPT_PARTEXEC:
         case ICPT_IOINST:
                 /* last instruction only stored for these icptcodes */
-                return table[vcpu->arch.sie_block->ipa >> 14];
+                return insn_length(vcpu->arch.sie_block->ipa >> 8);
         case ICPT_PROGI:
                 return vcpu->arch.sie_block->pgmilc;
         default:
@@ -352,6 +351,7 @@ static int __must_check __deliver_machine_check(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         struct kvm_s390_mchk_info mchk;
+        unsigned long adtl_status_addr;
         int rc;
 
         spin_lock(&li->lock);
@@ -372,6 +372,9 @@ static int __must_check __deliver_machine_check(struct kvm_vcpu *vcpu)
                                          mchk.cr14, mchk.mcic);
 
         rc  = kvm_s390_vcpu_store_status(vcpu, KVM_S390_STORE_STATUS_PREFIXED);
+        rc |= read_guest_lc(vcpu, __LC_VX_SAVE_AREA_ADDR,
+                            &adtl_status_addr, sizeof(unsigned long));
+        rc |= kvm_s390_vcpu_store_adtl_status(vcpu, adtl_status_addr);
         rc |= put_guest_lc(vcpu, mchk.mcic,
                            (u64 __user *) __LC_MCCK_CODE);
         rc |= put_guest_lc(vcpu, mchk.failing_storage_address,
@@ -484,7 +487,7 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         struct kvm_s390_pgm_info pgm_info;
-        int rc = 0;
+        int rc = 0, nullifying = false;
         u16 ilc = get_ilc(vcpu);
 
         spin_lock(&li->lock);
@@ -509,6 +512,8 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
         case PGM_LX_TRANSLATION:
         case PGM_PRIMARY_AUTHORITY:
         case PGM_SECONDARY_AUTHORITY:
+                nullifying = true;
+                /* fall through */
         case PGM_SPACE_SWITCH:
                 rc = put_guest_lc(vcpu, pgm_info.trans_exc_code,
                                   (u64 *)__LC_TRANS_EXC_CODE);
@@ -521,6 +526,7 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
         case PGM_EXTENDED_AUTHORITY:
                 rc = put_guest_lc(vcpu, pgm_info.exc_access_id,
                                   (u8 *)__LC_EXC_ACCESS_ID);
+                nullifying = true;
                 break;
         case PGM_ASCE_TYPE:
         case PGM_PAGE_TRANSLATION:
@@ -534,6 +540,7 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
                                    (u8 *)__LC_EXC_ACCESS_ID);
                 rc |= put_guest_lc(vcpu, pgm_info.op_access_id,
                                    (u8 *)__LC_OP_ACCESS_ID);
+                nullifying = true;
                 break;
         case PGM_MONITOR:
                 rc = put_guest_lc(vcpu, pgm_info.mon_class_nr,
@@ -541,6 +548,7 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
                 rc |= put_guest_lc(vcpu, pgm_info.mon_code,
                                    (u64 *)__LC_MON_CODE);
                 break;
+        case PGM_VECTOR_PROCESSING:
         case PGM_DATA:
                 rc = put_guest_lc(vcpu, pgm_info.data_exc_code,
                                   (u32 *)__LC_DATA_EXC_CODE);
@@ -551,6 +559,15 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
                 rc |= put_guest_lc(vcpu, pgm_info.exc_access_id,
                                    (u8 *)__LC_EXC_ACCESS_ID);
                 break;
+        case PGM_STACK_FULL:
+        case PGM_STACK_EMPTY:
+        case PGM_STACK_SPECIFICATION:
+        case PGM_STACK_TYPE:
+        case PGM_STACK_OPERATION:
+        case PGM_TRACE_TABEL:
+        case PGM_CRYPTO_OPERATION:
+                nullifying = true;
+                break;
         }
 
         if (pgm_info.code & PGM_PER) {
@@ -564,6 +581,9 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
                                    (u8 *) __LC_PER_ACCESS_ID);
         }
 
+        if (nullifying && vcpu->arch.sie_block->icptcode == ICPT_INST)
+                kvm_s390_rewind_psw(vcpu, ilc);
+
         rc |= put_guest_lc(vcpu, ilc, (u16 *) __LC_PGM_ILC);
         rc |= put_guest_lc(vcpu, pgm_info.code,
                            (u16 *)__LC_PGM_INT_CODE);
@@ -1332,10 +1352,10 @@ int kvm_s390_inject_vm(struct kvm *kvm,
         return rc;
 }
 
-void kvm_s390_reinject_io_int(struct kvm *kvm,
+int kvm_s390_reinject_io_int(struct kvm *kvm,
                               struct kvm_s390_interrupt_info *inti)
 {
-        __inject_vm(kvm, inti);
+        return __inject_vm(kvm, inti);
 }
 
 int s390int_to_s390irq(struct kvm_s390_interrupt *s390int,
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 0c3623927563..9072127bd51b 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -25,6 +25,7 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
+#include <linux/vmalloc.h>
 #include <asm/asm-offsets.h>
 #include <asm/lowcore.h>
 #include <asm/pgtable.h>
@@ -38,6 +39,8 @@
 #include "trace.h"
 #include "trace-s390.h"
 
+#define MEM_OP_MAX_SIZE 65536   /* Maximum transfer size for KVM_S390_MEM_OP */
+
 #define VCPU_STAT(x) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU
 
 struct kvm_stats_debugfs_item debugfs_entries[] = {
@@ -87,6 +90,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "instruction_sigp_stop", VCPU_STAT(instruction_sigp_stop) },
         { "instruction_sigp_stop_store_status", VCPU_STAT(instruction_sigp_stop_store_status) },
         { "instruction_sigp_store_status", VCPU_STAT(instruction_sigp_store_status) },
+        { "instruction_sigp_store_adtl_status", VCPU_STAT(instruction_sigp_store_adtl_status) },
         { "instruction_sigp_set_arch", VCPU_STAT(instruction_sigp_arch) },
         { "instruction_sigp_set_prefix", VCPU_STAT(instruction_sigp_prefix) },
         { "instruction_sigp_restart", VCPU_STAT(instruction_sigp_restart) },
@@ -173,8 +177,13 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_VM_ATTRIBUTES:
         case KVM_CAP_MP_STATE:
         case KVM_CAP_S390_USER_SIGP:
+        case KVM_CAP_S390_USER_STSI:
+        case KVM_CAP_S390_SKEYS:
                 r = 1;
                 break;
+        case KVM_CAP_S390_MEM_OP:
+                r = MEM_OP_MAX_SIZE;
+                break;
         case KVM_CAP_NR_VCPUS:
         case KVM_CAP_MAX_VCPUS:
                 r = KVM_MAX_VCPUS;
@@ -185,6 +194,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_S390_COW:
                 r = MACHINE_HAS_ESOP;
                 break;
+        case KVM_CAP_S390_VECTOR_REGISTERS:
+                r = MACHINE_HAS_VX;
+                break;
         default:
                 r = 0;
         }
@@ -265,6 +277,18 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 kvm->arch.user_sigp = 1;
                 r = 0;
                 break;
+        case KVM_CAP_S390_VECTOR_REGISTERS:
+                if (MACHINE_HAS_VX) {
+                        set_kvm_facility(kvm->arch.model.fac->mask, 129);
+                        set_kvm_facility(kvm->arch.model.fac->list, 129);
+                        r = 0;
+                } else
+                        r = -EINVAL;
+                break;
+        case KVM_CAP_S390_USER_STSI:
+                kvm->arch.user_stsi = 1;
+                r = 0;
+                break;
         default:
                 r = -EINVAL;
                 break;
@@ -522,7 +546,7 @@ static int kvm_s390_set_processor(struct kvm *kvm, struct kvm_device_attr *attr)
                 memcpy(&kvm->arch.model.cpu_id, &proc->cpuid,
                        sizeof(struct cpuid));
                 kvm->arch.model.ibc = proc->ibc;
-                memcpy(kvm->arch.model.fac->kvm, proc->fac_list,
+                memcpy(kvm->arch.model.fac->list, proc->fac_list,
                        S390_ARCH_FAC_LIST_SIZE_BYTE);
         } else
                 ret = -EFAULT;
@@ -556,7 +580,7 @@ static int kvm_s390_get_processor(struct kvm *kvm, struct kvm_device_attr *attr)
         }
         memcpy(&proc->cpuid, &kvm->arch.model.cpu_id, sizeof(struct cpuid));
         proc->ibc = kvm->arch.model.ibc;
-        memcpy(&proc->fac_list, kvm->arch.model.fac->kvm, S390_ARCH_FAC_LIST_SIZE_BYTE);
+        memcpy(&proc->fac_list, kvm->arch.model.fac->list, S390_ARCH_FAC_LIST_SIZE_BYTE);
         if (copy_to_user((void __user *)attr->addr, proc, sizeof(*proc)))
                 ret = -EFAULT;
         kfree(proc);
@@ -576,10 +600,10 @@ static int kvm_s390_get_machine(struct kvm *kvm, struct kvm_device_attr *attr)
         }
         get_cpu_id((struct cpuid *) &mach->cpuid);
         mach->ibc = sclp_get_ibc();
-        memcpy(&mach->fac_mask, kvm_s390_fac_list_mask,
-               kvm_s390_fac_list_mask_size() * sizeof(u64));
+        memcpy(&mach->fac_mask, kvm->arch.model.fac->mask,
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
         memcpy((unsigned long *)&mach->fac_list, S390_lowcore.stfle_fac_list,
-               S390_ARCH_FAC_LIST_SIZE_U64);
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
         if (copy_to_user((void __user *)attr->addr, mach, sizeof(*mach)))
                 ret = -EFAULT;
         kfree(mach);
@@ -709,6 +733,108 @@ static int kvm_s390_vm_has_attr(struct kvm *kvm, struct kvm_device_attr *attr)
         return ret;
 }
 
+static long kvm_s390_get_skeys(struct kvm *kvm, struct kvm_s390_skeys *args)
+{
+        uint8_t *keys;
+        uint64_t hva;
+        unsigned long curkey;
+        int i, r = 0;
+
+        if (args->flags != 0)
+                return -EINVAL;
+
+        /* Is this guest using storage keys? */
+        if (!mm_use_skey(current->mm))
+                return KVM_S390_GET_SKEYS_NONE;
+
+        /* Enforce sane limit on memory allocation */
+        if (args->count < 1 || args->count > KVM_S390_SKEYS_MAX)
+                return -EINVAL;
+
+        keys = kmalloc_array(args->count, sizeof(uint8_t),
+                             GFP_KERNEL | __GFP_NOWARN);
+        if (!keys)
+                keys = vmalloc(sizeof(uint8_t) * args->count);
+        if (!keys)
+                return -ENOMEM;
+
+        for (i = 0; i < args->count; i++) {
+                hva = gfn_to_hva(kvm, args->start_gfn + i);
+                if (kvm_is_error_hva(hva)) {
+                        r = -EFAULT;
+                        goto out;
+                }
+
+                curkey = get_guest_storage_key(current->mm, hva);
+                if (IS_ERR_VALUE(curkey)) {
+                        r = curkey;
+                        goto out;
+                }
+                keys[i] = curkey;
+        }
+
+        r = copy_to_user((uint8_t __user *)args->skeydata_addr, keys,
+                         sizeof(uint8_t) * args->count);
+        if (r)
+                r = -EFAULT;
+out:
+        kvfree(keys);
+        return r;
+}
+
+static long kvm_s390_set_skeys(struct kvm *kvm, struct kvm_s390_skeys *args)
+{
+        uint8_t *keys;
+        uint64_t hva;
+        int i, r = 0;
+
+        if (args->flags != 0)
+                return -EINVAL;
+
+        /* Enforce sane limit on memory allocation */
+        if (args->count < 1 || args->count > KVM_S390_SKEYS_MAX)
+                return -EINVAL;
+
+        keys = kmalloc_array(args->count, sizeof(uint8_t),
+                             GFP_KERNEL | __GFP_NOWARN);
+        if (!keys)
+                keys = vmalloc(sizeof(uint8_t) * args->count);
+        if (!keys)
+                return -ENOMEM;
+
+        r = copy_from_user(keys, (uint8_t __user *)args->skeydata_addr,
+                           sizeof(uint8_t) * args->count);
+        if (r) {
+                r = -EFAULT;
+                goto out;
+        }
+
+        /* Enable storage key handling for the guest */
+        s390_enable_skey();
+
+        for (i = 0; i < args->count; i++) {
+                hva = gfn_to_hva(kvm, args->start_gfn + i);
+                if (kvm_is_error_hva(hva)) {
+                        r = -EFAULT;
+                        goto out;
+                }
+
+                /* Lowest order bit is reserved */
+                if (keys[i] & 0x01) {
+                        r = -EINVAL;
+                        goto out;
+                }
+
+                r = set_guest_storage_key(current->mm, hva,
+                                          (unsigned long)keys[i], 0);
+                if (r)
+                        goto out;
+        }
+out:
+        kvfree(keys);
+        return r;
+}
+
 long kvm_arch_vm_ioctl(struct file *filp,
                        unsigned int ioctl, unsigned long arg)
 {
@@ -768,6 +894,26 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = kvm_s390_vm_has_attr(kvm, &attr);
                 break;
         }
+        case KVM_S390_GET_SKEYS: {
+                struct kvm_s390_skeys args;
+
+                r = -EFAULT;
+                if (copy_from_user(&args, argp,
+                                   sizeof(struct kvm_s390_skeys)))
+                        break;
+                r = kvm_s390_get_skeys(kvm, &args);
+                break;
+        }
+        case KVM_S390_SET_SKEYS: {
+                struct kvm_s390_skeys args;
+
+                r = -EFAULT;
+                if (copy_from_user(&args, argp,
+                                   sizeof(struct kvm_s390_skeys)))
+                        break;
+                r = kvm_s390_set_skeys(kvm, &args);
+                break;
+        }
         default:
                 r = -ENOTTY;
         }
@@ -778,15 +924,18 @@ long kvm_arch_vm_ioctl(struct file *filp,
 static int kvm_s390_query_ap_config(u8 *config)
 {
         u32 fcn_code = 0x04000000UL;
-        u32 cc;
+        u32 cc = 0;
 
+        memset(config, 0, 128);
         asm volatile(
                 "lgr 0,%1\n"
                 "lgr 2,%2\n"
                 ".long 0xb2af0000\n"            /* PQAP(QCI) */
-                "ipm %0\n"
+                "0: ipm %0\n"
                 "srl %0,28\n"
-                : "=r" (cc)
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                : "+r" (cc)
                 : "r" (fcn_code), "r" (config)
                 : "cc", "0", "2", "memory"
         );
@@ -839,9 +988,13 @@ static int kvm_s390_crypto_init(struct kvm *kvm)
 
         kvm_s390_set_crycb_format(kvm);
 
-        /* Disable AES/DEA protected key functions by default */
-        kvm->arch.crypto.aes_kw = 0;
-        kvm->arch.crypto.dea_kw = 0;
+        /* Enable AES/DEA protected key functions by default */
+        kvm->arch.crypto.aes_kw = 1;
+        kvm->arch.crypto.dea_kw = 1;
+        get_random_bytes(kvm->arch.crypto.crycb->aes_wrapping_key_mask,
+                         sizeof(kvm->arch.crypto.crycb->aes_wrapping_key_mask));
+        get_random_bytes(kvm->arch.crypto.crycb->dea_wrapping_key_mask,
+                         sizeof(kvm->arch.crypto.crycb->dea_wrapping_key_mask));
 
         return 0;
 }
@@ -881,50 +1034,39 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 
         kvm->arch.dbf = debug_register(debug_name, 8, 2, 8 * sizeof(long));
         if (!kvm->arch.dbf)
-                goto out_nodbf;
+                goto out_err;
 
         /*
          * The architectural maximum amount of facilities is 16 kbit. To store
          * this amount, 2 kbyte of memory is required. Thus we need a full
-         * page to hold the active copy (arch.model.fac->sie) and the current
-         * facilities set (arch.model.fac->kvm). Its address size has to be
+         * page to hold the guest facility list (arch.model.fac->list) and the
+         * facility mask (arch.model.fac->mask). Its address size has to be
          * 31 bits and word aligned.
          */
         kvm->arch.model.fac =
-                (struct s390_model_fac *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+                (struct kvm_s390_fac *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
         if (!kvm->arch.model.fac)
-                goto out_nofac;
-
-        memcpy(kvm->arch.model.fac->kvm, S390_lowcore.stfle_fac_list,
-               S390_ARCH_FAC_LIST_SIZE_U64);
-
-        /*
-         * If this KVM host runs *not* in a LPAR, relax the facility bits
-         * of the kvm facility mask by all missing facilities. This will allow
-         * to determine the right CPU model by means of the remaining facilities.
-         * Live guest migration must prohibit the migration of KVMs running in
-         * a LPAR to non LPAR hosts.
-         */
-        if (!MACHINE_IS_LPAR)
-                for (i = 0; i < kvm_s390_fac_list_mask_size(); i++)
-                        kvm_s390_fac_list_mask[i] &= kvm->arch.model.fac->kvm[i];
+                goto out_err;
 
-        /*
-         * Apply the kvm facility mask to limit the kvm supported/tolerated
-         * facility list.
-         */
+        /* Populate the facility mask initially. */
+        memcpy(kvm->arch.model.fac->mask, S390_lowcore.stfle_fac_list,
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
         for (i = 0; i < S390_ARCH_FAC_LIST_SIZE_U64; i++) {
                 if (i < kvm_s390_fac_list_mask_size())
-                        kvm->arch.model.fac->kvm[i] &= kvm_s390_fac_list_mask[i];
+                        kvm->arch.model.fac->mask[i] &= kvm_s390_fac_list_mask[i];
                 else
-                        kvm->arch.model.fac->kvm[i] = 0UL;
+                        kvm->arch.model.fac->mask[i] = 0UL;
         }
 
+        /* Populate the facility list initially. */
+        memcpy(kvm->arch.model.fac->list, kvm->arch.model.fac->mask,
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
+
         kvm_s390_get_cpu_id(&kvm->arch.model.cpu_id);
         kvm->arch.model.ibc = sclp_get_ibc() & 0x0fff;
 
         if (kvm_s390_crypto_init(kvm) < 0)
-                goto out_crypto;
+                goto out_err;
 
         spin_lock_init(&kvm->arch.float_int.lock);
         INIT_LIST_HEAD(&kvm->arch.float_int.list);
@@ -939,7 +1081,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         } else {
                 kvm->arch.gmap = gmap_alloc(current->mm, (1UL << 44) - 1);
                 if (!kvm->arch.gmap)
-                        goto out_nogmap;
+                        goto out_err;
                 kvm->arch.gmap->private = kvm;
                 kvm->arch.gmap->pfault_enabled = 0;
         }
@@ -951,15 +1093,11 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         spin_lock_init(&kvm->arch.start_stop_lock);
 
         return 0;
-out_nogmap:
+out_err:
         kfree(kvm->arch.crypto.crycb);
-out_crypto:
         free_page((unsigned long)kvm->arch.model.fac);
-out_nofac:
         debug_unregister(kvm->arch.dbf);
-out_nodbf:
         free_page((unsigned long)(kvm->arch.sca));
-out_err:
         return rc;
 }
 
@@ -1039,6 +1177,8 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
                                     KVM_SYNC_CRS |
                                     KVM_SYNC_ARCH0 |
                                     KVM_SYNC_PFAULT;
+        if (test_kvm_facility(vcpu->kvm, 129))
+                vcpu->run->kvm_valid_regs |= KVM_SYNC_VRS;
 
         if (kvm_is_ucontrol(vcpu->kvm))
                 return __kvm_ucontrol_vcpu_init(vcpu);
@@ -1049,10 +1189,18 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
 void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
         save_fp_ctl(&vcpu->arch.host_fpregs.fpc);
-        save_fp_regs(vcpu->arch.host_fpregs.fprs);
+        if (test_kvm_facility(vcpu->kvm, 129))
+                save_vx_regs((__vector128 *)&vcpu->arch.host_vregs->vrs);
+        else
+                save_fp_regs(vcpu->arch.host_fpregs.fprs);
         save_access_regs(vcpu->arch.host_acrs);
-        restore_fp_ctl(&vcpu->arch.guest_fpregs.fpc);
-        restore_fp_regs(vcpu->arch.guest_fpregs.fprs);
+        if (test_kvm_facility(vcpu->kvm, 129)) {
+                restore_fp_ctl(&vcpu->run->s.regs.fpc);
+                restore_vx_regs((__vector128 *)&vcpu->run->s.regs.vrs);
+        } else {
+                restore_fp_ctl(&vcpu->arch.guest_fpregs.fpc);
+                restore_fp_regs(vcpu->arch.guest_fpregs.fprs);
+        }
         restore_access_regs(vcpu->run->s.regs.acrs);
         gmap_enable(vcpu->arch.gmap);
         atomic_set_mask(CPUSTAT_RUNNING, &vcpu->arch.sie_block->cpuflags);
@@ -1062,11 +1210,19 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 {
         atomic_clear_mask(CPUSTAT_RUNNING, &vcpu->arch.sie_block->cpuflags);
         gmap_disable(vcpu->arch.gmap);
-        save_fp_ctl(&vcpu->arch.guest_fpregs.fpc);
-        save_fp_regs(vcpu->arch.guest_fpregs.fprs);
+        if (test_kvm_facility(vcpu->kvm, 129)) {
+                save_fp_ctl(&vcpu->run->s.regs.fpc);
+                save_vx_regs((__vector128 *)&vcpu->run->s.regs.vrs);
+        } else {
+                save_fp_ctl(&vcpu->arch.guest_fpregs.fpc);
+                save_fp_regs(vcpu->arch.guest_fpregs.fprs);
+        }
         save_access_regs(vcpu->run->s.regs.acrs);
         restore_fp_ctl(&vcpu->arch.host_fpregs.fpc);
-        restore_fp_regs(vcpu->arch.host_fpregs.fprs);
+        if (test_kvm_facility(vcpu->kvm, 129))
+                restore_vx_regs((__vector128 *)&vcpu->arch.host_vregs->vrs);
+        else
+                restore_fp_regs(vcpu->arch.host_fpregs.fprs);
         restore_access_regs(vcpu->arch.host_acrs);
 }
 
@@ -1134,6 +1290,15 @@ int kvm_s390_vcpu_setup_cmma(struct kvm_vcpu *vcpu)
         return 0;
 }
 
+static void kvm_s390_vcpu_setup_model(struct kvm_vcpu *vcpu)
+{
+        struct kvm_s390_cpu_model *model = &vcpu->kvm->arch.model;
+
+        vcpu->arch.cpu_id = model->cpu_id;
+        vcpu->arch.sie_block->ibc = model->ibc;
+        vcpu->arch.sie_block->fac = (int) (long) model->fac->list;
+}
+
 int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
 {
         int rc = 0;
@@ -1142,6 +1307,8 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
                                                     CPUSTAT_SM |
                                                     CPUSTAT_STOPPED |
                                                     CPUSTAT_GED);
+        kvm_s390_vcpu_setup_model(vcpu);
+
         vcpu->arch.sie_block->ecb   = 6;
         if (test_kvm_facility(vcpu->kvm, 50) && test_kvm_facility(vcpu->kvm, 73))
                 vcpu->arch.sie_block->ecb |= 0x10;
@@ -1152,8 +1319,11 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
                 vcpu->arch.sie_block->eca |= 1;
         if (sclp_has_sigpif())
                 vcpu->arch.sie_block->eca |= 0x10000000U;
-        vcpu->arch.sie_block->ictl |= ICTL_ISKE | ICTL_SSKE | ICTL_RRBE |
-                                      ICTL_TPROT;
+        if (test_kvm_facility(vcpu->kvm, 129)) {
+                vcpu->arch.sie_block->eca |= 0x00020000;
+                vcpu->arch.sie_block->ecd |= 0x20000000;
+        }
+        vcpu->arch.sie_block->ictl |= ICTL_ISKE | ICTL_SSKE | ICTL_RRBE;
 
         if (kvm_s390_cmma_enabled(vcpu->kvm)) {
                 rc = kvm_s390_vcpu_setup_cmma(vcpu);
@@ -1163,13 +1333,6 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
         hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup;
 
-        mutex_lock(&vcpu->kvm->lock);
-        vcpu->arch.cpu_id = vcpu->kvm->arch.model.cpu_id;
-        memcpy(vcpu->kvm->arch.model.fac->sie, vcpu->kvm->arch.model.fac->kvm,
-               S390_ARCH_FAC_LIST_SIZE_BYTE);
-        vcpu->arch.sie_block->ibc = vcpu->kvm->arch.model.ibc;
-        mutex_unlock(&vcpu->kvm->lock);
-
         kvm_s390_vcpu_crypto_setup(vcpu);
 
         return rc;
@@ -1197,6 +1360,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 
         vcpu->arch.sie_block = &sie_page->sie_block;
         vcpu->arch.sie_block->itdba = (unsigned long) &sie_page->itdb;
+        vcpu->arch.host_vregs = &sie_page->vregs;
 
         vcpu->arch.sie_block->icpua = id;
         if (!kvm_is_ucontrol(kvm)) {
@@ -1212,7 +1376,6 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
                 vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;
                 set_bit(63 - id, (unsigned long *) &kvm->arch.sca->mcn);
         }
-        vcpu->arch.sie_block->fac = (int) (long) kvm->arch.model.fac->sie;
 
         spin_lock_init(&vcpu->arch.local_int.lock);
         vcpu->arch.local_int.float_int = &kvm->arch.float_int;
@@ -1732,6 +1895,31 @@ static int vcpu_pre_run(struct kvm_vcpu *vcpu)
         return 0;
 }
 
+static int vcpu_post_run_fault_in_sie(struct kvm_vcpu *vcpu)
+{
+        psw_t *psw = &vcpu->arch.sie_block->gpsw;
+        u8 opcode;
+        int rc;
+
+        VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction");
+        trace_kvm_s390_sie_fault(vcpu);
+
+        /*
+         * We want to inject an addressing exception, which is defined as a
+         * suppressing or terminating exception. However, since we came here
+         * by a DAT access exception, the PSW still points to the faulting
+         * instruction since DAT exceptions are nullifying. So we've got
+         * to look up the current opcode to get the length of the instruction
+         * to be able to forward the PSW.
+         */
+        rc = read_guest(vcpu, psw->addr, 0, &opcode, 1);
+        if (rc)
+                return kvm_s390_inject_prog_cond(vcpu, rc);
+        psw->addr = __rewind_psw(*psw, -insn_length(opcode));
+
+        return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+}
+
 static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason)
 {
         int rc = -1;
@@ -1763,11 +1951,8 @@ static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason)
                 }
         }
 
-        if (rc == -1) {
-                VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction");
-                trace_kvm_s390_sie_fault(vcpu);
-                rc = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-        }
+        if (rc == -1)
+                rc = vcpu_post_run_fault_in_sie(vcpu);
 
         memcpy(&vcpu->run->s.regs.gprs[14], &vcpu->arch.sie_block->gg14, 16);
 
@@ -1983,6 +2168,35 @@ int kvm_s390_vcpu_store_status(struct kvm_vcpu *vcpu, unsigned long addr)
         return kvm_s390_store_status_unloaded(vcpu, addr);
 }
 
+/*
+ * store additional status at address
+ */
+int kvm_s390_store_adtl_status_unloaded(struct kvm_vcpu *vcpu,
+                                        unsigned long gpa)
+{
+        /* Only bits 0-53 are used for address formation */
+        if (!(gpa & ~0x3ff))
+                return 0;
+
+        return write_guest_abs(vcpu, gpa & ~0x3ff,
+                               (void *)&vcpu->run->s.regs.vrs, 512);
+}
+
+int kvm_s390_vcpu_store_adtl_status(struct kvm_vcpu *vcpu, unsigned long addr)
+{
+        if (!test_kvm_facility(vcpu->kvm, 129))
+                return 0;
+
+        /*
+         * The guest VXRS are in the host VXRs due to the lazy
+         * copying in vcpu load/put. Let's update our copies before we save
+         * it into the save area.
+         */
+        save_vx_regs((__vector128 *)&vcpu->run->s.regs.vrs);
+
+        return kvm_s390_store_adtl_status_unloaded(vcpu, addr);
+}
+
 static void __disable_ibs_on_vcpu(struct kvm_vcpu *vcpu)
 {
         kvm_check_request(KVM_REQ_ENABLE_IBS, vcpu);
@@ -2107,6 +2321,65 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
         return r;
 }
 
+static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu,
+                                  struct kvm_s390_mem_op *mop)
+{
+        void __user *uaddr = (void __user *)mop->buf;
+        void *tmpbuf = NULL;
+        int r, srcu_idx;
+        const u64 supported_flags = KVM_S390_MEMOP_F_INJECT_EXCEPTION
+                                    | KVM_S390_MEMOP_F_CHECK_ONLY;
+
+        if (mop->flags & ~supported_flags)
+                return -EINVAL;
+
+        if (mop->size > MEM_OP_MAX_SIZE)
+                return -E2BIG;
+
+        if (!(mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY)) {
+                tmpbuf = vmalloc(mop->size);
+                if (!tmpbuf)
+                        return -ENOMEM;
+        }
+
+        srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+
+        switch (mop->op) {
+        case KVM_S390_MEMOP_LOGICAL_READ:
+                if (mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY) {
+                        r = check_gva_range(vcpu, mop->gaddr, mop->ar, mop->size, false);
+                        break;
+                }
+                r = read_guest(vcpu, mop->gaddr, mop->ar, tmpbuf, mop->size);
+                if (r == 0) {
+                        if (copy_to_user(uaddr, tmpbuf, mop->size))
+                                r = -EFAULT;
+                }
+                break;
+        case KVM_S390_MEMOP_LOGICAL_WRITE:
+                if (mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY) {
+                        r = check_gva_range(vcpu, mop->gaddr, mop->ar, mop->size, true);
+                        break;
+                }
+                if (copy_from_user(tmpbuf, uaddr, mop->size)) {
+                        r = -EFAULT;
+                        break;
+                }
+                r = write_guest(vcpu, mop->gaddr, mop->ar, tmpbuf, mop->size);
+                break;
+        default:
+                r = -EINVAL;
+        }
+
+        srcu_read_unlock(&vcpu->kvm->srcu, srcu_idx);
+
+        if (r > 0 && (mop->flags & KVM_S390_MEMOP_F_INJECT_EXCEPTION) != 0)
+                kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
+
+        vfree(tmpbuf);
+        return r;
+}
+
 long kvm_arch_vcpu_ioctl(struct file *filp,
                          unsigned int ioctl, unsigned long arg)
 {
@@ -2206,6 +2479,15 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 r = kvm_vcpu_ioctl_enable_cap(vcpu, &cap);
                 break;
         }
+        case KVM_S390_MEM_OP: {
+                struct kvm_s390_mem_op mem_op;
+
+                if (copy_from_user(&mem_op, argp, sizeof(mem_op)) == 0)
+                        r = kvm_s390_guest_mem_op(vcpu, &mem_op);
+                else
+                        r = -EFAULT;
+                break;
+        }
         default:
                 r = -ENOTTY;
         }
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index 985c2114d7ef..c5aefef158e5 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -70,16 +70,22 @@ static inline void kvm_s390_set_prefix(struct kvm_vcpu *vcpu, u32 prefix)
         kvm_make_request(KVM_REQ_MMU_RELOAD, vcpu);
 }
 
-static inline u64 kvm_s390_get_base_disp_s(struct kvm_vcpu *vcpu)
+typedef u8 __bitwise ar_t;
+
+static inline u64 kvm_s390_get_base_disp_s(struct kvm_vcpu *vcpu, ar_t *ar)
 {
         u32 base2 = vcpu->arch.sie_block->ipb >> 28;
         u32 disp2 = ((vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16);
 
+        if (ar)
+                *ar = base2;
+
         return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2;
 }
 
 static inline void kvm_s390_get_base_disp_sse(struct kvm_vcpu *vcpu,
-                                              u64 *address1, u64 *address2)
+                                              u64 *address1, u64 *address2,
+                                              ar_t *ar_b1, ar_t *ar_b2)
 {
         u32 base1 = (vcpu->arch.sie_block->ipb & 0xf0000000) >> 28;
         u32 disp1 = (vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16;
@@ -88,6 +94,11 @@ static inline void kvm_s390_get_base_disp_sse(struct kvm_vcpu *vcpu,
 
         *address1 = (base1 ? vcpu->run->s.regs.gprs[base1] : 0) + disp1;
         *address2 = (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2;
+
+        if (ar_b1)
+                *ar_b1 = base1;
+        if (ar_b2)
+                *ar_b2 = base2;
 }
 
 static inline void kvm_s390_get_regs_rre(struct kvm_vcpu *vcpu, int *r1, int *r2)
@@ -98,7 +109,7 @@ static inline void kvm_s390_get_regs_rre(struct kvm_vcpu *vcpu, int *r1, int *r2
                 *r2 = (vcpu->arch.sie_block->ipb & 0x000f0000) >> 16;
 }
 
-static inline u64 kvm_s390_get_base_disp_rsy(struct kvm_vcpu *vcpu)
+static inline u64 kvm_s390_get_base_disp_rsy(struct kvm_vcpu *vcpu, ar_t *ar)
 {
         u32 base2 = vcpu->arch.sie_block->ipb >> 28;
         u32 disp2 = ((vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16) +
@@ -107,14 +118,20 @@ static inline u64 kvm_s390_get_base_disp_rsy(struct kvm_vcpu *vcpu)
         if (disp2 & 0x80000)
                 disp2+=0xfff00000;
 
+        if (ar)
+                *ar = base2;
+
         return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + (long)(int)disp2;
 }
 
-static inline u64 kvm_s390_get_base_disp_rs(struct kvm_vcpu *vcpu)
+static inline u64 kvm_s390_get_base_disp_rs(struct kvm_vcpu *vcpu, ar_t *ar)
 {
         u32 base2 = vcpu->arch.sie_block->ipb >> 28;
         u32 disp2 = ((vcpu->arch.sie_block->ipb & 0x0fff0000) >> 16);
 
+        if (ar)
+                *ar = base2;
+
         return (base2 ? vcpu->run->s.regs.gprs[base2] : 0) + disp2;
 }
 
@@ -125,10 +142,22 @@ static inline void kvm_s390_set_psw_cc(struct kvm_vcpu *vcpu, unsigned long cc)
         vcpu->arch.sie_block->gpsw.mask |= cc << 44;
 }
 
-/* test availability of facility in a kvm intance */
+/* test availability of facility in a kvm instance */
 static inline int test_kvm_facility(struct kvm *kvm, unsigned long nr)
 {
-        return __test_facility(nr, kvm->arch.model.fac->kvm);
+        return __test_facility(nr, kvm->arch.model.fac->mask) &&
+                __test_facility(nr, kvm->arch.model.fac->list);
+}
+
+static inline int set_kvm_facility(u64 *fac_list, unsigned long nr)
+{
+        unsigned char *ptr;
+
+        if (nr >= MAX_FACILITY_BIT)
+                return -EINVAL;
+        ptr = (unsigned char *) fac_list + (nr >> 3);
+        *ptr |= (0x80UL >> (nr & 7));
+        return 0;
 }
 
 /* are cpu states controlled by user space */
@@ -150,8 +179,8 @@ int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
 int __must_check kvm_s390_inject_program_int(struct kvm_vcpu *vcpu, u16 code);
 struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
                                                     u64 cr6, u64 schid);
-void kvm_s390_reinject_io_int(struct kvm *kvm,
-                              struct kvm_s390_interrupt_info *inti);
+int kvm_s390_reinject_io_int(struct kvm *kvm,
+                             struct kvm_s390_interrupt_info *inti);
 int kvm_s390_mask_adapter(struct kvm *kvm, unsigned int id, bool masked);
 
 /* implemented in intercept.c */
@@ -176,7 +205,10 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu);
 /* implemented in kvm-s390.c */
 long kvm_arch_fault_in_page(struct kvm_vcpu *vcpu, gpa_t gpa, int writable);
 int kvm_s390_store_status_unloaded(struct kvm_vcpu *vcpu, unsigned long addr);
+int kvm_s390_store_adtl_status_unloaded(struct kvm_vcpu *vcpu,
+                                        unsigned long addr);
 int kvm_s390_vcpu_store_status(struct kvm_vcpu *vcpu, unsigned long addr);
+int kvm_s390_vcpu_store_adtl_status(struct kvm_vcpu *vcpu, unsigned long addr);
 void kvm_s390_vcpu_start(struct kvm_vcpu *vcpu);
 void kvm_s390_vcpu_stop(struct kvm_vcpu *vcpu);
 void s390_vcpu_block(struct kvm_vcpu *vcpu);
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index bdd9b5b17e03..5e4658d20c77 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -36,15 +36,16 @@ static int handle_set_clock(struct kvm_vcpu *vcpu)
         struct kvm_vcpu *cpup;
         s64 hostclk, val;
         int i, rc;
+        ar_t ar;
         u64 op2;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        op2 = kvm_s390_get_base_disp_s(vcpu);
+        op2 = kvm_s390_get_base_disp_s(vcpu, &ar);
         if (op2 & 7)    /* Operand must be on a doubleword boundary */
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-        rc = read_guest(vcpu, op2, &val, sizeof(val));
+        rc = read_guest(vcpu, op2, ar, &val, sizeof(val));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
@@ -68,20 +69,21 @@ static int handle_set_prefix(struct kvm_vcpu *vcpu)
         u64 operand2;
         u32 address;
         int rc;
+        ar_t ar;
 
         vcpu->stat.instruction_spx++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        operand2 = kvm_s390_get_base_disp_s(vcpu);
+        operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 
         /* must be word boundary */
         if (operand2 & 3)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         /* get the value */
-        rc = read_guest(vcpu, operand2, &address, sizeof(address));
+        rc = read_guest(vcpu, operand2, ar, &address, sizeof(address));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
@@ -107,13 +109,14 @@ static int handle_store_prefix(struct kvm_vcpu *vcpu)
         u64 operand2;
         u32 address;
         int rc;
+        ar_t ar;
 
         vcpu->stat.instruction_stpx++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        operand2 = kvm_s390_get_base_disp_s(vcpu);
+        operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 
         /* must be word boundary */
         if (operand2 & 3)
@@ -122,7 +125,7 @@ static int handle_store_prefix(struct kvm_vcpu *vcpu)
         address = kvm_s390_get_prefix(vcpu);
 
         /* get the value */
-        rc = write_guest(vcpu, operand2, &address, sizeof(address));
+        rc = write_guest(vcpu, operand2, ar, &address, sizeof(address));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
@@ -136,18 +139,19 @@ static int handle_store_cpu_address(struct kvm_vcpu *vcpu)
         u16 vcpu_id = vcpu->vcpu_id;
         u64 ga;
         int rc;
+        ar_t ar;
 
         vcpu->stat.instruction_stap++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        ga = kvm_s390_get_base_disp_s(vcpu);
+        ga = kvm_s390_get_base_disp_s(vcpu, &ar);
 
         if (ga & 1)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
-        rc = write_guest(vcpu, ga, &vcpu_id, sizeof(vcpu_id));
+        rc = write_guest(vcpu, ga, ar, &vcpu_id, sizeof(vcpu_id));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
@@ -207,7 +211,7 @@ static int handle_test_block(struct kvm_vcpu *vcpu)
         kvm_s390_get_regs_rre(vcpu, NULL, &reg2);
         addr = vcpu->run->s.regs.gprs[reg2] & PAGE_MASK;
         addr = kvm_s390_logical_to_effective(vcpu, addr);
-        if (kvm_s390_check_low_addr_protection(vcpu, addr))
+        if (kvm_s390_check_low_addr_prot_real(vcpu, addr))
                 return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
         addr = kvm_s390_real_to_abs(vcpu, addr);
 
@@ -229,18 +233,20 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
         struct kvm_s390_interrupt_info *inti;
         unsigned long len;
         u32 tpi_data[3];
-        int cc, rc;
+        int rc;
         u64 addr;
+        ar_t ar;
 
-        rc = 0;
-        addr = kvm_s390_get_base_disp_s(vcpu);
+        addr = kvm_s390_get_base_disp_s(vcpu, &ar);
         if (addr & 3)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-        cc = 0;
+
         inti = kvm_s390_get_io_int(vcpu->kvm, vcpu->arch.sie_block->gcr[6], 0);
-        if (!inti)
-                goto no_interrupt;
-        cc = 1;
+        if (!inti) {
+                kvm_s390_set_psw_cc(vcpu, 0);
+                return 0;
+        }
+
         tpi_data[0] = inti->io.subchannel_id << 16 | inti->io.subchannel_nr;
         tpi_data[1] = inti->io.io_int_parm;
         tpi_data[2] = inti->io.io_int_word;
@@ -250,31 +256,39 @@ static int handle_tpi(struct kvm_vcpu *vcpu)
                  * provided area.
                  */
                 len = sizeof(tpi_data) - 4;
-                rc = write_guest(vcpu, addr, &tpi_data, len);
-                if (rc)
-                        return kvm_s390_inject_prog_cond(vcpu, rc);
+                rc = write_guest(vcpu, addr, ar, &tpi_data, len);
+                if (rc) {
+                        rc = kvm_s390_inject_prog_cond(vcpu, rc);
+                        goto reinject_interrupt;
+                }
         } else {
                 /*
                  * Store the three-word I/O interruption code into
                  * the appropriate lowcore area.
                  */
                 len = sizeof(tpi_data);
-                if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len))
+                if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len)) {
+                        /* failed writes to the low core are not recoverable */
                         rc = -EFAULT;
+                        goto reinject_interrupt;
+                }
         }
+
+        /* irq was successfully handed to the guest */
+        kfree(inti);
+        kvm_s390_set_psw_cc(vcpu, 1);
+        return 0;
+reinject_interrupt:
         /*
          * If we encounter a problem storing the interruption code, the
          * instruction is suppressed from the guest's view: reinject the
          * interrupt.
          */
-        if (!rc)
+        if (kvm_s390_reinject_io_int(vcpu->kvm, inti)) {
                 kfree(inti);
-        else
-                kvm_s390_reinject_io_int(vcpu->kvm, inti);
-no_interrupt:
-        /* Set condition code and we're done. */
-        if (!rc)
-                kvm_s390_set_psw_cc(vcpu, cc);
+                rc = -EFAULT;
+        }
+        /* don't set the cc, a pgm irq was injected or we drop to user space */
         return rc ? -EFAULT : 0;
 }
 
@@ -348,7 +362,7 @@ static int handle_stfl(struct kvm_vcpu *vcpu)
          * We need to shift the lower 32 facility bits (bit 0-31) from a u64
          * into a u32 memory representation. They will remain bits 0-31.
          */
-        fac = *vcpu->kvm->arch.model.fac->sie >> 32;
+        fac = *vcpu->kvm->arch.model.fac->list >> 32;
         rc = write_guest_lc(vcpu, offsetof(struct _lowcore, stfl_fac_list),
                             &fac, sizeof(fac));
         if (rc)
@@ -386,15 +400,16 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
         psw_compat_t new_psw;
         u64 addr;
         int rc;
+        ar_t ar;
 
         if (gpsw->mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        addr = kvm_s390_get_base_disp_s(vcpu);
+        addr = kvm_s390_get_base_disp_s(vcpu, &ar);
         if (addr & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
-        rc = read_guest(vcpu, addr, &new_psw, sizeof(new_psw));
+        rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         if (!(new_psw.mask & PSW32_MASK_BASE))
@@ -412,14 +427,15 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
         psw_t new_psw;
         u64 addr;
         int rc;
+        ar_t ar;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        addr = kvm_s390_get_base_disp_s(vcpu);
+        addr = kvm_s390_get_base_disp_s(vcpu, &ar);
         if (addr & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-        rc = read_guest(vcpu, addr, &new_psw, sizeof(new_psw));
+        rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         vcpu->arch.sie_block->gpsw = new_psw;
@@ -433,18 +449,19 @@ static int handle_stidp(struct kvm_vcpu *vcpu)
         u64 stidp_data = vcpu->arch.stidp_data;
         u64 operand2;
         int rc;
+        ar_t ar;
 
         vcpu->stat.instruction_stidp++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        operand2 = kvm_s390_get_base_disp_s(vcpu);
+        operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 
         if (operand2 & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
-        rc = write_guest(vcpu, operand2, &stidp_data, sizeof(stidp_data));
+        rc = write_guest(vcpu, operand2, ar, &stidp_data, sizeof(stidp_data));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
@@ -467,6 +484,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
         for (n = mem->count - 1; n > 0 ; n--)
                 memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
 
+        memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
         mem->vm[0].cpus_total = cpus;
         mem->vm[0].cpus_configured = cpus;
         mem->vm[0].cpus_standby = 0;
@@ -478,6 +496,17 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
         ASCEBC(mem->vm[0].cpi, 16);
 }
 
+static void insert_stsi_usr_data(struct kvm_vcpu *vcpu, u64 addr, ar_t ar,
+                                 u8 fc, u8 sel1, u16 sel2)
+{
+        vcpu->run->exit_reason = KVM_EXIT_S390_STSI;
+        vcpu->run->s390_stsi.addr = addr;
+        vcpu->run->s390_stsi.ar = ar;
+        vcpu->run->s390_stsi.fc = fc;
+        vcpu->run->s390_stsi.sel1 = sel1;
+        vcpu->run->s390_stsi.sel2 = sel2;
+}
+
 static int handle_stsi(struct kvm_vcpu *vcpu)
 {
         int fc = (vcpu->run->s.regs.gprs[0] & 0xf0000000) >> 28;
@@ -486,6 +515,7 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
         unsigned long mem = 0;
         u64 operand2;
         int rc = 0;
+        ar_t ar;
 
         vcpu->stat.instruction_stsi++;
         VCPU_EVENT(vcpu, 4, "stsi: fc: %x sel1: %x sel2: %x", fc, sel1, sel2);
@@ -508,7 +538,7 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
                 return 0;
         }
 
-        operand2 = kvm_s390_get_base_disp_s(vcpu);
+        operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 
         if (operand2 & 0xfff)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
@@ -532,16 +562,20 @@ static int handle_stsi(struct kvm_vcpu *vcpu)
                 break;
         }
 
-        rc = write_guest(vcpu, operand2, (void *)mem, PAGE_SIZE);
+        rc = write_guest(vcpu, operand2, ar, (void *)mem, PAGE_SIZE);
         if (rc) {
                 rc = kvm_s390_inject_prog_cond(vcpu, rc);
                 goto out;
         }
+        if (vcpu->kvm->arch.user_stsi) {
+                insert_stsi_usr_data(vcpu, operand2, ar, fc, sel1, sel2);
+                rc = -EREMOTE;
+        }
         trace_kvm_s390_handle_stsi(vcpu, fc, sel1, sel2, operand2);
         free_page(mem);
         kvm_s390_set_psw_cc(vcpu, 0);
         vcpu->run->s.regs.gprs[0] = 0;
-        return 0;
+        return rc;
 out_no_data:
         kvm_s390_set_psw_cc(vcpu, 3);
 out:
@@ -670,7 +704,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
         }
 
         if (vcpu->run->s.regs.gprs[reg1] & PFMF_CF) {
-                if (kvm_s390_check_low_addr_protection(vcpu, start))
+                if (kvm_s390_check_low_addr_prot_real(vcpu, start))
                         return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
         }
 
@@ -776,13 +810,14 @@ int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
         int reg, rc, nr_regs;
         u32 ctl_array[16];
         u64 ga;
+        ar_t ar;
 
         vcpu->stat.instruction_lctl++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        ga = kvm_s390_get_base_disp_rs(vcpu);
+        ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 
         if (ga & 3)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
@@ -791,7 +826,7 @@ int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
         trace_kvm_s390_handle_lctl(vcpu, 0, reg1, reg3, ga);
 
         nr_regs = ((reg3 - reg1) & 0xf) + 1;
-        rc = read_guest(vcpu, ga, ctl_array, nr_regs * sizeof(u32));
+        rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         reg = reg1;
@@ -814,13 +849,14 @@ int kvm_s390_handle_stctl(struct kvm_vcpu *vcpu)
         int reg, rc, nr_regs;
         u32 ctl_array[16];
         u64 ga;
+        ar_t ar;
 
         vcpu->stat.instruction_stctl++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        ga = kvm_s390_get_base_disp_rs(vcpu);
+        ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 
         if (ga & 3)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
@@ -836,7 +872,7 @@ int kvm_s390_handle_stctl(struct kvm_vcpu *vcpu)
                         break;
                 reg = (reg + 1) % 16;
         } while (1);
-        rc = write_guest(vcpu, ga, ctl_array, nr_regs * sizeof(u32));
+        rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 }
 
@@ -847,13 +883,14 @@ static int handle_lctlg(struct kvm_vcpu *vcpu)
         int reg, rc, nr_regs;
         u64 ctl_array[16];
         u64 ga;
+        ar_t ar;
 
         vcpu->stat.instruction_lctlg++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        ga = kvm_s390_get_base_disp_rsy(vcpu);
+        ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 
         if (ga & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
@@ -862,7 +899,7 @@ static int handle_lctlg(struct kvm_vcpu *vcpu)
         trace_kvm_s390_handle_lctl(vcpu, 1, reg1, reg3, ga);
 
         nr_regs = ((reg3 - reg1) & 0xf) + 1;
-        rc = read_guest(vcpu, ga, ctl_array, nr_regs * sizeof(u64));
+        rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
         reg = reg1;
@@ -884,13 +921,14 @@ static int handle_stctg(struct kvm_vcpu *vcpu)
         int reg, rc, nr_regs;
         u64 ctl_array[16];
         u64 ga;
+        ar_t ar;
 
         vcpu->stat.instruction_stctg++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        ga = kvm_s390_get_base_disp_rsy(vcpu);
+        ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 
         if (ga & 7)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
@@ -906,7 +944,7 @@ static int handle_stctg(struct kvm_vcpu *vcpu)
                         break;
                 reg = (reg + 1) % 16;
         } while (1);
-        rc = write_guest(vcpu, ga, ctl_array, nr_regs * sizeof(u64));
+        rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 }
 
@@ -931,13 +969,14 @@ static int handle_tprot(struct kvm_vcpu *vcpu)
         unsigned long hva, gpa;
         int ret = 0, cc = 0;
         bool writable;
+        ar_t ar;
 
         vcpu->stat.instruction_tprot++;
 
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        kvm_s390_get_base_disp_sse(vcpu, &address1, &address2);
+        kvm_s390_get_base_disp_sse(vcpu, &address1, &address2, &ar, NULL);
 
         /* we only handle the Linux memory detection case:
          * access key == 0
@@ -946,11 +985,11 @@ static int handle_tprot(struct kvm_vcpu *vcpu)
                 return -EOPNOTSUPP;
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_DAT)
                 ipte_lock(vcpu);
-        ret = guest_translate_address(vcpu, address1, &gpa, 1);
+        ret = guest_translate_address(vcpu, address1, ar, &gpa, 1);
         if (ret == PGM_PROTECTION) {
                 /* Write protected? Try again with read-only... */
                 cc = 1;
-                ret = guest_translate_address(vcpu, address1, &gpa, 0);
+                ret = guest_translate_address(vcpu, address1, ar, &gpa, 0);
         }
         if (ret) {
                 if (ret == PGM_ADDRESSING || ret == PGM_TRANSLATION_SPEC) {
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index 23b1e86b2122..72e58bd2bee7 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -393,6 +393,9 @@ static int handle_sigp_order_in_user_space(struct kvm_vcpu *vcpu, u8 order_code)
         case SIGP_STORE_STATUS_AT_ADDRESS:
                 vcpu->stat.instruction_sigp_store_status++;
                 break;
+        case SIGP_STORE_ADDITIONAL_STATUS:
+                vcpu->stat.instruction_sigp_store_adtl_status++;
+                break;
         case SIGP_SET_PREFIX:
                 vcpu->stat.instruction_sigp_prefix++;
                 break;
@@ -431,7 +434,7 @@ int kvm_s390_handle_sigp(struct kvm_vcpu *vcpu)
         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
-        order_code = kvm_s390_get_base_disp_rs(vcpu);
+        order_code = kvm_s390_get_base_disp_rs(vcpu, NULL);
         if (handle_sigp_order_in_user_space(vcpu, order_code))
                 return -EOPNOTSUPP;
 
@@ -473,7 +476,7 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu)
         int r3 = vcpu->arch.sie_block->ipa & 0x000f;
         u16 cpu_addr = vcpu->run->s.regs.gprs[r3];
         struct kvm_vcpu *dest_vcpu;
-        u8 order_code = kvm_s390_get_base_disp_rs(vcpu);
+        u8 order_code = kvm_s390_get_base_disp_rs(vcpu, NULL);
 
         trace_kvm_s390_handle_sigp_pei(vcpu, order_code, cpu_addr);
 
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 753a56731951..f0b85443e060 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -287,7 +287,7 @@ void __iomem *pci_iomap_range(struct pci_dev *pdev,
         addr = ZPCI_IOMAP_ADDR_BASE | ((u64) idx << 48);
         return (void __iomem *) addr + offset;
 }
-EXPORT_SYMBOL_GPL(pci_iomap_range);
+EXPORT_SYMBOL(pci_iomap_range);
 
 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
 {
@@ -309,7 +309,7 @@ void pci_iounmap(struct pci_dev *pdev, void __iomem *addr)
         }
         spin_unlock(&zpci_iomap_lock);
 }
-EXPORT_SYMBOL_GPL(pci_iounmap);
+EXPORT_SYMBOL(pci_iounmap);
 
 static int pci_read(struct pci_bus *bus, unsigned int devfn, int where,
                     int size, u32 *val)
@@ -483,9 +483,8 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
         airq_iv_free_bit(zpci_aisb_iv, zdev->aisb);
 }
 
-static void zpci_map_resources(struct zpci_dev *zdev)
+static void zpci_map_resources(struct pci_dev *pdev)
 {
-        struct pci_dev *pdev = zdev->pdev;
         resource_size_t len;
         int i;
 
@@ -499,9 +498,8 @@ static void zpci_map_resources(struct zpci_dev *zdev)
         }
 }
 
-static void zpci_unmap_resources(struct zpci_dev *zdev)
+static void zpci_unmap_resources(struct pci_dev *pdev)
 {
-        struct pci_dev *pdev = zdev->pdev;
         resource_size_t len;
         int i;
 
@@ -651,7 +649,7 @@ int pcibios_add_device(struct pci_dev *pdev)
 
         zdev->pdev = pdev;
         pdev->dev.groups = zpci_attr_groups;
-        zpci_map_resources(zdev);
+        zpci_map_resources(pdev);
 
         for (i = 0; i < PCI_BAR_COUNT; i++) {
                 res = &pdev->resource[i];
@@ -663,6 +661,11 @@ int pcibios_add_device(struct pci_dev *pdev)
         return 0;
 }
 
+void pcibios_release_device(struct pci_dev *pdev)
+{
+        zpci_unmap_resources(pdev);
+}
+
 int pcibios_enable_device(struct pci_dev *pdev, int mask)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
@@ -670,7 +673,6 @@ int pcibios_enable_device(struct pci_dev *pdev, int mask)
         zdev->pdev = pdev;
         zpci_debug_init_device(zdev);
         zpci_fmb_enable_device(zdev);
-        zpci_map_resources(zdev);
 
         return pci_enable_resources(pdev, mask);
 }
@@ -679,7 +681,6 @@ void pcibios_disable_device(struct pci_dev *pdev)
 {
         struct zpci_dev *zdev = get_zdev(pdev);
 
-        zpci_unmap_resources(zdev);
         zpci_fmb_disable_device(zdev);
         zpci_debug_exit_device(zdev);
         zdev->pdev = NULL;
@@ -688,7 +689,8 @@ void pcibios_disable_device(struct pci_dev *pdev)
 #ifdef CONFIG_HIBERNATE_CALLBACKS
 static int zpci_restore(struct device *dev)
 {
-        struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct zpci_dev *zdev = get_zdev(pdev);
         int ret = 0;
 
         if (zdev->state != ZPCI_FN_STATE_ONLINE)
@@ -698,7 +700,7 @@ static int zpci_restore(struct device *dev)
         if (ret)
                 goto out;
 
-        zpci_map_resources(zdev);
+        zpci_map_resources(pdev);
         zpci_register_ioat(zdev, 0, zdev->start_dma + PAGE_OFFSET,
                            zdev->start_dma + zdev->iommu_size - 1,
                            (u64) zdev->dma_table);
@@ -709,12 +711,14 @@ out:
 
 static int zpci_freeze(struct device *dev)
 {
-        struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct zpci_dev *zdev = get_zdev(pdev);
 
         if (zdev->state != ZPCI_FN_STATE_ONLINE)
                 return 0;
 
         zpci_unregister_ioat(zdev, 0);
+        zpci_unmap_resources(pdev);
         return clp_disable_fh(zdev);
 }
 
diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index 8aa271b3d1ad..b1bb2b72302c 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
         if (copy_from_user(buf, user_buffer, length))
                 goto out;
 
-        memcpy_toio(io_addr, buf, length);
-        ret = 0;
+        ret = zpci_memcpy_toio(io_addr, buf, length);
 out:
         if (buf != local_buf)
                 kfree(buf);
@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
                 goto out;
         io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
 
-        ret = -EFAULT;
-        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
+                ret = -EFAULT;
                 goto out;
-
-        memcpy_fromio(buf, io_addr, length);
-
-        if (copy_to_user(user_buffer, buf, length))
+        }
+        ret = zpci_memcpy_fromio(buf, io_addr, length);
+        if (ret)
                 goto out;
+        if (copy_to_user(user_buffer, buf, length))
+                ret = -EFAULT;
 
-        ret = 0;
 out:
         if (buf != local_buf)
                 kfree(buf);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c2fb8a87dccb..b7d31ca55187 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -499,6 +499,7 @@ config X86_INTEL_QUARK
         depends on X86_IO_APIC
         select IOSF_MBI
         select INTEL_IMR
+        select COMMON_CLK
         ---help---
           Select to include support for Quark X1000 SoC.
           Say Y here if you have a Quark based system such as the Arduino
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index a236e39cc385..30b28dc76411 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -81,11 +81,6 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
                 (base_gfn >> KVM_HPAGE_GFN_SHIFT(level));
 }
 
-#define SELECTOR_TI_MASK (1 << 2)
-#define SELECTOR_RPL_MASK 0x03
-
-#define IOPL_SHIFT 12
-
 #define KVM_PERMILLE_MMU_PAGES 20
 #define KVM_MIN_ALLOC_MMU_PAGES 64
 #define KVM_MMU_HASH_SHIFT 10
@@ -933,6 +928,7 @@ struct x86_emulate_ctxt;
 int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size, unsigned short port);
 void kvm_emulate_cpuid(struct kvm_vcpu *vcpu);
 int kvm_emulate_halt(struct kvm_vcpu *vcpu);
+int kvm_vcpu_halt(struct kvm_vcpu *vcpu);
 int kvm_emulate_wbinvd(struct kvm_vcpu *vcpu);
 
 void kvm_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index e62cf897f781..c1adf33fdd0d 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -115,7 +115,7 @@ static inline void kvm_spinlock_init(void)
 
 static inline bool kvm_para_available(void)
 {
-        return 0;
+        return false;
 }
 
 static inline unsigned int kvm_arch_para_features(void)
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index d6b078e9fa28..25b1cc07d496 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -95,6 +95,7 @@ unsigned __pvclock_read_cycles(const struct pvclock_vcpu_time_info *src,
 
 struct pvclock_vsyscall_time_info {
         struct pvclock_vcpu_time_info pvti;
+        u32 migrate_count;
 } __attribute__((__aligned__(SMP_CACHE_BYTES)));
 
 #define PVTI_SIZE sizeof(struct pvclock_vsyscall_time_info)
diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
index 5fa9770035dc..c9a6d68b8d62 100644
--- a/arch/x86/include/asm/xsave.h
+++ b/arch/x86/include/asm/xsave.h
@@ -82,18 +82,15 @@ static inline int xsave_state_booting(struct xsave_struct *fx, u64 mask)
         if (boot_cpu_has(X86_FEATURE_XSAVES))
                 asm volatile("1:"XSAVES"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
         else
                 asm volatile("1:"XSAVE"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
-
-        asm volatile(xstate_fault
-                     : "0" (0)
-                     : "memory");
-
         return err;
 }
 
@@ -112,18 +109,15 @@ static inline int xrstor_state_booting(struct xsave_struct *fx, u64 mask)
         if (boot_cpu_has(X86_FEATURE_XSAVES))
                 asm volatile("1:"XRSTORS"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
         else
                 asm volatile("1:"XRSTOR"\n\t"
                         "2:\n\t"
-                        : : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
+                             xstate_fault
+                        : "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                         :   "memory");
-
-        asm volatile(xstate_fault
-                     : "0" (0)
-                     : "memory");
-
         return err;
 }
 
@@ -149,9 +143,9 @@ static inline int xsave_state(struct xsave_struct *fx, u64 mask)
          */
         alternative_input_2(
                 "1:"XSAVE,
-                "1:"XSAVEOPT,
+                XSAVEOPT,
                 X86_FEATURE_XSAVEOPT,
-                "1:"XSAVES,
+                XSAVES,
                 X86_FEATURE_XSAVES,
                 [fx] "D" (fx), "a" (lmask), "d" (hmask) :
                 "memory");
@@ -178,7 +172,7 @@ static inline int xrstor_state(struct xsave_struct *fx, u64 mask)
          */
         alternative_input(
                 "1: " XRSTOR,
-                "1: " XRSTORS,
+                XRSTORS,
                 X86_FEATURE_XSAVES,
                 "D" (fx), "m" (*fx), "a" (lmask), "d" (hmask)
                 : "memory");
diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h
index c5f1a1deb91a..1fe92181ee9e 100644
--- a/arch/x86/include/uapi/asm/vmx.h
+++ b/arch/x86/include/uapi/asm/vmx.h
@@ -67,6 +67,7 @@
 #define EXIT_REASON_EPT_VIOLATION       48
 #define EXIT_REASON_EPT_MISCONFIG       49
 #define EXIT_REASON_INVEPT              50
+#define EXIT_REASON_RDTSCP              51
 #define EXIT_REASON_PREEMPTION_TIMER    52
 #define EXIT_REASON_INVVPID             53
 #define EXIT_REASON_WBINVD              54
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b5c8ff5e9dfc..2346c95c6ab1 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1396,6 +1396,12 @@ void cpu_init(void)
 
         wait_for_master_cpu(cpu);
 
+        /*
+         * Initialize the CR4 shadow before doing anything that could
+         * try to read it.
+         */
+        cr4_init_shadow();
+
         show_ucode_info_early();
 
         printk(KERN_INFO "Initializing CPU#%d\n", cpu);
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 94d7dcb12145..50163fa9034f 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -565,8 +565,8 @@ static const struct _tlb_table intel_tlb_table[] = {
         { 0xb2, TLB_INST_4K,            64,     " TLB_INST 4KByte pages, 4-way set associative" },
         { 0xb3, TLB_DATA_4K,            128,    " TLB_DATA 4 KByte pages, 4-way set associative" },
         { 0xb4, TLB_DATA_4K,            256,    " TLB_DATA 4 KByte pages, 4-way associative" },
-        { 0xb5, TLB_INST_4K,            64,     " TLB_INST 4 KByte pages, 8-way set ssociative" },
-        { 0xb6, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 8-way set ssociative" },
+        { 0xb5, TLB_INST_4K,            64,     " TLB_INST 4 KByte pages, 8-way set associative" },
+        { 0xb6, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 8-way set associative" },
         { 0xba, TLB_DATA_4K,            64,     " TLB_DATA 4 KByte pages, 4-way associative" },
         { 0xc0, TLB_DATA_4K_4M,         8,      " TLB_DATA 4 KByte and 4 MByte pages, 4-way associative" },
         { 0xc1, STLB_4K_2M,             1024,   " STLB 4 KByte and 2 MByte pages, 8-way associative" },
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 000d4199b03e..31e2d5bf3e38 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -982,6 +982,9 @@ ENTRY(xen_hypervisor_callback)
 ENTRY(xen_do_upcall)
 1:      mov %esp, %eax
         call xen_evtchn_do_upcall
+#ifndef CONFIG_PREEMPT
+        call xen_maybe_preempt_hcall
+#endif
         jmp  ret_from_intr
         CFI_ENDPROC
 ENDPROC(xen_hypervisor_callback)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index db13655c3a2a..1d74d161687c 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -269,11 +269,14 @@ ENTRY(ret_from_fork)
         testl $3, CS-ARGOFFSET(%rsp)            # from kernel_thread?
         jz   1f
 
-        testl $_TIF_IA32, TI_flags(%rcx)        # 32-bit compat task needs IRET
-        jnz  int_ret_from_sys_call
-
-        RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
-        jmp ret_from_sys_call                   # go to the SYSRET fastpath
+        /*
+         * By the time we get here, we have no idea whether our pt_regs,
+         * ti flags, and ti status came from the 64-bit SYSCALL fast path,
+         * the slow path, or one of the ia32entry paths.
+         * Use int_ret_from_sys_call to return, since it can safely handle
+         * all of the above.
+         */
+        jmp  int_ret_from_sys_call
 
 1:
         subq $REST_SKIP, %rsp   # leave space for volatiles
@@ -1208,6 +1211,9 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
         popq %rsp
         CFI_DEF_CFA_REGISTER rsp
         decl PER_CPU_VAR(irq_count)
+#ifndef CONFIG_PREEMPT
+        call xen_maybe_preempt_hcall
+#endif
         jmp  error_exit
         CFI_ENDPROC
 END(xen_do_hypervisor_callback)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 6a1146ea4d4d..4e3d5a9621fe 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -223,27 +223,48 @@ static unsigned long
 __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
 {
         struct kprobe *kp;
+        unsigned long faddr;
 
         kp = get_kprobe((void *)addr);
-        /* There is no probe, return original address */
-        if (!kp)
+        faddr = ftrace_location(addr);
+        /*
+         * Addresses inside the ftrace location are refused by
+         * arch_check_ftrace_location(). Something went terribly wrong
+         * if such an address is checked here.
+         */
+        if (WARN_ON(faddr && faddr != addr))
+                return 0UL;
+        /*
+         * Use the current code if it is not modified by Kprobe
+         * and it cannot be modified by ftrace.
+         */
+        if (!kp && !faddr)
                 return addr;
 
         /*
-         *  Basically, kp->ainsn.insn has an original instruction.
-         *  However, RIP-relative instruction can not do single-stepping
-         *  at different place, __copy_instruction() tweaks the displacement of
-         *  that instruction. In that case, we can't recover the instruction
-         *  from the kp->ainsn.insn.
+         * Basically, kp->ainsn.insn has an original instruction.
+         * However, RIP-relative instruction can not do single-stepping
+         * at different place, __copy_instruction() tweaks the displacement of
+         * that instruction. In that case, we can't recover the instruction
+         * from the kp->ainsn.insn.
          *
-         *  On the other hand, kp->opcode has a copy of the first byte of
-         *  the probed instruction, which is overwritten by int3. And
-         *  the instruction at kp->addr is not modified by kprobes except
-         *  for the first byte, we can recover the original instruction
-         *  from it and kp->opcode.
+         * On the other hand, in case on normal Kprobe, kp->opcode has a copy
+         * of the first byte of the probed instruction, which is overwritten
+         * by int3. And the instruction at kp->addr is not modified by kprobes
+         * except for the first byte, we can recover the original instruction
+         * from it and kp->opcode.
+         *
+         * In case of Kprobes using ftrace, we do not have a copy of
+         * the original instruction. In fact, the ftrace location might
+         * be modified at anytime and even could be in an inconsistent state.
+         * Fortunately, we know that the original code is the ideal 5-byte
+         * long NOP.
          */
-        memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-        buf[0] = kp->opcode;
+        memcpy(buf, (void *)addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+        if (faddr)
+                memcpy(buf, ideal_nops[NOP_ATOMIC5], 5);
+        else
+                buf[0] = kp->opcode;
         return (unsigned long)buf;
 }
 
@@ -251,6 +272,7 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
  * Recover the probed instruction at addr for further analysis.
  * Caller must lock kprobes by kprobe_mutex, or disable preemption
  * for preventing to release referencing kprobes.
+ * Returns zero if the instruction can not get recovered.
  */
 unsigned long recover_probed_instruction(kprobe_opcode_t *buf, unsigned long addr)
 {
@@ -285,6 +307,8 @@ static int can_probe(unsigned long paddr)
                  * normally used, we just go through if there is no kprobe.
                  */
                 __addr = recover_probed_instruction(buf, addr);
+                if (!__addr)
+                        return 0;
                 kernel_insn_init(&insn, (void *)__addr, MAX_INSN_SIZE);
                 insn_get_length(&insn);
 
@@ -333,6 +357,8 @@ int __copy_instruction(u8 *dest, u8 *src)
         unsigned long recovered_insn =
                 recover_probed_instruction(buf, (unsigned long)src);
 
+        if (!recovered_insn)
+                return 0;
         kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
         insn_get_length(&insn);
         /* Another subsystem puts a breakpoint, failed to recover */
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 0dd8d089c315..7b3b9d15c47a 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -259,6 +259,8 @@ static int can_optimize(unsigned long paddr)
                          */
                         return 0;
                 recovered_insn = recover_probed_instruction(buf, addr);
+                if (!recovered_insn)
+                        return 0;
                 kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
                 insn_get_length(&insn);
                 /* Another subsystem puts a breakpoint */
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 2f355d229a58..e5ecd20e72dd 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -141,7 +141,46 @@ void pvclock_read_wallclock(struct pvclock_wall_clock *wall_clock,
         set_normalized_timespec(ts, now.tv_sec, now.tv_nsec);
 }
 
+static struct pvclock_vsyscall_time_info *pvclock_vdso_info;
+
+static struct pvclock_vsyscall_time_info *
+pvclock_get_vsyscall_user_time_info(int cpu)
+{
+        if (!pvclock_vdso_info) {
+                BUG();
+                return NULL;
+        }
+
+        return &pvclock_vdso_info[cpu];
+}
+
+struct pvclock_vcpu_time_info *pvclock_get_vsyscall_time_info(int cpu)
+{
+        return &pvclock_get_vsyscall_user_time_info(cpu)->pvti;
+}
+
 #ifdef CONFIG_X86_64
+static int pvclock_task_migrate(struct notifier_block *nb, unsigned long l,
+                                void *v)
+{
+        struct task_migration_notifier *mn = v;
+        struct pvclock_vsyscall_time_info *pvti;
+
+        pvti = pvclock_get_vsyscall_user_time_info(mn->from_cpu);
+
+        /* this is NULL when pvclock vsyscall is not initialized */
+        if (unlikely(pvti == NULL))
+                return NOTIFY_DONE;
+
+        pvti->migrate_count++;
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block pvclock_migrate = {
+        .notifier_call = pvclock_task_migrate,
+};
+
 /*
  * Initialize the generic pvclock vsyscall state.  This will allocate
  * a/some page(s) for the per-vcpu pvclock information, set up a
@@ -155,12 +194,17 @@ int __init pvclock_init_vsyscall(struct pvclock_vsyscall_time_info *i,
 
         WARN_ON (size != PVCLOCK_VSYSCALL_NR_PAGES*PAGE_SIZE);
 
+        pvclock_vdso_info = i;
+
         for (idx = 0; idx <= (PVCLOCK_FIXMAP_END-PVCLOCK_FIXMAP_BEGIN); idx++) {
                 __set_fixmap(PVCLOCK_FIXMAP_BEGIN + idx,
                              __pa(i) + (idx*PAGE_SIZE),
                              PAGE_KERNEL_VVAR);
         }
 
+
+        register_task_migration_notifier(&pvclock_migrate);
+
         return 0;
 }
 #endif
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 4452eedfaedd..26228466f3f8 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -26,7 +26,7 @@ static inline bool guest_cpuid_has_xsave(struct kvm_vcpu *vcpu)
         struct kvm_cpuid_entry2 *best;
 
         if (!static_cpu_has(X86_FEATURE_XSAVE))
-                return 0;
+                return false;
 
         best = kvm_find_cpuid_entry(vcpu, 1, 0);
         return best && (best->ecx & bit(X86_FEATURE_XSAVE));
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 106c01557f2b..b304728aabe3 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -248,27 +248,7 @@ struct mode_dual {
         struct opcode mode64;
 };
 
-/* EFLAGS bit definitions. */
-#define EFLG_ID (1<<21)
-#define EFLG_VIP (1<<20)
-#define EFLG_VIF (1<<19)
-#define EFLG_AC (1<<18)
-#define EFLG_VM (1<<17)
-#define EFLG_RF (1<<16)
-#define EFLG_IOPL (3<<12)
-#define EFLG_NT (1<<14)
-#define EFLG_OF (1<<11)
-#define EFLG_DF (1<<10)
-#define EFLG_IF (1<<9)
-#define EFLG_TF (1<<8)
-#define EFLG_SF (1<<7)
-#define EFLG_ZF (1<<6)
-#define EFLG_AF (1<<4)
-#define EFLG_PF (1<<2)
-#define EFLG_CF (1<<0)
-
 #define EFLG_RESERVED_ZEROS_MASK 0xffc0802a
-#define EFLG_RESERVED_ONE_MASK 2
 
 enum x86_transfer_type {
         X86_TRANSFER_NONE,
@@ -317,7 +297,8 @@ static void invalidate_registers(struct x86_emulate_ctxt *ctxt)
  * These EFLAGS bits are restored from saved value during emulation, and
  * any changes are written back to the saved value after emulation.
  */
-#define EFLAGS_MASK (EFLG_OF|EFLG_SF|EFLG_ZF|EFLG_AF|EFLG_PF|EFLG_CF)
+#define EFLAGS_MASK (X86_EFLAGS_OF|X86_EFLAGS_SF|X86_EFLAGS_ZF|X86_EFLAGS_AF|\
+                     X86_EFLAGS_PF|X86_EFLAGS_CF)
 
 #ifdef CONFIG_X86_64
 #define ON64(x) x
@@ -478,6 +459,25 @@ static void assign_masked(ulong *dest, ulong src, ulong mask)
         *dest = (*dest & ~mask) | (src & mask);
 }
 
+static void assign_register(unsigned long *reg, u64 val, int bytes)
+{
+        /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
+        switch (bytes) {
+        case 1:
+                *(u8 *)reg = (u8)val;
+                break;
+        case 2:
+                *(u16 *)reg = (u16)val;
+                break;
+        case 4:
+                *reg = (u32)val;
+                break;  /* 64b: zero-extend */
+        case 8:
+                *reg = val;
+                break;
+        }
+}
+
 static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
 {
         return (1UL << (ctxt->ad_bytes << 3)) - 1;
@@ -943,6 +943,22 @@ FASTOP2(xadd);
 
 FASTOP2R(cmp, cmp_r);
 
+static int em_bsf_c(struct x86_emulate_ctxt *ctxt)
+{
+        /* If src is zero, do not writeback, but update flags */
+        if (ctxt->src.val == 0)
+                ctxt->dst.type = OP_NONE;
+        return fastop(ctxt, em_bsf);
+}
+
+static int em_bsr_c(struct x86_emulate_ctxt *ctxt)
+{
+        /* If src is zero, do not writeback, but update flags */
+        if (ctxt->src.val == 0)
+                ctxt->dst.type = OP_NONE;
+        return fastop(ctxt, em_bsr);
+}
+
 static u8 test_cc(unsigned int condition, unsigned long flags)
 {
         u8 rc;
@@ -1399,7 +1415,7 @@ static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
                 unsigned int in_page, n;
                 unsigned int count = ctxt->rep_prefix ?
                         address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) : 1;
-                in_page = (ctxt->eflags & EFLG_DF) ?
+                in_page = (ctxt->eflags & X86_EFLAGS_DF) ?
                         offset_in_page(reg_read(ctxt, VCPU_REGS_RDI)) :
                         PAGE_SIZE - offset_in_page(reg_read(ctxt, VCPU_REGS_RDI));
                 n = min3(in_page, (unsigned int)sizeof(rc->data) / size, count);
@@ -1412,7 +1428,7 @@ static int pio_in_emulated(struct x86_emulate_ctxt *ctxt,
         }
 
         if (ctxt->rep_prefix && (ctxt->d & String) &&
-            !(ctxt->eflags & EFLG_DF)) {
+            !(ctxt->eflags & X86_EFLAGS_DF)) {
                 ctxt->dst.data = rc->data + rc->pos;
                 ctxt->dst.type = OP_MEM_STR;
                 ctxt->dst.count = (rc->end - rc->pos) / size;
@@ -1691,21 +1707,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
 
 static void write_register_operand(struct operand *op)
 {
-        /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
-        switch (op->bytes) {
-        case 1:
-                *(u8 *)op->addr.reg = (u8)op->val;
-                break;
-        case 2:
-                *(u16 *)op->addr.reg = (u16)op->val;
-                break;
-        case 4:
-                *op->addr.reg = (u32)op->val;
-                break;  /* 64b: zero-extend */
-        case 8:
-                *op->addr.reg = op->val;
-                break;
-        }
+        return assign_register(op->addr.reg, op->val, op->bytes);
 }
 
 static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)
@@ -1792,32 +1794,34 @@ static int emulate_popf(struct x86_emulate_ctxt *ctxt,
 {
         int rc;
         unsigned long val, change_mask;
-        int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
+        int iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> X86_EFLAGS_IOPL_BIT;
         int cpl = ctxt->ops->cpl(ctxt);
 
         rc = emulate_pop(ctxt, &val, len);
         if (rc != X86EMUL_CONTINUE)
                 return rc;
 
-        change_mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_OF
-                | EFLG_TF | EFLG_DF | EFLG_NT | EFLG_AC | EFLG_ID;
+        change_mask = X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+                      X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_OF |
+                      X86_EFLAGS_TF | X86_EFLAGS_DF | X86_EFLAGS_NT |
+                      X86_EFLAGS_AC | X86_EFLAGS_ID;
 
         switch(ctxt->mode) {
         case X86EMUL_MODE_PROT64:
         case X86EMUL_MODE_PROT32:
         case X86EMUL_MODE_PROT16:
                 if (cpl == 0)
-                        change_mask |= EFLG_IOPL;
+                        change_mask |= X86_EFLAGS_IOPL;
                 if (cpl <= iopl)
-                        change_mask |= EFLG_IF;
+                        change_mask |= X86_EFLAGS_IF;
                 break;
         case X86EMUL_MODE_VM86:
                 if (iopl < 3)
                         return emulate_gp(ctxt, 0);
-                change_mask |= EFLG_IF;
+                change_mask |= X86_EFLAGS_IF;
                 break;
         default: /* real mode */
-                change_mask |= (EFLG_IOPL | EFLG_IF);
+                change_mask |= (X86_EFLAGS_IOPL | X86_EFLAGS_IF);
                 break;
         }
 
@@ -1918,7 +1922,7 @@ static int em_pusha(struct x86_emulate_ctxt *ctxt)
 
 static int em_pushf(struct x86_emulate_ctxt *ctxt)
 {
-        ctxt->src.val = (unsigned long)ctxt->eflags & ~EFLG_VM;
+        ctxt->src.val = (unsigned long)ctxt->eflags & ~X86_EFLAGS_VM;
         return em_push(ctxt);
 }
 
@@ -1926,6 +1930,7 @@ static int em_popa(struct x86_emulate_ctxt *ctxt)
 {
         int rc = X86EMUL_CONTINUE;
         int reg = VCPU_REGS_RDI;
+        u32 val;
 
         while (reg >= VCPU_REGS_RAX) {
                 if (reg == VCPU_REGS_RSP) {
@@ -1933,9 +1938,10 @@ static int em_popa(struct x86_emulate_ctxt *ctxt)
                         --reg;
                 }
 
-                rc = emulate_pop(ctxt, reg_rmw(ctxt, reg), ctxt->op_bytes);
+                rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
                 if (rc != X86EMUL_CONTINUE)
                         break;
+                assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
                 --reg;
         }
         return rc;
@@ -1956,7 +1962,7 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq)
         if (rc != X86EMUL_CONTINUE)
                 return rc;
 
-        ctxt->eflags &= ~(EFLG_IF | EFLG_TF | EFLG_AC);
+        ctxt->eflags &= ~(X86_EFLAGS_IF | X86_EFLAGS_TF | X86_EFLAGS_AC);
 
         ctxt->src.val = get_segment_selector(ctxt, VCPU_SREG_CS);
         rc = em_push(ctxt);
@@ -2022,10 +2028,14 @@ static int emulate_iret_real(struct x86_emulate_ctxt *ctxt)
         unsigned long temp_eip = 0;
         unsigned long temp_eflags = 0;
         unsigned long cs = 0;
-        unsigned long mask = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF | EFLG_TF |
-                             EFLG_IF | EFLG_DF | EFLG_OF | EFLG_IOPL | EFLG_NT | EFLG_RF |
-                             EFLG_AC | EFLG_ID | (1 << 1); /* Last one is the reserved bit */
-        unsigned long vm86_mask = EFLG_VM | EFLG_VIF | EFLG_VIP;
+        unsigned long mask = X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+                             X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_TF |
+                             X86_EFLAGS_IF | X86_EFLAGS_DF | X86_EFLAGS_OF |
+                             X86_EFLAGS_IOPL | X86_EFLAGS_NT | X86_EFLAGS_RF |
+                             X86_EFLAGS_AC | X86_EFLAGS_ID |
+                             X86_EFLAGS_FIXED_BIT;
+        unsigned long vm86_mask = X86_EFLAGS_VM | X86_EFLAGS_VIF |
+                                  X86_EFLAGS_VIP;
 
         /* TODO: Add stack limit check */
 
@@ -2054,7 +2064,6 @@ static int emulate_iret_real(struct x86_emulate_ctxt *ctxt)
 
         ctxt->_eip = temp_eip;
 
-
         if (ctxt->op_bytes == 4)
                 ctxt->eflags = ((temp_eflags & mask) | (ctxt->eflags & vm86_mask));
         else if (ctxt->op_bytes == 2) {
@@ -2063,7 +2072,7 @@ static int emulate_iret_real(struct x86_emulate_ctxt *ctxt)
         }
 
         ctxt->eflags &= ~EFLG_RESERVED_ZEROS_MASK; /* Clear reserved zeros */
-        ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
+        ctxt->eflags |= X86_EFLAGS_FIXED_BIT;
         ctxt->ops->set_nmi_mask(ctxt, false);
 
         return rc;
@@ -2145,12 +2154,12 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
             ((u32) (old >> 32) != (u32) reg_read(ctxt, VCPU_REGS_RDX))) {
                 *reg_write(ctxt, VCPU_REGS_RAX) = (u32) (old >> 0);
                 *reg_write(ctxt, VCPU_REGS_RDX) = (u32) (old >> 32);
-                ctxt->eflags &= ~EFLG_ZF;
+                ctxt->eflags &= ~X86_EFLAGS_ZF;
         } else {
                 ctxt->dst.val64 = ((u64)reg_read(ctxt, VCPU_REGS_RCX) << 32) |
                         (u32) reg_read(ctxt, VCPU_REGS_RBX);
 
-                ctxt->eflags |= EFLG_ZF;
+                ctxt->eflags |= X86_EFLAGS_ZF;
         }
         return X86EMUL_CONTINUE;
 }
@@ -2222,7 +2231,7 @@ static int em_cmpxchg(struct x86_emulate_ctxt *ctxt)
         ctxt->src.val = ctxt->dst.orig_val;
         fastop(ctxt, em_cmp);
 
-        if (ctxt->eflags & EFLG_ZF) {
+        if (ctxt->eflags & X86_EFLAGS_ZF) {
                 /* Success: write back to memory; no update of EAX */
                 ctxt->src.type = OP_NONE;
                 ctxt->dst.val = ctxt->src.orig_val;
@@ -2381,14 +2390,14 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt)
 
                 ops->get_msr(ctxt, MSR_SYSCALL_MASK, &msr_data);
                 ctxt->eflags &= ~msr_data;
-                ctxt->eflags |= EFLG_RESERVED_ONE_MASK;
+                ctxt->eflags |= X86_EFLAGS_FIXED_BIT;
 #endif
         } else {
                 /* legacy mode */
                 ops->get_msr(ctxt, MSR_STAR, &msr_data);
                 ctxt->_eip = (u32)msr_data;
 
-                ctxt->eflags &= ~(EFLG_VM | EFLG_IF);
+                ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF);
         }
 
         return X86EMUL_CONTINUE;
@@ -2425,8 +2434,8 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
         if ((msr_data & 0xfffc) == 0x0)
                 return emulate_gp(ctxt, 0);
 
-        ctxt->eflags &= ~(EFLG_VM | EFLG_IF);
-        cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
+        ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF);
+        cs_sel = (u16)msr_data & ~SEGMENT_RPL_MASK;
         ss_sel = cs_sel + 8;
         if (efer & EFER_LMA) {
                 cs.d = 0;
@@ -2493,8 +2502,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
                         return emulate_gp(ctxt, 0);
                 break;
         }
-        cs_sel |= SELECTOR_RPL_MASK;
-        ss_sel |= SELECTOR_RPL_MASK;
+        cs_sel |= SEGMENT_RPL_MASK;
+        ss_sel |= SEGMENT_RPL_MASK;
 
         ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
         ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
@@ -2512,7 +2521,7 @@ static bool emulator_bad_iopl(struct x86_emulate_ctxt *ctxt)
                 return false;
         if (ctxt->mode == X86EMUL_MODE_VM86)
                 return true;
-        iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> IOPL_SHIFT;
+        iopl = (ctxt->eflags & X86_EFLAGS_IOPL) >> X86_EFLAGS_IOPL_BIT;
         return ctxt->ops->cpl(ctxt) > iopl;
 }
 
@@ -2782,10 +2791,8 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
                 return ret;
         ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl,
                                         X86_TRANSFER_TASK_SWITCH, NULL);
-        if (ret != X86EMUL_CONTINUE)
-                return ret;
 
-        return X86EMUL_CONTINUE;
+        return ret;
 }
 
 static int task_switch_32(struct x86_emulate_ctxt *ctxt,
@@ -2954,7 +2961,7 @@ int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
 static void string_addr_inc(struct x86_emulate_ctxt *ctxt, int reg,
                 struct operand *op)
 {
-        int df = (ctxt->eflags & EFLG_DF) ? -op->count : op->count;
+        int df = (ctxt->eflags & X86_EFLAGS_DF) ? -op->count : op->count;
 
         register_address_increment(ctxt, reg, df * op->bytes);
         op->addr.mem.ea = register_address(ctxt, reg);
@@ -3323,7 +3330,7 @@ static int em_clts(struct x86_emulate_ctxt *ctxt)
         return X86EMUL_CONTINUE;
 }
 
-static int em_vmcall(struct x86_emulate_ctxt *ctxt)
+static int em_hypercall(struct x86_emulate_ctxt *ctxt)
 {
         int rc = ctxt->ops->fix_hypercall(ctxt);
 
@@ -3395,17 +3402,6 @@ static int em_lgdt(struct x86_emulate_ctxt *ctxt)
         return em_lgdt_lidt(ctxt, true);
 }
 
-static int em_vmmcall(struct x86_emulate_ctxt *ctxt)
-{
-        int rc;
-
-        rc = ctxt->ops->fix_hypercall(ctxt);
-
-        /* Disable writeback. */
-        ctxt->dst.type = OP_NONE;
-        return rc;
-}
-
 static int em_lidt(struct x86_emulate_ctxt *ctxt)
 {
         return em_lgdt_lidt(ctxt, false);
@@ -3504,7 +3500,8 @@ static int em_sahf(struct x86_emulate_ctxt *ctxt)
 {
         u32 flags;
 
-        flags = EFLG_CF | EFLG_PF | EFLG_AF | EFLG_ZF | EFLG_SF;
+        flags = X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF | X86_EFLAGS_ZF |
+                X86_EFLAGS_SF;
         flags &= *reg_rmw(ctxt, VCPU_REGS_RAX) >> 8;
 
         ctxt->eflags &= ~0xffUL;
@@ -3769,7 +3766,7 @@ static int check_perm_out(struct x86_emulate_ctxt *ctxt)
 
 static const struct opcode group7_rm0[] = {
         N,
-        I(SrcNone | Priv | EmulateOnUD, em_vmcall),
+        I(SrcNone | Priv | EmulateOnUD, em_hypercall),
         N, N, N, N, N, N,
 };
 
@@ -3781,7 +3778,7 @@ static const struct opcode group7_rm1[] = {
 
 static const struct opcode group7_rm3[] = {
         DIP(SrcNone | Prot | Priv,              vmrun,          check_svme_pa),
-        II(SrcNone  | Prot | EmulateOnUD,       em_vmmcall,     vmmcall),
+        II(SrcNone  | Prot | EmulateOnUD,       em_hypercall,   vmmcall),
         DIP(SrcNone | Prot | Priv,              vmload,         check_svme_pa),
         DIP(SrcNone | Prot | Priv,              vmsave,         check_svme_pa),
         DIP(SrcNone | Prot | Priv,              stgi,           check_svme),
@@ -4192,7 +4189,8 @@ static const struct opcode twobyte_table[256] = {
         N, N,
         G(BitOp, group8),
         F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_btc),
-        F(DstReg | SrcMem | ModRM, em_bsf), F(DstReg | SrcMem | ModRM, em_bsr),
+        I(DstReg | SrcMem | ModRM, em_bsf_c),
+        I(DstReg | SrcMem | ModRM, em_bsr_c),
         D(DstReg | SrcMem8 | ModRM | Mov), D(DstReg | SrcMem16 | ModRM | Mov),
         /* 0xC0 - 0xC7 */
         F2bv(DstMem | SrcReg | ModRM | SrcWrite | Lock, em_xadd),
@@ -4759,9 +4757,9 @@ static bool string_insn_completed(struct x86_emulate_ctxt *ctxt)
         if (((ctxt->b == 0xa6) || (ctxt->b == 0xa7) ||
              (ctxt->b == 0xae) || (ctxt->b == 0xaf))
             && (((ctxt->rep_prefix == REPE_PREFIX) &&
-                 ((ctxt->eflags & EFLG_ZF) == 0))
+                 ((ctxt->eflags & X86_EFLAGS_ZF) == 0))
                 || ((ctxt->rep_prefix == REPNE_PREFIX) &&
-                    ((ctxt->eflags & EFLG_ZF) == EFLG_ZF))))
+                    ((ctxt->eflags & X86_EFLAGS_ZF) == X86_EFLAGS_ZF))))
                 return true;
 
         return false;
@@ -4913,7 +4911,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
                         /* All REP prefixes have the same first termination condition */
                         if (address_mask(ctxt, reg_read(ctxt, VCPU_REGS_RCX)) == 0) {
                                 ctxt->eip = ctxt->_eip;
-                                ctxt->eflags &= ~EFLG_RF;
+                                ctxt->eflags &= ~X86_EFLAGS_RF;
                                 goto done;
                         }
                 }
@@ -4963,9 +4961,9 @@ special_insn:
         }
 
         if (ctxt->rep_prefix && (ctxt->d & String))
-                ctxt->eflags |= EFLG_RF;
+                ctxt->eflags |= X86_EFLAGS_RF;
         else
-                ctxt->eflags &= ~EFLG_RF;
+                ctxt->eflags &= ~X86_EFLAGS_RF;
 
         if (ctxt->execute) {
                 if (ctxt->d & Fastop) {
@@ -5014,7 +5012,7 @@ special_insn:
                 rc = emulate_int(ctxt, ctxt->src.val);
                 break;
         case 0xce:              /* into */
-                if (ctxt->eflags & EFLG_OF)
+                if (ctxt->eflags & X86_EFLAGS_OF)
                         rc = emulate_int(ctxt, 4);
                 break;
         case 0xe9: /* jmp rel */
@@ -5027,19 +5025,19 @@ special_insn:
                 break;
         case 0xf5:      /* cmc */
                 /* complement carry flag from eflags reg */
-                ctxt->eflags ^= EFLG_CF;
+                ctxt->eflags ^= X86_EFLAGS_CF;
                 break;
         case 0xf8: /* clc */
-                ctxt->eflags &= ~EFLG_CF;
+                ctxt->eflags &= ~X86_EFLAGS_CF;
                 break;
         case 0xf9: /* stc */
-                ctxt->eflags |= EFLG_CF;
+                ctxt->eflags |= X86_EFLAGS_CF;
                 break;
         case 0xfc: /* cld */
-                ctxt->eflags &= ~EFLG_DF;
+                ctxt->eflags &= ~X86_EFLAGS_DF;
                 break;
         case 0xfd: /* std */
-                ctxt->eflags |= EFLG_DF;
+                ctxt->eflags |= X86_EFLAGS_DF;
                 break;
         default:
                 goto cannot_emulate;
@@ -5100,7 +5098,7 @@ writeback:
                         }
                         goto done; /* skip rip writeback */
                 }
-                ctxt->eflags &= ~EFLG_RF;
+                ctxt->eflags &= ~X86_EFLAGS_RF;
         }
 
         ctxt->eip = ctxt->_eip;
@@ -5137,8 +5135,7 @@ twobyte_insn:
         case 0x40 ... 0x4f:     /* cmov */
                 if (test_cc(ctxt->b, ctxt->eflags))
                         ctxt->dst.val = ctxt->src.val;
-                else if (ctxt->mode != X86EMUL_MODE_PROT64 ||
-                         ctxt->op_bytes != 4)
+                else if (ctxt->op_bytes != 4)
                         ctxt->dst.type = OP_NONE; /* no writeback */
                 break;
         case 0x80 ... 0x8f: /* jnz rel, etc*/
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 8ff4eaa2bf19..fef922ff2635 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -507,6 +507,7 @@ static int picdev_read(struct kvm_pic *s,
                 return -EOPNOTSUPP;
 
         if (len != 1) {
+                memset(val, 0, len);
                 pr_pic_unimpl("non byte read\n");
                 return 0;
         }
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 8bf2e49708e3..51889ec847b0 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -206,6 +206,8 @@ static int ioapic_set_irq(struct kvm_ioapic *ioapic, unsigned int irq,
 
         old_irr = ioapic->irr;
         ioapic->irr |= mask;
+        if (edge)
+                ioapic->irr_delivered &= ~mask;
         if ((edge && old_irr == ioapic->irr) ||
             (!edge && entry.fields.remote_irr)) {
                 ret = 0;
@@ -349,7 +351,7 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
         irqe.shorthand = 0;
 
         if (irqe.trig_mode == IOAPIC_EDGE_TRIG)
-                ioapic->irr &= ~(1 << irq);
+                ioapic->irr_delivered |= 1 << irq;
 
         if (irq == RTC_GSI && line_status) {
                 /*
@@ -471,13 +473,6 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
         }
 }
 
-bool kvm_ioapic_handles_vector(struct kvm *kvm, int vector)
-{
-        struct kvm_ioapic *ioapic = kvm->arch.vioapic;
-        smp_rmb();
-        return test_bit(vector, ioapic->handled_vectors);
-}
-
 void kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu, int vector, int trigger_mode)
 {
         struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
@@ -597,6 +592,7 @@ static void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
         ioapic->base_address = IOAPIC_DEFAULT_BASE_ADDRESS;
         ioapic->ioregsel = 0;
         ioapic->irr = 0;
+        ioapic->irr_delivered = 0;
         ioapic->id = 0;
         memset(ioapic->irq_eoi, 0x00, IOAPIC_NUM_PINS);
         rtc_irq_eoi_tracking_reset(ioapic);
@@ -654,6 +650,7 @@ int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
 
         spin_lock(&ioapic->lock);
         memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
+        state->irr &= ~ioapic->irr_delivered;
         spin_unlock(&ioapic->lock);
         return 0;
 }
@@ -667,6 +664,7 @@ int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
         spin_lock(&ioapic->lock);
         memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
         ioapic->irr = 0;
+        ioapic->irr_delivered = 0;
         update_handled_vectors(ioapic);
         kvm_vcpu_request_scan_ioapic(kvm);
         kvm_ioapic_inject_all(ioapic, state->irr);
diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
index d9e02cab7b96..ca0b0b4e6256 100644
--- a/arch/x86/kvm/ioapic.h
+++ b/arch/x86/kvm/ioapic.h
@@ -77,6 +77,7 @@ struct kvm_ioapic {
         struct rtc_status rtc_status;
         struct delayed_work eoi_inject;
         u32 irq_eoi[IOAPIC_NUM_PINS];
+        u32 irr_delivered;
 };
 
 #ifdef DEBUG
@@ -97,13 +98,19 @@ static inline struct kvm_ioapic *ioapic_irqchip(struct kvm *kvm)
         return kvm->arch.vioapic;
 }
 
+static inline bool kvm_ioapic_handles_vector(struct kvm *kvm, int vector)
+{
+        struct kvm_ioapic *ioapic = kvm->arch.vioapic;
+        smp_rmb();
+        return test_bit(vector, ioapic->handled_vectors);
+}
+
 void kvm_rtc_eoi_tracking_restore_one(struct kvm_vcpu *vcpu);
 bool kvm_apic_match_dest(struct kvm_vcpu *vcpu, struct kvm_lapic *source,
                 int short_hand, unsigned int dest, int dest_mode);
 int kvm_apic_compare_prio(struct kvm_vcpu *vcpu1, struct kvm_vcpu *vcpu2);
 void kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu, int vector,
                         int trigger_mode);
-bool kvm_ioapic_handles_vector(struct kvm *kvm, int vector);
 int kvm_ioapic_init(struct kvm *kvm);
 void kvm_ioapic_destroy(struct kvm *kvm);
 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int irq_source_id,
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index ba57bb79e795..44f7b9afbedb 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1572,7 +1572,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu)
                 apic_set_reg(apic, APIC_TMR + 0x10 * i, 0);
         }
         apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm);
-        apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm);
+        apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0;
         apic->highest_isr_cache = -1;
         update_divide_count(apic);
         atomic_set(&apic->lapic_timer.pending, 0);
@@ -1782,7 +1782,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
         update_divide_count(apic);
         start_apic_timer(apic);
         apic->irr_pending = true;
-        apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ?
+        apic->isr_count = kvm_x86_ops->hwapic_isr_update ?
                                 1 : count_vectors(apic->regs + APIC_ISR);
         apic->highest_isr_cache = -1;
         if (kvm_x86_ops->hwapic_irr_update)
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 8e6b7d869d2f..29fbf9dfdc54 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -38,7 +38,7 @@ static struct kvm_arch_event_perf_mapping {
 };
 
 /* mapping between fixed pmc index and arch_events array */
-int fixed_pmc_events[] = {1, 0, 7};
+static int fixed_pmc_events[] = {1, 0, 7};
 
 static bool pmc_is_gp(struct kvm_pmc *pmc)
 {
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d319e0c24758..155534c0f5e8 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1929,14 +1929,12 @@ static int nop_on_interception(struct vcpu_svm *svm)
 static int halt_interception(struct vcpu_svm *svm)
 {
         svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
-        skip_emulated_instruction(&svm->vcpu);
         return kvm_emulate_halt(&svm->vcpu);
 }
 
 static int vmmcall_interception(struct vcpu_svm *svm)
 {
         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
-        skip_emulated_instruction(&svm->vcpu);
         kvm_emulate_hypercall(&svm->vcpu);
         return 1;
 }
@@ -2757,11 +2755,11 @@ static int invlpga_interception(struct vcpu_svm *svm)
 {
         struct kvm_vcpu *vcpu = &svm->vcpu;
 
-        trace_kvm_invlpga(svm->vmcb->save.rip, vcpu->arch.regs[VCPU_REGS_RCX],
-                          vcpu->arch.regs[VCPU_REGS_RAX]);
+        trace_kvm_invlpga(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RCX),
+                          kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
 
         /* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
-        kvm_mmu_invlpg(vcpu, vcpu->arch.regs[VCPU_REGS_RAX]);
+        kvm_mmu_invlpg(vcpu, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
 
         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
         skip_emulated_instruction(&svm->vcpu);
@@ -2770,12 +2768,18 @@ static int invlpga_interception(struct vcpu_svm *svm)
 
 static int skinit_interception(struct vcpu_svm *svm)
 {
-        trace_kvm_skinit(svm->vmcb->save.rip, svm->vcpu.arch.regs[VCPU_REGS_RAX]);
+        trace_kvm_skinit(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
 
         kvm_queue_exception(&svm->vcpu, UD_VECTOR);
         return 1;
 }
 
+static int wbinvd_interception(struct vcpu_svm *svm)
+{
+        kvm_emulate_wbinvd(&svm->vcpu);
+        return 1;
+}
+
 static int xsetbv_interception(struct vcpu_svm *svm)
 {
         u64 new_bv = kvm_read_edx_eax(&svm->vcpu);
@@ -2902,7 +2906,8 @@ static int rdpmc_interception(struct vcpu_svm *svm)
         return 1;
 }
 
-bool check_selective_cr0_intercepted(struct vcpu_svm *svm, unsigned long val)
+static bool check_selective_cr0_intercepted(struct vcpu_svm *svm,
+                                            unsigned long val)
 {
         unsigned long cr0 = svm->vcpu.arch.cr0;
         bool ret = false;
@@ -2940,7 +2945,10 @@ static int cr_interception(struct vcpu_svm *svm)
                 return emulate_on_interception(svm);
 
         reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
-        cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
+        if (svm->vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE)
+                cr = SVM_EXIT_WRITE_CR0 - SVM_EXIT_READ_CR0;
+        else
+                cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
 
         err = 0;
         if (cr >= 16) { /* mov to cr */
@@ -3133,7 +3141,7 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
 
 static int rdmsr_interception(struct vcpu_svm *svm)
 {
-        u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
+        u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
         u64 data;
 
         if (svm_get_msr(&svm->vcpu, ecx, &data)) {
@@ -3142,8 +3150,8 @@ static int rdmsr_interception(struct vcpu_svm *svm)
         } else {
                 trace_kvm_msr_read(ecx, data);
 
-                svm->vcpu.arch.regs[VCPU_REGS_RAX] = data & 0xffffffff;
-                svm->vcpu.arch.regs[VCPU_REGS_RDX] = data >> 32;
+                kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, data & 0xffffffff);
+                kvm_register_write(&svm->vcpu, VCPU_REGS_RDX, data >> 32);
                 svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
                 skip_emulated_instruction(&svm->vcpu);
         }
@@ -3246,9 +3254,8 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 static int wrmsr_interception(struct vcpu_svm *svm)
 {
         struct msr_data msr;
-        u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
-        u64 data = (svm->vcpu.arch.regs[VCPU_REGS_RAX] & -1u)
-                | ((u64)(svm->vcpu.arch.regs[VCPU_REGS_RDX] & -1u) << 32);
+        u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
+        u64 data = kvm_read_edx_eax(&svm->vcpu);
 
         msr.data = data;
         msr.index = ecx;
@@ -3325,7 +3332,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
         [SVM_EXIT_READ_CR3]                     = cr_interception,
         [SVM_EXIT_READ_CR4]                     = cr_interception,
         [SVM_EXIT_READ_CR8]                     = cr_interception,
-        [SVM_EXIT_CR0_SEL_WRITE]                = emulate_on_interception,
+        [SVM_EXIT_CR0_SEL_WRITE]                = cr_interception,
         [SVM_EXIT_WRITE_CR0]                    = cr_interception,
         [SVM_EXIT_WRITE_CR3]                    = cr_interception,
         [SVM_EXIT_WRITE_CR4]                    = cr_interception,
@@ -3376,7 +3383,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
         [SVM_EXIT_STGI]                         = stgi_interception,
         [SVM_EXIT_CLGI]                         = clgi_interception,
         [SVM_EXIT_SKINIT]                       = skinit_interception,
-        [SVM_EXIT_WBINVD]                       = emulate_on_interception,
+        [SVM_EXIT_WBINVD]                       = wbinvd_interception,
         [SVM_EXIT_MONITOR]                      = monitor_interception,
         [SVM_EXIT_MWAIT]                        = mwait_interception,
         [SVM_EXIT_XSETBV]                       = xsetbv_interception,
@@ -3555,7 +3562,7 @@ static int handle_exit(struct kvm_vcpu *vcpu)
 
         if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
             || !svm_exit_handlers[exit_code]) {
-                WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code);
+                WARN_ONCE(1, "svm: unexpected exit reason 0x%x\n", exit_code);
                 kvm_queue_exception(vcpu, UD_VECTOR);
                 return 1;
         }
@@ -3649,11 +3656,6 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
         return;
 }
 
-static void svm_hwapic_isr_update(struct kvm *kvm, int isr)
-{
-        return;
-}
-
 static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 {
         return;
@@ -4403,7 +4405,6 @@ static struct kvm_x86_ops svm_x86_ops = {
         .set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
         .vm_has_apicv = svm_vm_has_apicv,
         .load_eoi_exitmap = svm_load_eoi_exitmap,
-        .hwapic_isr_update = svm_hwapic_isr_update,
         .sync_pir_to_irr = svm_sync_pir_to_irr,
 
         .set_tss_addr = svm_set_tss_addr,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 317da9bde728..b5a6425d8d97 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2467,6 +2467,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
         vmx->nested.nested_vmx_secondary_ctls_low = 0;
         vmx->nested.nested_vmx_secondary_ctls_high &=
                 SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+                SECONDARY_EXEC_RDTSCP |
                 SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
                 SECONDARY_EXEC_APIC_REGISTER_VIRT |
                 SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
@@ -3262,8 +3263,8 @@ static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
                  * default value.
                  */
                 if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)
-                        save->selector &= ~SELECTOR_RPL_MASK;
-                save->dpl = save->selector & SELECTOR_RPL_MASK;
+                        save->selector &= ~SEGMENT_RPL_MASK;
+                save->dpl = save->selector & SEGMENT_RPL_MASK;
                 save->s = 1;
         }
         vmx_set_segment(vcpu, save, seg);
@@ -3836,7 +3837,7 @@ static bool code_segment_valid(struct kvm_vcpu *vcpu)
         unsigned int cs_rpl;
 
         vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
-        cs_rpl = cs.selector & SELECTOR_RPL_MASK;
+        cs_rpl = cs.selector & SEGMENT_RPL_MASK;
 
         if (cs.unusable)
                 return false;
@@ -3864,7 +3865,7 @@ static bool stack_segment_valid(struct kvm_vcpu *vcpu)
         unsigned int ss_rpl;
 
         vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
-        ss_rpl = ss.selector & SELECTOR_RPL_MASK;
+        ss_rpl = ss.selector & SEGMENT_RPL_MASK;
 
         if (ss.unusable)
                 return true;
@@ -3886,7 +3887,7 @@ static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
         unsigned int rpl;
 
         vmx_get_segment(vcpu, &var, seg);
-        rpl = var.selector & SELECTOR_RPL_MASK;
+        rpl = var.selector & SEGMENT_RPL_MASK;
 
         if (var.unusable)
                 return true;
@@ -3913,7 +3914,7 @@ static bool tr_valid(struct kvm_vcpu *vcpu)
 
         if (tr.unusable)
                 return false;
-        if (tr.selector & SELECTOR_TI_MASK)     /* TI = 1 */
+        if (tr.selector & SEGMENT_TI_MASK)      /* TI = 1 */
                 return false;
         if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
                 return false;
@@ -3931,7 +3932,7 @@ static bool ldtr_valid(struct kvm_vcpu *vcpu)
 
         if (ldtr.unusable)
                 return true;
-        if (ldtr.selector & SELECTOR_TI_MASK)   /* TI = 1 */
+        if (ldtr.selector & SEGMENT_TI_MASK)    /* TI = 1 */
                 return false;
         if (ldtr.type != 2)
                 return false;
@@ -3948,8 +3949,8 @@ static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
         vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
         vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
 
-        return ((cs.selector & SELECTOR_RPL_MASK) ==
-                 (ss.selector & SELECTOR_RPL_MASK));
+        return ((cs.selector & SEGMENT_RPL_MASK) ==
+                 (ss.selector & SEGMENT_RPL_MASK));
 }
 
 /*
@@ -5000,7 +5001,7 @@ static int handle_rmode_exception(struct kvm_vcpu *vcpu,
                 if (emulate_instruction(vcpu, 0) == EMULATE_DONE) {
                         if (vcpu->arch.halt_request) {
                                 vcpu->arch.halt_request = 0;
-                                return kvm_emulate_halt(vcpu);
+                                return kvm_vcpu_halt(vcpu);
                         }
                         return 1;
                 }
@@ -5065,6 +5066,10 @@ static int handle_exception(struct kvm_vcpu *vcpu)
         }
 
         if (is_invalid_opcode(intr_info)) {
+                if (is_guest_mode(vcpu)) {
+                        kvm_queue_exception(vcpu, UD_VECTOR);
+                        return 1;
+                }
                 er = emulate_instruction(vcpu, EMULTYPE_TRAP_UD);
                 if (er != EMULATE_DONE)
                         kvm_queue_exception(vcpu, UD_VECTOR);
@@ -5527,13 +5532,11 @@ static int handle_interrupt_window(struct kvm_vcpu *vcpu)
 
 static int handle_halt(struct kvm_vcpu *vcpu)
 {
-        skip_emulated_instruction(vcpu);
         return kvm_emulate_halt(vcpu);
 }
 
 static int handle_vmcall(struct kvm_vcpu *vcpu)
 {
-        skip_emulated_instruction(vcpu);
         kvm_emulate_hypercall(vcpu);
         return 1;
 }
@@ -5564,7 +5567,6 @@ static int handle_rdpmc(struct kvm_vcpu *vcpu)
 
 static int handle_wbinvd(struct kvm_vcpu *vcpu)
 {
-        skip_emulated_instruction(vcpu);
         kvm_emulate_wbinvd(vcpu);
         return 1;
 }
@@ -5903,7 +5905,7 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
 
                 if (vcpu->arch.halt_request) {
                         vcpu->arch.halt_request = 0;
-                        ret = kvm_emulate_halt(vcpu);
+                        ret = kvm_vcpu_halt(vcpu);
                         goto out;
                 }
 
@@ -7312,21 +7314,21 @@ static bool nested_vmx_exit_handled_io(struct kvm_vcpu *vcpu,
                 else if (port < 0x10000)
                         bitmap = vmcs12->io_bitmap_b;
                 else
-                        return 1;
+                        return true;
                 bitmap += (port & 0x7fff) / 8;
 
                 if (last_bitmap != bitmap)
                         if (kvm_read_guest(vcpu->kvm, bitmap, &b, 1))
-                                return 1;
+                                return true;
                 if (b & (1 << (port & 7)))
-                        return 1;
+                        return true;
 
                 port++;
                 size--;
                 last_bitmap = bitmap;
         }
 
-        return 0;
+        return false;
 }
 
 /*
@@ -7342,7 +7344,7 @@ static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
         gpa_t bitmap;
 
         if (!nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
-                return 1;
+                return true;
 
         /*
          * The MSR_BITMAP page is divided into four 1024-byte bitmaps,
@@ -7361,10 +7363,10 @@ static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
         if (msr_index < 1024*8) {
                 unsigned char b;
                 if (kvm_read_guest(vcpu->kvm, bitmap + msr_index/8, &b, 1))
-                        return 1;
+                        return true;
                 return 1 & (b >> (msr_index & 7));
         } else
-                return 1; /* let L1 handle the wrong parameter */
+                return true; /* let L1 handle the wrong parameter */
 }
 
 /*
@@ -7386,7 +7388,7 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
                 case 0:
                         if (vmcs12->cr0_guest_host_mask &
                             (val ^ vmcs12->cr0_read_shadow))
-                                return 1;
+                                return true;
                         break;
                 case 3:
                         if ((vmcs12->cr3_target_count >= 1 &&
@@ -7397,37 +7399,37 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
                                         vmcs12->cr3_target_value2 == val) ||
                                 (vmcs12->cr3_target_count >= 4 &&
                                         vmcs12->cr3_target_value3 == val))
-                                return 0;
+                                return false;
                         if (nested_cpu_has(vmcs12, CPU_BASED_CR3_LOAD_EXITING))
-                                return 1;
+                                return true;
                         break;
                 case 4:
                         if (vmcs12->cr4_guest_host_mask &
                             (vmcs12->cr4_read_shadow ^ val))
-                                return 1;
+                                return true;
                         break;
                 case 8:
                         if (nested_cpu_has(vmcs12, CPU_BASED_CR8_LOAD_EXITING))
-                                return 1;
+                                return true;
                         break;
                 }
                 break;
         case 2: /* clts */
                 if ((vmcs12->cr0_guest_host_mask & X86_CR0_TS) &&
                     (vmcs12->cr0_read_shadow & X86_CR0_TS))
-                        return 1;
+                        return true;
                 break;
         case 1: /* mov from cr */
                 switch (cr) {
                 case 3:
                         if (vmcs12->cpu_based_vm_exec_control &
                             CPU_BASED_CR3_STORE_EXITING)
-                                return 1;
+                                return true;
                         break;
                 case 8:
                         if (vmcs12->cpu_based_vm_exec_control &
                             CPU_BASED_CR8_STORE_EXITING)
-                                return 1;
+                                return true;
                         break;
                 }
                 break;
@@ -7438,14 +7440,14 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
                  */
                 if (vmcs12->cr0_guest_host_mask & 0xe &
                     (val ^ vmcs12->cr0_read_shadow))
-                        return 1;
+                        return true;
                 if ((vmcs12->cr0_guest_host_mask & 0x1) &&
                     !(vmcs12->cr0_read_shadow & 0x1) &&
                     (val & 0x1))
-                        return 1;
+                        return true;
                 break;
         }
-        return 0;
+        return false;
 }
 
 /*
@@ -7468,48 +7470,48 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                                 KVM_ISA_VMX);
 
         if (vmx->nested.nested_run_pending)
-                return 0;
+                return false;
 
         if (unlikely(vmx->fail)) {
                 pr_info_ratelimited("%s failed vm entry %x\n", __func__,
                                     vmcs_read32(VM_INSTRUCTION_ERROR));
-                return 1;
+                return true;
         }
 
         switch (exit_reason) {
         case EXIT_REASON_EXCEPTION_NMI:
                 if (!is_exception(intr_info))
-                        return 0;
+                        return false;
                 else if (is_page_fault(intr_info))
                         return enable_ept;
                 else if (is_no_device(intr_info) &&
                          !(vmcs12->guest_cr0 & X86_CR0_TS))
-                        return 0;
+                        return false;
                 return vmcs12->exception_bitmap &
                                 (1u << (intr_info & INTR_INFO_VECTOR_MASK));
         case EXIT_REASON_EXTERNAL_INTERRUPT:
-                return 0;
+                return false;
         case EXIT_REASON_TRIPLE_FAULT:
-                return 1;
+                return true;
         case EXIT_REASON_PENDING_INTERRUPT:
                 return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_INTR_PENDING);
         case EXIT_REASON_NMI_WINDOW:
                 return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING);
         case EXIT_REASON_TASK_SWITCH:
-                return 1;
+                return true;
         case EXIT_REASON_CPUID:
                 if (kvm_register_read(vcpu, VCPU_REGS_RAX) == 0xa)
-                        return 0;
-                return 1;
+                        return false;
+                return true;
         case EXIT_REASON_HLT:
                 return nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING);
         case EXIT_REASON_INVD:
-                return 1;
+                return true;
         case EXIT_REASON_INVLPG:
                 return nested_cpu_has(vmcs12, CPU_BASED_INVLPG_EXITING);
         case EXIT_REASON_RDPMC:
                 return nested_cpu_has(vmcs12, CPU_BASED_RDPMC_EXITING);
-        case EXIT_REASON_RDTSC:
+        case EXIT_REASON_RDTSC: case EXIT_REASON_RDTSCP:
                 return nested_cpu_has(vmcs12, CPU_BASED_RDTSC_EXITING);
         case EXIT_REASON_VMCALL: case EXIT_REASON_VMCLEAR:
         case EXIT_REASON_VMLAUNCH: case EXIT_REASON_VMPTRLD:
@@ -7521,7 +7523,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                  * VMX instructions trap unconditionally. This allows L1 to
                  * emulate them for its L2 guest, i.e., allows 3-level nesting!
                  */
-                return 1;
+                return true;
         case EXIT_REASON_CR_ACCESS:
                 return nested_vmx_exit_handled_cr(vcpu, vmcs12);
         case EXIT_REASON_DR_ACCESS:
@@ -7532,7 +7534,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
         case EXIT_REASON_MSR_WRITE:
                 return nested_vmx_exit_handled_msr(vcpu, vmcs12, exit_reason);
         case EXIT_REASON_INVALID_STATE:
-                return 1;
+                return true;
         case EXIT_REASON_MWAIT_INSTRUCTION:
                 return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING);
         case EXIT_REASON_MONITOR_INSTRUCTION:
@@ -7542,7 +7544,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                         nested_cpu_has2(vmcs12,
                                 SECONDARY_EXEC_PAUSE_LOOP_EXITING);
         case EXIT_REASON_MCE_DURING_VMENTRY:
-                return 0;
+                return false;
         case EXIT_REASON_TPR_BELOW_THRESHOLD:
                 return nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW);
         case EXIT_REASON_APIC_ACCESS:
@@ -7551,7 +7553,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
         case EXIT_REASON_APIC_WRITE:
         case EXIT_REASON_EOI_INDUCED:
                 /* apic_write and eoi_induced should exit unconditionally. */
-                return 1;
+                return true;
         case EXIT_REASON_EPT_VIOLATION:
                 /*
                  * L0 always deals with the EPT violation. If nested EPT is
@@ -7559,7 +7561,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                  * missing in the guest EPT table (EPT12), the EPT violation
                  * will be injected with nested_ept_inject_page_fault()
                  */
-                return 0;
+                return false;
         case EXIT_REASON_EPT_MISCONFIG:
                 /*
                  * L2 never uses directly L1's EPT, but rather L0's own EPT
@@ -7567,11 +7569,11 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                  * (EPT on EPT). So any problems with the structure of the
                  * table is L0's fault.
                  */
-                return 0;
+                return false;
         case EXIT_REASON_WBINVD:
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_WBINVD_EXITING);
         case EXIT_REASON_XSETBV:
-                return 1;
+                return true;
         case EXIT_REASON_XSAVES: case EXIT_REASON_XRSTORS:
                 /*
                  * This should never happen, since it is not possible to
@@ -7581,7 +7583,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                  */
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
         default:
-                return 1;
+                return true;
         }
 }
 
@@ -8516,6 +8518,9 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
                                                 exec_control);
                         }
                 }
+                if (nested && !vmx->rdtscp_enabled)
+                        vmx->nested.nested_vmx_secondary_ctls_high &=
+                                ~SECONDARY_EXEC_RDTSCP;
         }
 
         /* Exposing INVPCID only when PCID is exposed */
@@ -9145,8 +9150,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                         exec_control &= ~SECONDARY_EXEC_RDTSCP;
                 /* Take the following fields only from vmcs12 */
                 exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+                                  SECONDARY_EXEC_RDTSCP |
                                   SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
-                                  SECONDARY_EXEC_APIC_REGISTER_VIRT);
+                                  SECONDARY_EXEC_APIC_REGISTER_VIRT);
                 if (nested_cpu_has(vmcs12,
                                 CPU_BASED_ACTIVATE_SECONDARY_CONTROLS))
                         exec_control |= vmcs12->secondary_vm_exec_control;
@@ -9518,7 +9524,7 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
         vmcs12->launch_state = 1;
 
         if (vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT)
-                return kvm_emulate_halt(vcpu);
+                return kvm_vcpu_halt(vcpu);
 
         vmx->nested.nested_run_pending = 1;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5573d633144c..a284c927551e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4477,7 +4477,8 @@ mmio:
         return X86EMUL_CONTINUE;
 }
 
-int emulator_read_write(struct x86_emulate_ctxt *ctxt, unsigned long addr,
+static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
+                        unsigned long addr,
                         void *val, unsigned int bytes,
                         struct x86_exception *exception,
                         const struct read_write_emulator_ops *ops)
@@ -4540,7 +4541,7 @@ static int emulator_read_emulated(struct x86_emulate_ctxt *ctxt,
                                    exception, &read_emultor);
 }
 
-int emulator_write_emulated(struct x86_emulate_ctxt *ctxt,
+static int emulator_write_emulated(struct x86_emulate_ctxt *ctxt,
                             unsigned long addr,
                             const void *val,
                             unsigned int bytes,
@@ -4707,7 +4708,7 @@ static void emulator_invlpg(struct x86_emulate_ctxt *ctxt, ulong address)
         kvm_mmu_invlpg(emul_to_vcpu(ctxt), address);
 }
 
-int kvm_emulate_wbinvd(struct kvm_vcpu *vcpu)
+int kvm_emulate_wbinvd_noskip(struct kvm_vcpu *vcpu)
 {
         if (!need_emulate_wbinvd(vcpu))
                 return X86EMUL_CONTINUE;
@@ -4724,19 +4725,29 @@ int kvm_emulate_wbinvd(struct kvm_vcpu *vcpu)
                 wbinvd();
         return X86EMUL_CONTINUE;
 }
+
+int kvm_emulate_wbinvd(struct kvm_vcpu *vcpu)
+{
+        kvm_x86_ops->skip_emulated_instruction(vcpu);
+        return kvm_emulate_wbinvd_noskip(vcpu);
+}
 EXPORT_SYMBOL_GPL(kvm_emulate_wbinvd);
 
+
+
 static void emulator_wbinvd(struct x86_emulate_ctxt *ctxt)
 {
-        kvm_emulate_wbinvd(emul_to_vcpu(ctxt));
+        kvm_emulate_wbinvd_noskip(emul_to_vcpu(ctxt));
 }
 
-int emulator_get_dr(struct x86_emulate_ctxt *ctxt, int dr, unsigned long *dest)
+static int emulator_get_dr(struct x86_emulate_ctxt *ctxt, int dr,
+                           unsigned long *dest)
 {
         return kvm_get_dr(emul_to_vcpu(ctxt), dr, dest);
 }
 
-int emulator_set_dr(struct x86_emulate_ctxt *ctxt, int dr, unsigned long value)
+static int emulator_set_dr(struct x86_emulate_ctxt *ctxt, int dr,
+                           unsigned long value)
 {
 
         return __kvm_set_dr(emul_to_vcpu(ctxt), dr, value);
@@ -5818,7 +5829,7 @@ void kvm_arch_exit(void)
         free_percpu(shared_msrs);
 }
 
-int kvm_emulate_halt(struct kvm_vcpu *vcpu)
+int kvm_vcpu_halt(struct kvm_vcpu *vcpu)
 {
         ++vcpu->stat.halt_exits;
         if (irqchip_in_kernel(vcpu->kvm)) {
@@ -5829,6 +5840,13 @@ int kvm_emulate_halt(struct kvm_vcpu *vcpu)
                 return 0;
         }
 }
+EXPORT_SYMBOL_GPL(kvm_vcpu_halt);
+
+int kvm_emulate_halt(struct kvm_vcpu *vcpu)
+{
+        kvm_x86_ops->skip_emulated_instruction(vcpu);
+        return kvm_vcpu_halt(vcpu);
+}
 EXPORT_SYMBOL_GPL(kvm_emulate_halt);
 
 int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
@@ -5905,7 +5923,7 @@ static void kvm_pv_kick_cpu_op(struct kvm *kvm, unsigned long flags, int apicid)
         lapic_irq.dest_id = apicid;
 
         lapic_irq.delivery_mode = APIC_DM_REMRD;
-        kvm_irq_delivery_to_apic(kvm, 0, &lapic_irq, NULL);
+        kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL);
 }
 
 int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
@@ -5913,6 +5931,8 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
         unsigned long nr, a0, a1, a2, a3, ret;
         int op_64_bit, r = 1;
 
+        kvm_x86_ops->skip_emulated_instruction(vcpu);
+
         if (kvm_hv_hypercall_enabled(vcpu->kvm))
                 return kvm_hv_hypercall(vcpu);
 
@@ -7430,7 +7450,7 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
 
         for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
                 if (!dont || free->arch.rmap[i] != dont->arch.rmap[i]) {
-                        kvm_kvfree(free->arch.rmap[i]);
+                        kvfree(free->arch.rmap[i]);
                         free->arch.rmap[i] = NULL;
                 }
                 if (i == 0)
@@ -7438,7 +7458,7 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
 
                 if (!dont || free->arch.lpage_info[i - 1] !=
                              dont->arch.lpage_info[i - 1]) {
-                        kvm_kvfree(free->arch.lpage_info[i - 1]);
+                        kvfree(free->arch.lpage_info[i - 1]);
                         free->arch.lpage_info[i - 1] = NULL;
                 }
         }
@@ -7492,12 +7512,12 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
 
 out_free:
         for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
-                kvm_kvfree(slot->arch.rmap[i]);
+                kvfree(slot->arch.rmap[i]);
                 slot->arch.rmap[i] = NULL;
                 if (i == 0)
                         continue;
 
-                kvm_kvfree(slot->arch.lpage_info[i - 1]);
+                kvfree(slot->arch.lpage_info[i - 1]);
                 slot->arch.lpage_info[i - 1] = NULL;
         }
         return -ENOMEM;
diff --git a/arch/x86/lguest/Kconfig b/arch/x86/lguest/Kconfig
index 4a0890f815c4..08f41caada45 100644
--- a/arch/x86/lguest/Kconfig
+++ b/arch/x86/lguest/Kconfig
@@ -1,6 +1,6 @@
 config LGUEST_GUEST
         bool "Lguest guest support"
-        depends on X86_32 && PARAVIRT
+        depends on X86_32 && PARAVIRT && PCI
         select TTY
         select VIRTUALIZATION
         select VIRTIO
@@ -8,7 +8,7 @@ config LGUEST_GUEST
         help
           Lguest is a tiny in-kernel hypervisor.  Selecting this will
           allow your kernel to boot under lguest.  This option will increase
-          your kernel size by about 6k.  If in doubt, say N.
+          your kernel size by about 10k.  If in doubt, say N.
 
           If you say Y here, make sure you say Y (or M) to the virtio block
           and net drivers which lguest needs.
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 6ac273832f28..e4695985f9de 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -331,7 +331,7 @@ static void probe_pci_root_info(struct pci_root_info *info,
                                 struct list_head *list)
 {
         int ret;
-        struct resource_entry *entry;
+        struct resource_entry *entry, *tmp;
 
         sprintf(info->name, "PCI Bus %04x:%02x", domain, busnum);
         info->bridge = device;
@@ -345,8 +345,13 @@ static void probe_pci_root_info(struct pci_root_info *info,
                 dev_dbg(&device->dev,
                         "no IO and memory resources present in _CRS\n");
         else
-                resource_list_for_each_entry(entry, list)
-                        entry->res->name = info->name;
+                resource_list_for_each_entry_safe(entry, tmp, list) {
+                        if ((entry->res->flags & IORESOURCE_WINDOW) == 0 ||
+                            (entry->res->flags & IORESOURCE_DISABLED))
+                                resource_list_destroy_entry(entry);
+                        else
+                                entry->res->name = info->name;
+                }
 }
 
 struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
index 1bbedc4b0f88..3005f0c89f2e 100644
--- a/arch/x86/platform/intel-mid/intel-mid.c
+++ b/arch/x86/platform/intel-mid/intel-mid.c
@@ -130,7 +130,7 @@ static void intel_mid_arch_setup(void)
                 intel_mid_ops = get_intel_mid_ops[__intel_mid_cpu_chip]();
         else {
                 intel_mid_ops = get_intel_mid_ops[INTEL_MID_CPU_CHIP_PENWELL]();
-                pr_info("ARCH: Uknown SoC, assuming PENWELL!\n");
+                pr_info("ARCH: Unknown SoC, assuming PENWELL!\n");
         }
 
 out:
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index 9793322751e0..30933760ee5f 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -82,18 +82,15 @@ static notrace cycle_t vread_pvclock(int *mode)
         cycle_t ret;
         u64 last;
         u32 version;
+        u32 migrate_count;
         u8 flags;
         unsigned cpu, cpu1;
 
 
         /*
-         * Note: hypervisor must guarantee that:
-         * 1. cpu ID number maps 1:1 to per-CPU pvclock time info.
-         * 2. that per-CPU pvclock time info is updated if the
-         *    underlying CPU changes.
-         * 3. that version is increased whenever underlying CPU
-         *    changes.
-         *
+         * When looping to get a consistent (time-info, tsc) pair, we
+         * also need to deal with the possibility we can switch vcpus,
+         * so make sure we always re-fetch time-info for the current vcpu.
          */
         do {
                 cpu = __getcpu() & VGETCPU_CPU_MASK;
@@ -104,6 +101,8 @@ static notrace cycle_t vread_pvclock(int *mode)
 
                 pvti = get_pvti(cpu);
 
+                migrate_count = pvti->migrate_count;
+
                 version = __pvclock_read_cycles(&pvti->pvti, &ret, &flags);
 
                 /*
@@ -115,7 +114,8 @@ static notrace cycle_t vread_pvclock(int *mode)
                 cpu1 = __getcpu() & VGETCPU_CPU_MASK;
         } while (unlikely(cpu != cpu1 ||
                           (pvti->pvti.version & 1) ||
-                          pvti->pvti.version != version));
+                          pvti->pvti.version != version ||
+                          pvti->migrate_count != migrate_count));
 
         if (unlikely(!(flags & PVCLOCK_TSC_STABLE_BIT)))
                 *mode = VCLOCK_NONE;
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index bd8b8459c3d0..5240f563076d 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1070,6 +1070,23 @@ static inline void xen_write_cr8(unsigned long val)
         BUG_ON(val);
 }
 #endif
+
+static u64 xen_read_msr_safe(unsigned int msr, int *err)
+{
+        u64 val;
+
+        val = native_read_msr_safe(msr, err);
+        switch (msr) {
+        case MSR_IA32_APICBASE:
+#ifdef CONFIG_X86_X2APIC
+                if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+#endif
+                        val &= ~X2APIC_ENABLE;
+                break;
+        }
+        return val;
+}
+
 static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
 {
         int ret;
@@ -1240,7 +1257,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
 
         .wbinvd = native_wbinvd,
 
-        .read_msr = native_read_msr_safe,
+        .read_msr = xen_read_msr_safe,
         .write_msr = xen_write_msr_safe,
 
         .read_tsc = native_read_tsc,
@@ -1741,6 +1758,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
 #ifdef CONFIG_X86_32
         i386_start_kernel();
 #else
+        cr4_init_shadow(); /* 32b kernel does this in i386_start_kernel() */
         x86_64_start_reservations((char *)__pa_symbol(&boot_params));
 #endif
 }
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index c723668e3e27..5589a6e2a023 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -42,8 +42,10 @@ static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io)
          * CHECKME: len might be required to check versus a minimum
          * length as well. 1 for io is fine, but for memory it does
          * not make any sense at all.
+         * Note: some BIOSes report incorrect length for ACPI address space
+         * descriptor, so remove check of 'reslen == len' to avoid regression.
          */
-        if (len && reslen && reslen == len && start <= end)
+        if (len && reslen && start <= end)
                 return true;
 
         pr_debug("ACPI: invalid or unassigned resource %s [%016llx - %016llx] length [%016llx]\n",
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index debd30917010..26eb70c8f518 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -2110,7 +2110,8 @@ static int __init intel_opregion_present(void)
 
 int acpi_video_register(void)
 {
-        int result = 0;
+        int ret;
+
         if (register_count) {
                 /*
                  * if the function of acpi_video_register is already called,
@@ -2122,9 +2123,9 @@ int acpi_video_register(void)
         mutex_init(&video_list_lock);
         INIT_LIST_HEAD(&video_bus_head);
 
-        result = acpi_bus_register_driver(&acpi_video_bus);
-        if (result < 0)
-                return -ENODEV;
+        ret = acpi_bus_register_driver(&acpi_video_bus);
+        if (ret)
+                return ret;
 
         /*
          * When the acpi_video_bus is loaded successfully, increase
@@ -2176,6 +2177,17 @@ EXPORT_SYMBOL(acpi_video_unregister_backlight);
 
 static int __init acpi_video_init(void)
 {
+        /*
+         * Let the module load even if ACPI is disabled (e.g. due to
+         * a broken BIOS) so that i915.ko can still be loaded on such
+         * old systems without an AcpiOpRegion.
+         *
+         * acpi_video_register() will report -ENODEV later as well due
+         * to acpi_disabled when i915.ko tries to register itself afterwards.
+         */
+        if (acpi_disabled)
+                return 0;
+
         dmi_check_system(video_dmi_table);
 
         if (intel_opregion_present())
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 33b09b6568a4..6607f3c6ace1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
 {
         void *page_addr;
         unsigned long user_page_addr;
-        struct vm_struct tmp_area;
         struct page **page;
         struct mm_struct *mm;
 
@@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
                                 proc->pid, page_addr);
                         goto err_alloc_page_failed;
                 }
-                tmp_area.addr = page_addr;
-                tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
-                ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
-                if (ret) {
+                ret = map_kernel_range_noflush((unsigned long)page_addr,
+                                        PAGE_SIZE, PAGE_KERNEL, page);
+                flush_cache_vmap((unsigned long)page_addr,
+                                (unsigned long)page_addr + PAGE_SIZE);
+                if (ret != 1) {
                         pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
                                proc->pid, page_addr);
                         goto err_map_kernel_failed;
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index f9054cd36a72..5389579c5120 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -869,6 +869,8 @@ try_offline_again:
          */
         ata_msleep(ap, 1);
 
+        sata_set_spd(link);
+
         /*
          * Now, bring the host controller online again, this can take time
          * as PHY reset and communication establishment, 1st D2H FIS and
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index ba4abbe4693c..45937f88e77c 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -2242,7 +2242,7 @@ static void rtpm_status_str(struct seq_file *s, struct device *dev)
 }
 
 static int pm_genpd_summary_one(struct seq_file *s,
-                struct generic_pm_domain *gpd)
+                                struct generic_pm_domain *genpd)
 {
         static const char * const status_lookup[] = {
                 [GPD_STATE_ACTIVE] = "on",
@@ -2256,26 +2256,26 @@ static int pm_genpd_summary_one(struct seq_file *s,
         struct gpd_link *link;
         int ret;
 
-        ret = mutex_lock_interruptible(&gpd->lock);
+        ret = mutex_lock_interruptible(&genpd->lock);
         if (ret)
                 return -ERESTARTSYS;
 
-        if (WARN_ON(gpd->status >= ARRAY_SIZE(status_lookup)))
+        if (WARN_ON(genpd->status >= ARRAY_SIZE(status_lookup)))
                 goto exit;
-        seq_printf(s, "%-30s  %-15s  ", gpd->name, status_lookup[gpd->status]);
+        seq_printf(s, "%-30s  %-15s  ", genpd->name, status_lookup[genpd->status]);
 
         /*
          * Modifications on the list require holding locks on both
          * master and slave, so we are safe.
-         * Also gpd->name is immutable.
+         * Also genpd->name is immutable.
          */
-        list_for_each_entry(link, &gpd->master_links, master_node) {
+        list_for_each_entry(link, &genpd->master_links, master_node) {
                 seq_printf(s, "%s", link->slave->name);
-                if (!list_is_last(&link->master_node, &gpd->master_links))
+                if (!list_is_last(&link->master_node, &genpd->master_links))
                         seq_puts(s, ", ");
         }
 
-        list_for_each_entry(pm_data, &gpd->dev_list, list_node) {
+        list_for_each_entry(pm_data, &genpd->dev_list, list_node) {
                 kobj_path = kobject_get_path(&pm_data->dev->kobj, GFP_KERNEL);
                 if (kobj_path == NULL)
                         continue;
@@ -2287,14 +2287,14 @@ static int pm_genpd_summary_one(struct seq_file *s,
 
         seq_puts(s, "\n");
 exit:
-        mutex_unlock(&gpd->lock);
+        mutex_unlock(&genpd->lock);
 
         return 0;
 }
 
 static int pm_genpd_summary_show(struct seq_file *s, void *data)
 {
-        struct generic_pm_domain *gpd;
+        struct generic_pm_domain *genpd;
         int ret = 0;
 
         seq_puts(s, "    domain                      status         slaves\n");
@@ -2305,8 +2305,8 @@ static int pm_genpd_summary_show(struct seq_file *s, void *data)
         if (ret)
                 return -ERESTARTSYS;
 
-        list_for_each_entry(gpd, &gpd_list, gpd_list_node) {
-                ret = pm_genpd_summary_one(s, gpd);
+        list_for_each_entry(genpd, &gpd_list, gpd_list_node) {
+                ret = pm_genpd_summary_one(s, genpd);
                 if (ret)
                         break;
         }
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index c2744b30d5d9..aab7158d2afe 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -730,6 +730,7 @@ void pm_system_wakeup(void)
         pm_abort_suspend = true;
         freeze_wake();
 }
+EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
 void pm_wakeup_clear(void)
 {
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index b64bccbb78c9..ceb32dd52a6c 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -482,6 +482,7 @@ static int nvme_error_status(u16 status)
         }
 }
 
+#ifdef CONFIG_BLK_DEV_INTEGRITY
 static void nvme_dif_prep(u32 p, u32 v, struct t10_pi_tuple *pi)
 {
         if (be32_to_cpu(pi->ref_tag) == v)
@@ -538,6 +539,58 @@ static void nvme_dif_remap(struct request *req,
         kunmap_atomic(pmap);
 }
 
+static int nvme_noop_verify(struct blk_integrity_iter *iter)
+{
+        return 0;
+}
+
+static int nvme_noop_generate(struct blk_integrity_iter *iter)
+{
+        return 0;
+}
+
+struct blk_integrity nvme_meta_noop = {
+        .name                   = "NVME_META_NOOP",
+        .generate_fn            = nvme_noop_generate,
+        .verify_fn              = nvme_noop_verify,
+};
+
+static void nvme_init_integrity(struct nvme_ns *ns)
+{
+        struct blk_integrity integrity;
+
+        switch (ns->pi_type) {
+        case NVME_NS_DPS_PI_TYPE3:
+                integrity = t10_pi_type3_crc;
+                break;
+        case NVME_NS_DPS_PI_TYPE1:
+        case NVME_NS_DPS_PI_TYPE2:
+                integrity = t10_pi_type1_crc;
+                break;
+        default:
+                integrity = nvme_meta_noop;
+                break;
+        }
+        integrity.tuple_size = ns->ms;
+        blk_integrity_register(ns->disk, &integrity);
+        blk_queue_max_integrity_segments(ns->queue, 1);
+}
+#else /* CONFIG_BLK_DEV_INTEGRITY */
+static void nvme_dif_remap(struct request *req,
+                        void (*dif_swap)(u32 p, u32 v, struct t10_pi_tuple *pi))
+{
+}
+static void nvme_dif_prep(u32 p, u32 v, struct t10_pi_tuple *pi)
+{
+}
+static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
+{
+}
+static void nvme_init_integrity(struct nvme_ns *ns)
+{
+}
+#endif
+
 static void req_completion(struct nvme_queue *nvmeq, void *ctx,
                                                 struct nvme_completion *cqe)
 {
@@ -1959,43 +2012,6 @@ static void nvme_config_discard(struct nvme_ns *ns)
         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, ns->queue);
 }
 
-static int nvme_noop_verify(struct blk_integrity_iter *iter)
-{
-        return 0;
-}
-
-static int nvme_noop_generate(struct blk_integrity_iter *iter)
-{
-        return 0;
-}
-
-struct blk_integrity nvme_meta_noop = {
-        .name                   = "NVME_META_NOOP",
-        .generate_fn            = nvme_noop_generate,
-        .verify_fn              = nvme_noop_verify,
-};
-
-static void nvme_init_integrity(struct nvme_ns *ns)
-{
-        struct blk_integrity integrity;
-
-        switch (ns->pi_type) {
-        case NVME_NS_DPS_PI_TYPE3:
-                integrity = t10_pi_type3_crc;
-                break;
-        case NVME_NS_DPS_PI_TYPE1:
-        case NVME_NS_DPS_PI_TYPE2:
-                integrity = t10_pi_type1_crc;
-                break;
-        default:
-                integrity = nvme_meta_noop;
-                break;
-        }
-        integrity.tuple_size = ns->ms;
-        blk_integrity_register(ns->disk, &integrity);
-        blk_queue_max_integrity_segments(ns->queue, 1);
-}
-
 static int nvme_revalidate_disk(struct gendisk *disk)
 {
         struct nvme_ns *ns = disk->private_data;
@@ -2036,7 +2052,8 @@ static int nvme_revalidate_disk(struct gendisk *disk)
         pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
                                         id->dps & NVME_NS_DPS_PI_MASK : 0;
 
-        if (disk->integrity && (ns->pi_type != pi_type || ns->ms != old_ms ||
+        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
+                                ns->ms != old_ms ||
                                 bs != queue_logical_block_size(disk->queue) ||
                                 (ns->ms && id->flbas & NVME_NS_FLBAS_META_EXT)))
                 blk_integrity_unregister(disk);
@@ -2044,11 +2061,11 @@ static int nvme_revalidate_disk(struct gendisk *disk)
         ns->pi_type = pi_type;
         blk_queue_logical_block_size(ns->queue, bs);
 
-        if (ns->ms && !disk->integrity && (disk->flags & GENHD_FL_UP) &&
+        if (ns->ms && !blk_get_integrity(disk) && (disk->flags & GENHD_FL_UP) &&
                                 !(id->flbas & NVME_NS_FLBAS_META_EXT))
                 nvme_init_integrity(ns);
 
-        if (id->ncap == 0 || (ns->ms && !disk->integrity))
+        if (id->ncap == 0 || (ns->ms && !blk_get_integrity(disk)))
                 set_capacity(disk, 0);
         else
                 set_capacity(disk, le64_to_cpup(&id->nsze) << (ns->lba_shift - 9));
@@ -2652,7 +2669,7 @@ static void nvme_dev_remove(struct nvme_dev *dev)
 
         list_for_each_entry(ns, &dev->namespaces, list) {
                 if (ns->disk->flags & GENHD_FL_UP) {
-                        if (ns->disk->integrity)
+                        if (blk_get_integrity(ns->disk))
                                 blk_integrity_unregister(ns->disk);
                         del_gendisk(ns->disk);
                 }
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 8e233edd7a09..871bd3550cb0 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -528,7 +528,7 @@ out_cleanup:
 static inline void update_used_max(struct zram *zram,
                                         const unsigned long pages)
 {
-        int old_max, cur_max;
+        unsigned long old_max, cur_max;
 
         old_max = atomic_long_read(&zram->stats.max_used_pages);
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b87688881143..8bfc4c2bba87 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -272,6 +272,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 
         /* Intel Bluetooth devices */
+        { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 1d278ccd751f..e096e9cddb40 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -140,24 +140,24 @@ static int tpm_dev_add_device(struct tpm_chip *chip)
 {
         int rc;
 
-        rc = device_add(&chip->dev);
+        rc = cdev_add(&chip->cdev, chip->dev.devt, 1);
         if (rc) {
                 dev_err(&chip->dev,
-                        "unable to device_register() %s, major %d, minor %d, err=%d\n",
+                        "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
                         chip->devname, MAJOR(chip->dev.devt),
                         MINOR(chip->dev.devt), rc);
 
+                device_unregister(&chip->dev);
                 return rc;
         }
 
-        rc = cdev_add(&chip->cdev, chip->dev.devt, 1);
+        rc = device_add(&chip->dev);
         if (rc) {
                 dev_err(&chip->dev,
-                        "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
+                        "unable to device_register() %s, major %d, minor %d, err=%d\n",
                         chip->devname, MAJOR(chip->dev.devt),
                         MINOR(chip->dev.devt), rc);
 
-                device_unregister(&chip->dev);
                 return rc;
         }
 
@@ -174,27 +174,17 @@ static void tpm_dev_del_device(struct tpm_chip *chip)
  * tpm_chip_register() - create a character device for the TPM chip
  * @chip: TPM chip to use.
  *
- * Creates a character device for the TPM chip and adds sysfs interfaces for
- * the device, PPI and TCPA. As the last step this function adds the
- * chip to the list of TPM chips available for use.
+ * Creates a character device for the TPM chip and adds sysfs attributes for
+ * the device. As the last step this function adds the chip to the list of TPM
+ * chips available for in-kernel use.
  *
- * NOTE: This function should be only called after the chip initialization
- * is complete.
- *
- * Called from tpm_<specific>.c probe function only for devices
- * the driver has determined it should claim.  Prior to calling
- * this function the specific probe function has called pci_enable_device
- * upon errant exit from this function specific probe function should call
- * pci_disable_device
+ * This function should be only called after the chip initialization is
+ * complete.
  */
 int tpm_chip_register(struct tpm_chip *chip)
 {
         int rc;
 
-        rc = tpm_dev_add_device(chip);
-        if (rc)
-                return rc;
-
         /* Populate sysfs for TPM1 devices. */
         if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
                 rc = tpm_sysfs_add_device(chip);
@@ -208,6 +198,10 @@ int tpm_chip_register(struct tpm_chip *chip)
                 chip->bios_dir = tpm_bios_log_setup(chip->devname);
         }
 
+        rc = tpm_dev_add_device(chip);
+        if (rc)
+                return rc;
+
         /* Make the chip available. */
         spin_lock(&driver_lock);
         list_add_rcu(&chip->list, &tpm_chip_list);
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index b1e53e3aece5..42ffa5e7a1e0 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         struct ibmvtpm_dev *ibmvtpm;
         struct ibmvtpm_crq crq;
-        u64 *word = (u64 *) &crq;
+        __be64 *word = (__be64 *)&crq;
         int rc;
 
         ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
         memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
         crq.valid = (u8)IBMVTPM_VALID_CMD;
         crq.msg = (u8)VTPM_TPM_COMMAND;
-        crq.len = (u16)count;
-        crq.data = ibmvtpm->rtce_dma_handle;
+        crq.len = cpu_to_be16(count);
+        crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
-                              cpu_to_be64(word[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
+                              be64_to_cpu(word[1]));
         if (rc != H_SUCCESS) {
                 dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
                 rc = 0;
diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
index f595f14426bf..6af92890518f 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.h
+++ b/drivers/char/tpm/tpm_ibmvtpm.h
@@ -22,9 +22,9 @@
 struct ibmvtpm_crq {
         u8 valid;
         u8 msg;
-        u16 len;
-        u32 data;
-        u64 reserved;
+        __be16 len;
+        __be32 data;
+        __be64 reserved;
 } __attribute__((packed, aligned(8)));
 
 struct ibmvtpm_crq_queue {
diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c
index f07c8152e5cc..3f27d21fb729 100644
--- a/drivers/clk/at91/pmc.c
+++ b/drivers/clk/at91/pmc.c
@@ -89,12 +89,29 @@ static int pmc_irq_set_type(struct irq_data *d, unsigned type)
         return 0;
 }
 
+static void pmc_irq_suspend(struct irq_data *d)
+{
+        struct at91_pmc *pmc = irq_data_get_irq_chip_data(d);
+
+        pmc->imr = pmc_read(pmc, AT91_PMC_IMR);
+        pmc_write(pmc, AT91_PMC_IDR, pmc->imr);
+}
+
+static void pmc_irq_resume(struct irq_data *d)
+{
+        struct at91_pmc *pmc = irq_data_get_irq_chip_data(d);
+
+        pmc_write(pmc, AT91_PMC_IER, pmc->imr);
+}
+
 static struct irq_chip pmc_irq = {
         .name = "PMC",
         .irq_disable = pmc_irq_mask,
         .irq_mask = pmc_irq_mask,
         .irq_unmask = pmc_irq_unmask,
         .irq_set_type = pmc_irq_set_type,
+        .irq_suspend = pmc_irq_suspend,
+        .irq_resume = pmc_irq_resume,
 };
 
 static struct lock_class_key pmc_lock_class;
@@ -224,7 +241,8 @@ static struct at91_pmc *__init at91_pmc_init(struct device_node *np,
                 goto out_free_pmc;
 
         pmc_write(pmc, AT91_PMC_IDR, 0xffffffff);
-        if (request_irq(pmc->virq, pmc_irq_handler, IRQF_SHARED, "pmc", pmc))
+        if (request_irq(pmc->virq, pmc_irq_handler,
+                        IRQF_SHARED | IRQF_COND_SUSPEND, "pmc", pmc))
                 goto out_remove_irqdomain;
 
         return pmc;
diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
index 52d2041fa3f6..69abb08cf146 100644
--- a/drivers/clk/at91/pmc.h
+++ b/drivers/clk/at91/pmc.h
@@ -33,6 +33,7 @@ struct at91_pmc {
         spinlock_t lock;
         const struct at91_pmc_caps *caps;
         struct irq_domain *irqdomain;
+        u32 imr;
 };
 
 static inline void pmc_lock(struct at91_pmc *pmc)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 1c2506f68122..68161f7a07d6 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -63,6 +63,11 @@ config VT8500_TIMER
 config CADENCE_TTC_TIMER
         bool
 
+config ASM9260_TIMER
+        bool
+        select CLKSRC_MMIO
+        select CLKSRC_OF
+
 config CLKSRC_NOMADIK_MTU
         bool
         depends on (ARCH_NOMADIK || ARCH_U8500)
@@ -245,15 +250,4 @@ config CLKSRC_PXA
         help
           This enables OST0 support available on PXA and SA-11x0
           platforms.
-
-config ASM9260_TIMER
-        bool "Alphascale ASM9260 timer driver"
-        depends on GENERIC_CLOCKEVENTS
-        select CLKSRC_MMIO
-        select CLKSRC_OF
-        default y if MACH_ASM9260
-        help
-          This enables build of a clocksource and clockevent driver for
-          the 32-bit System Timer hardware available on a Alphascale ASM9260.
-
 endmenu
diff --git a/drivers/clocksource/mtk_timer.c b/drivers/clocksource/mtk_timer.c
index 32a3d25795d3..68ab42356d0e 100644
--- a/drivers/clocksource/mtk_timer.c
+++ b/drivers/clocksource/mtk_timer.c
@@ -224,6 +224,8 @@ static void __init mtk_timer_init(struct device_node *node)
         }
         rate = clk_get_rate(clk);
 
+        mtk_timer_global_reset(evt);
+
         if (request_irq(evt->dev.irq, mtk_timer_interrupt,
                         IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) {
                 pr_warn("failed to setup irq %d\n", evt->dev.irq);
@@ -232,8 +234,6 @@ static void __init mtk_timer_init(struct device_node *node)
 
         evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-        mtk_timer_global_reset(evt);
-
         /* Configure clock source */
         mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN);
         clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC),
@@ -241,10 +241,11 @@ static void __init mtk_timer_init(struct device_node *node)
 
         /* Configure clock event */
         mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT);
-        mtk_timer_enable_irq(evt, GPT_CLK_EVT);
-
         clockevents_config_and_register(&evt->dev, rate, 0x3,
                                         0xffffffff);
+
+        mtk_timer_enable_irq(evt, GPT_CLK_EVT);
+
         return;
 
 err_clk_disable:
diff --git a/drivers/clocksource/pxa_timer.c b/drivers/clocksource/pxa_timer.c
index 941f3f344e08..d9438af2bbd6 100644
--- a/drivers/clocksource/pxa_timer.c
+++ b/drivers/clocksource/pxa_timer.c
@@ -163,7 +163,7 @@ static struct irqaction pxa_ost0_irq = {
         .dev_id         = &ckevt_pxa_osmr0,
 };
 
-static void pxa_timer_common_init(int irq, unsigned long clock_tick_rate)
+static void __init pxa_timer_common_init(int irq, unsigned long clock_tick_rate)
 {
         timer_writel(0, OIER);
         timer_writel(OSSR_M0 | OSSR_M1 | OSSR_M2 | OSSR_M3, OSSR);
diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
index 5e98c6b1f284..82d2fbb20f7e 100644
--- a/drivers/cpufreq/exynos-cpufreq.c
+++ b/drivers/cpufreq/exynos-cpufreq.c
@@ -159,7 +159,7 @@ static struct cpufreq_driver exynos_driver = {
 
 static int exynos_cpufreq_probe(struct platform_device *pdev)
 {
-        struct device_node *cpus, *np;
+        struct device_node *cpu0;
         int ret = -EINVAL;
 
         exynos_info = kzalloc(sizeof(*exynos_info), GFP_KERNEL);
@@ -206,28 +206,19 @@ static int exynos_cpufreq_probe(struct platform_device *pdev)
         if (ret)
                 goto err_cpufreq_reg;
 
-        cpus = of_find_node_by_path("/cpus");
-        if (!cpus) {
-                pr_err("failed to find cpus node\n");
+        cpu0 = of_get_cpu_node(0, NULL);
+        if (!cpu0) {
+                pr_err("failed to find cpu0 node\n");
                 return 0;
         }
 
-        np = of_get_next_child(cpus, NULL);
-        if (!np) {
-                pr_err("failed to find cpus child node\n");
-                of_node_put(cpus);
-                return 0;
-        }
-
-        if (of_find_property(np, "#cooling-cells", NULL)) {
-                cdev = of_cpufreq_cooling_register(np,
+        if (of_find_property(cpu0, "#cooling-cells", NULL)) {
+                cdev = of_cpufreq_cooling_register(cpu0,
                                                    cpu_present_mask);
                 if (IS_ERR(cdev))
                         pr_err("running cpufreq without cooling device: %ld\n",
                                PTR_ERR(cdev));
         }
-        of_node_put(np);
-        of_node_put(cpus);
 
         return 0;
 
diff --git a/drivers/cpufreq/ppc-corenet-cpufreq.c b/drivers/cpufreq/ppc-corenet-cpufreq.c
index bee5df7794d3..7cb4b766cf94 100644
--- a/drivers/cpufreq/ppc-corenet-cpufreq.c
+++ b/drivers/cpufreq/ppc-corenet-cpufreq.c
@@ -22,6 +22,8 @@
 #include <linux/smp.h>
 #include <sysdev/fsl_soc.h>
 
+#include <asm/smp.h>    /* for get_hard_smp_processor_id() in UP configs */
+
 /**
  * struct cpu_data - per CPU data struct
  * @parent: the parent node of cpu clock
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 4d534582514e..080bd2dbde4b 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -44,6 +44,12 @@ void disable_cpuidle(void)
         off = 1;
 }
 
+bool cpuidle_not_available(struct cpuidle_driver *drv,
+                           struct cpuidle_device *dev)
+{
+        return off || !initialized || !drv || !dev || !dev->enabled;
+}
+
 /**
  * cpuidle_play_dead - cpu off-lining
  *
@@ -66,14 +72,8 @@ int cpuidle_play_dead(void)
         return -ENODEV;
 }
 
-/**
- * cpuidle_find_deepest_state - Find deepest state meeting specific conditions.
- * @drv: cpuidle driver for the given CPU.
- * @dev: cpuidle device for the given CPU.
- * @freeze: Whether or not the state should be suitable for suspend-to-idle.
- */
-static int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
-                                      struct cpuidle_device *dev, bool freeze)
+static int find_deepest_state(struct cpuidle_driver *drv,
+                              struct cpuidle_device *dev, bool freeze)
 {
         unsigned int latency_req = 0;
         int i, ret = freeze ? -1 : CPUIDLE_DRIVER_STATE_START - 1;
@@ -92,6 +92,17 @@ static int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
         return ret;
 }
 
+/**
+ * cpuidle_find_deepest_state - Find the deepest available idle state.
+ * @drv: cpuidle driver for the given CPU.
+ * @dev: cpuidle device for the given CPU.
+ */
+int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                               struct cpuidle_device *dev)
+{
+        return find_deepest_state(drv, dev, false);
+}
+
 static void enter_freeze_proper(struct cpuidle_driver *drv,
                                 struct cpuidle_device *dev, int index)
 {
@@ -113,15 +124,14 @@ static void enter_freeze_proper(struct cpuidle_driver *drv,
 
 /**
  * cpuidle_enter_freeze - Enter an idle state suitable for suspend-to-idle.
+ * @drv: cpuidle driver for the given CPU.
+ * @dev: cpuidle device for the given CPU.
  *
  * If there are states with the ->enter_freeze callback, find the deepest of
- * them and enter it with frozen tick.  Otherwise, find the deepest state
- * available and enter it normally.
+ * them and enter it with frozen tick.
  */
-void cpuidle_enter_freeze(void)
+int cpuidle_enter_freeze(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
-        struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
-        struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
         int index;
 
         /*
@@ -129,24 +139,11 @@ void cpuidle_enter_freeze(void)
          * that interrupts won't be enabled when it exits and allows the tick to
          * be frozen safely.
          */
-        index = cpuidle_find_deepest_state(drv, dev, true);
-        if (index >= 0) {
-                enter_freeze_proper(drv, dev, index);
-                return;
-        }
-
-        /*
-         * It is not safe to freeze the tick, find the deepest state available
-         * at all and try to enter it normally.
-         */
-        index = cpuidle_find_deepest_state(drv, dev, false);
+        index = find_deepest_state(drv, dev, true);
         if (index >= 0)
-                cpuidle_enter(drv, dev, index);
-        else
-                arch_cpu_idle();
+                enter_freeze_proper(drv, dev, index);
 
-        /* Interrupts are enabled again here. */
-        local_irq_disable();
+        return index;
 }
 
 /**
@@ -205,12 +202,6 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
  */
 int cpuidle_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
-        if (off || !initialized)
-                return -ENODEV;
-
-        if (!drv || !dev || !dev->enabled)
-                return -EBUSY;
-
         return cpuidle_curr_governor->select(drv, dev);
 }
 
diff --git a/drivers/dma-buf/fence.c b/drivers/dma-buf/fence.c
index e5541117b3e9..50ef8bd8708b 100644
--- a/drivers/dma-buf/fence.c
+++ b/drivers/dma-buf/fence.c
@@ -159,6 +159,9 @@ fence_wait_timeout(struct fence *fence, bool intr, signed long timeout)
         if (WARN_ON(timeout < 0))
                 return -EINVAL;
 
+        if (timeout == 0)
+                return fence_is_signaled(fence);
+
         trace_fence_wait_start(fence);
         ret = fence->ops->wait(fence, intr, timeout);
         trace_fence_wait_end(fence);
diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index 3c97c8fa8d02..39920d77f288 100644
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -327,6 +327,9 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
         unsigned seq, shared_count, i = 0;
         long ret = timeout;
 
+        if (!timeout)
+                return reservation_object_test_signaled_rcu(obj, wait_all);
+
 retry:
         fence = NULL;
         shared_count = 0;
@@ -402,8 +405,6 @@ reservation_object_test_signaled_single(struct fence *passed_fence)
         int ret = 1;
 
         if (!test_bit(FENCE_FLAG_SIGNALED_BIT, &lfence->flags)) {
-                int ret;
-
                 fence = fence_get_rcu(lfence);
                 if (!fence)
                         return -1;
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 09e2825a547a..d9891d3461f6 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -664,7 +664,6 @@ at_xdmac_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
         struct at_xdmac_desc    *first = NULL, *prev = NULL;
         unsigned int            periods = buf_len / period_len;
         int                     i;
-        u32                     cfg;
 
         dev_dbg(chan2dev(chan), "%s: buf_addr=%pad, buf_len=%zd, period_len=%zd, dir=%s, flags=0x%lx\n",
                 __func__, &buf_addr, buf_len, period_len,
@@ -700,17 +699,17 @@ at_xdmac_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr,
                 if (direction == DMA_DEV_TO_MEM) {
                         desc->lld.mbr_sa = atchan->per_src_addr;
                         desc->lld.mbr_da = buf_addr + i * period_len;
-                        cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
+                        desc->lld.mbr_cfg = atchan->cfg[AT_XDMAC_DEV_TO_MEM_CFG];
                 } else {
                         desc->lld.mbr_sa = buf_addr + i * period_len;
                         desc->lld.mbr_da = atchan->per_dst_addr;
-                        cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
+                        desc->lld.mbr_cfg = atchan->cfg[AT_XDMAC_MEM_TO_DEV_CFG];
                 }
                 desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV1
                         | AT_XDMAC_MBR_UBC_NDEN
                         | AT_XDMAC_MBR_UBC_NSEN
                         | AT_XDMAC_MBR_UBC_NDE
-                        | period_len >> at_xdmac_get_dwidth(cfg);
+                        | period_len >> at_xdmac_get_dwidth(desc->lld.mbr_cfg);
 
                 dev_dbg(chan2dev(chan),
                          "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x\n",
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 455b7a4f1e87..a8ad05291b27 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -626,7 +626,7 @@ static irqreturn_t dw_dma_interrupt(int irq, void *dev_id)
         dev_vdbg(dw->dma.dev, "%s: status=0x%x\n", __func__, status);
 
         /* Check if we have any interrupt from the DMAC */
-        if (!status)
+        if (!status || !dw->in_use)
                 return IRQ_NONE;
 
         /*
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 77a6dcf25b98..194ec20c9408 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -230,6 +230,10 @@ static bool is_bwd_noraid(struct pci_dev *pdev)
         switch (pdev->device) {
         case PCI_DEVICE_ID_INTEL_IOAT_BWD2:
         case PCI_DEVICE_ID_INTEL_IOAT_BWD3:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE0:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE1:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE2:
+        case PCI_DEVICE_ID_INTEL_IOAT_BDXDE3:
                 return true;
         default:
                 return false;
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index 8926f271904e..eb410044e1af 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -219,6 +219,9 @@ static irqreturn_t mmp_pdma_int_handler(int irq, void *dev_id)
 
         while (dint) {
                 i = __ffs(dint);
+                /* only handle interrupts belonging to pdma driver*/
+                if (i >= pdev->dma_channels)
+                        break;
                 dint &= (dint - 1);
                 phy = &pdev->phy[i];
                 ret = mmp_pdma_chan_handler(irq, phy);
@@ -999,6 +1002,9 @@ static int mmp_pdma_probe(struct platform_device *op)
         struct resource *iores;
         int i, ret, irq = 0;
         int dma_channels = 0, irq_num = 0;
+        const enum dma_slave_buswidth widths =
+                DMA_SLAVE_BUSWIDTH_1_BYTE   | DMA_SLAVE_BUSWIDTH_2_BYTES |
+                DMA_SLAVE_BUSWIDTH_4_BYTES;
 
         pdev = devm_kzalloc(&op->dev, sizeof(*pdev), GFP_KERNEL);
         if (!pdev)
@@ -1066,6 +1072,10 @@ static int mmp_pdma_probe(struct platform_device *op)
         pdev->device.device_config = mmp_pdma_config;
         pdev->device.device_terminate_all = mmp_pdma_terminate_all;
         pdev->device.copy_align = PDMA_ALIGNMENT;
+        pdev->device.src_addr_widths = widths;
+        pdev->device.dst_addr_widths = widths;
+        pdev->device.directions = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM);
+        pdev->device.residue_granularity = DMA_RESIDUE_GRANULARITY_DESCRIPTOR;
 
         if (pdev->dev->coherent_dma_mask)
                 dma_set_mask(pdev->dev, pdev->dev->coherent_dma_mask);
diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
index 70c2fa9963cd..b6f4e1fc9c78 100644
--- a/drivers/dma/mmp_tdma.c
+++ b/drivers/dma/mmp_tdma.c
@@ -110,7 +110,7 @@ struct mmp_tdma_chan {
         struct tasklet_struct           tasklet;
 
         struct mmp_tdma_desc            *desc_arr;
-        phys_addr_t                     desc_arr_phys;
+        dma_addr_t                      desc_arr_phys;
         int                             desc_num;
         enum dma_transfer_direction     dir;
         dma_addr_t                      dev_addr;
@@ -166,9 +166,12 @@ static void mmp_tdma_enable_chan(struct mmp_tdma_chan *tdmac)
 static int mmp_tdma_disable_chan(struct dma_chan *chan)
 {
         struct mmp_tdma_chan *tdmac = to_mmp_tdma_chan(chan);
+        u32 tdcr;
 
-        writel(readl(tdmac->reg_base + TDCR) & ~TDCR_CHANEN,
-                                        tdmac->reg_base + TDCR);
+        tdcr = readl(tdmac->reg_base + TDCR);
+        tdcr |= TDCR_ABR;
+        tdcr &= ~TDCR_CHANEN;
+        writel(tdcr, tdmac->reg_base + TDCR);
 
         tdmac->status = DMA_COMPLETE;
 
@@ -296,12 +299,27 @@ static int mmp_tdma_clear_chan_irq(struct mmp_tdma_chan *tdmac)
         return -EAGAIN;
 }
 
+static size_t mmp_tdma_get_pos(struct mmp_tdma_chan *tdmac)
+{
+        size_t reg;
+
+        if (tdmac->idx == 0) {
+                reg = __raw_readl(tdmac->reg_base + TDSAR);
+                reg -= tdmac->desc_arr[0].src_addr;
+        } else if (tdmac->idx == 1) {
+                reg = __raw_readl(tdmac->reg_base + TDDAR);
+                reg -= tdmac->desc_arr[0].dst_addr;
+        } else
+                return -EINVAL;
+
+        return reg;
+}
+
 static irqreturn_t mmp_tdma_chan_handler(int irq, void *dev_id)
 {
         struct mmp_tdma_chan *tdmac = dev_id;
 
         if (mmp_tdma_clear_chan_irq(tdmac) == 0) {
-                tdmac->pos = (tdmac->pos + tdmac->period_len) % tdmac->buf_len;
                 tasklet_schedule(&tdmac->tasklet);
                 return IRQ_HANDLED;
         } else
@@ -343,7 +361,7 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac)
         int size = tdmac->desc_num * sizeof(struct mmp_tdma_desc);
 
         gpool = tdmac->pool;
-        if (tdmac->desc_arr)
+        if (gpool && tdmac->desc_arr)
                 gen_pool_free(gpool, (unsigned long)tdmac->desc_arr,
                                 size);
         tdmac->desc_arr = NULL;
@@ -499,6 +517,7 @@ static enum dma_status mmp_tdma_tx_status(struct dma_chan *chan,
 {
         struct mmp_tdma_chan *tdmac = to_mmp_tdma_chan(chan);
 
+        tdmac->pos = mmp_tdma_get_pos(tdmac);
         dma_set_tx_state(txstate, chan->completed_cookie, chan->cookie,
                          tdmac->buf_len - tdmac->pos);
 
@@ -610,7 +629,7 @@ static int mmp_tdma_probe(struct platform_device *pdev)
         int i, ret;
         int irq = 0, irq_num = 0;
         int chan_num = TDMA_CHANNEL_NUM;
-        struct gen_pool *pool;
+        struct gen_pool *pool = NULL;
 
         of_id = of_match_device(mmp_tdma_dt_ids, &pdev->dev);
         if (of_id)
diff --git a/drivers/dma/qcom_bam_dma.c b/drivers/dma/qcom_bam_dma.c
index d7a33b3ac466..9c914d625906 100644
--- a/drivers/dma/qcom_bam_dma.c
+++ b/drivers/dma/qcom_bam_dma.c
@@ -162,9 +162,9 @@ static const struct reg_offset_data bam_v1_4_reg_info[] = {
         [BAM_P_IRQ_STTS]        = { 0x1010, 0x1000, 0x00, 0x00 },
         [BAM_P_IRQ_CLR]         = { 0x1014, 0x1000, 0x00, 0x00 },
         [BAM_P_IRQ_EN]          = { 0x1018, 0x1000, 0x00, 0x00 },
-        [BAM_P_EVNT_DEST_ADDR]  = { 0x102C, 0x00, 0x1000, 0x00 },
-        [BAM_P_EVNT_REG]        = { 0x1018, 0x00, 0x1000, 0x00 },
-        [BAM_P_SW_OFSTS]        = { 0x1000, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_DEST_ADDR]  = { 0x182C, 0x00, 0x1000, 0x00 },
+        [BAM_P_EVNT_REG]        = { 0x1818, 0x00, 0x1000, 0x00 },
+        [BAM_P_SW_OFSTS]        = { 0x1800, 0x00, 0x1000, 0x00 },
         [BAM_P_DATA_FIFO_ADDR]  = { 0x1824, 0x00, 0x1000, 0x00 },
         [BAM_P_DESC_FIFO_ADDR]  = { 0x181C, 0x00, 0x1000, 0x00 },
         [BAM_P_EVNT_GEN_TRSHLD] = { 0x1828, 0x00, 0x1000, 0x00 },
@@ -1143,6 +1143,10 @@ static int bam_dma_probe(struct platform_device *pdev)
         dma_cap_set(DMA_SLAVE, bdev->common.cap_mask);
 
         /* initialize dmaengine apis */
+        bdev->common.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        bdev->common.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
+        bdev->common.src_addr_widths = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        bdev->common.dst_addr_widths = DMA_SLAVE_BUSWIDTH_4_BYTES;
         bdev->common.device_alloc_chan_resources = bam_alloc_chan;
         bdev->common.device_free_chan_resources = bam_free_chan;
         bdev->common.device_prep_slave_sg = bam_prep_slave_sg;
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index b2431aa30033..9f1d4c7dbab8 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -582,15 +582,12 @@ static void sh_dmae_chan_remove(struct sh_dmae_device *shdev)
         }
 }
 
-static void sh_dmae_shutdown(struct platform_device *pdev)
-{
-        struct sh_dmae_device *shdev = platform_get_drvdata(pdev);
-        sh_dmae_ctl_stop(shdev);
-}
-
 #ifdef CONFIG_PM
 static int sh_dmae_runtime_suspend(struct device *dev)
 {
+        struct sh_dmae_device *shdev = dev_get_drvdata(dev);
+
+        sh_dmae_ctl_stop(shdev);
         return 0;
 }
 
@@ -605,6 +602,9 @@ static int sh_dmae_runtime_resume(struct device *dev)
 #ifdef CONFIG_PM_SLEEP
 static int sh_dmae_suspend(struct device *dev)
 {
+        struct sh_dmae_device *shdev = dev_get_drvdata(dev);
+
+        sh_dmae_ctl_stop(shdev);
         return 0;
 }
 
@@ -929,13 +929,12 @@ static int sh_dmae_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver sh_dmae_driver = {
-        .driver         = {
+        .driver         = {
                 .pm     = &sh_dmae_pm,
                 .name   = SH_DMAE_DRV_NAME,
                 .of_match_table = sh_dmae_of_match,
         },
         .remove         = sh_dmae_remove,
-        .shutdown       = sh_dmae_shutdown,
 };
 
 static int __init sh_dmae_init(void)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index c5f7b4e9eb6c..69fac068669f 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -78,7 +78,7 @@ static const char * __init dmi_string(const struct dmi_header *dm, u8 s)
  *      We have to be cautious here. We have seen BIOSes with DMI pointers
  *      pointing to completely the wrong place for example
  */
-static void dmi_table(u8 *buf, int len, int num,
+static void dmi_table(u8 *buf, u32 len, int num,
                       void (*decode)(const struct dmi_header *, void *),
                       void *private_data)
 {
@@ -93,12 +93,6 @@ static void dmi_table(u8 *buf, int len, int num,
                 const struct dmi_header *dm = (const struct dmi_header *)data;
 
                 /*
-                 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
-                 */
-                if (dm->type == DMI_ENTRY_END_OF_TABLE)
-                        break;
-
-                /*
                  *  We want to know the total length (formatted area and
                  *  strings) before decoding to make sure we won't run off the
                  *  table in dmi_decode or dmi_string
@@ -108,13 +102,20 @@ static void dmi_table(u8 *buf, int len, int num,
                         data++;
                 if (data - buf < len - 1)
                         decode(dm, private_data);
+
+                /*
+                 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
+                 */
+                if (dm->type == DMI_ENTRY_END_OF_TABLE)
+                        break;
+
                 data += 2;
                 i++;
         }
 }
 
 static phys_addr_t dmi_base;
-static u16 dmi_len;
+static u32 dmi_len;
 static u16 dmi_num;
 
 static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 2fe195002021..f07d4a67fa76 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -179,12 +179,12 @@ again:
                 start = desc->phys_addr;
                 end = start + desc->num_pages * (1UL << EFI_PAGE_SHIFT);
 
-                if ((start + size) > end || (start + size) > max)
-                        continue;
-
-                if (end - size > max)
+                if (end > max)
                         end = max;
 
+                if ((start + size) > end)
+                        continue;
+
                 if (round_down(end - size, align) < start)
                         continue;
 
diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
index 472fb5b8779f..9cdbc0c9cb2d 100644
--- a/drivers/gpio/gpio-tps65912.c
+++ b/drivers/gpio/gpio-tps65912.c
@@ -26,9 +26,12 @@ struct tps65912_gpio_data {
         struct gpio_chip gpio_chip;
 };
 
+#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
+
 static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
         int val;
 
         val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
 static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
                               int value)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         if (value)
                 tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
 static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
                                 int value)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         /* Set the initial value */
         tps65912_gpio_set(gc, offset, value);
@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
 
 static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
 {
-        struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
+        struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
+        struct tps65912 *tps65912 = tps65912_gpio->tps65912;
 
         return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
                                                                 GPIO_CFG_MASK);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 8cad8e400b44..4650bf830d6b 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -46,12 +46,13 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
 
         ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
         if (ret < 0) {
-                /* We've found the gpio chip, but the translation failed.
-                 * Return true to stop looking and return the translation
-                 * error via out_gpio
+                /* We've found a gpio chip, but the translation failed.
+                 * Store translation error in out_gpio.
+                 * Return false to keep looking, as more than one gpio chip
+                 * could be registered per of-node.
                  */
                 gg_data->out_gpio = ERR_PTR(ret);
-                return true;
+                return false;
          }
 
         gg_data->out_gpio = gpiochip_get_desc(gc, ret);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index b3589d0e39b9..910ff8ab9c9c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -62,12 +62,18 @@ enum KFD_MQD_TYPE get_mqd_type_from_queue_type(enum kfd_queue_type type)
         return KFD_MQD_TYPE_CP;
 }
 
-static inline unsigned int get_first_pipe(struct device_queue_manager *dqm)
+unsigned int get_first_pipe(struct device_queue_manager *dqm)
 {
-        BUG_ON(!dqm);
+        BUG_ON(!dqm || !dqm->dev);
         return dqm->dev->shared_resources.first_compute_pipe;
 }
 
+unsigned int get_pipes_num(struct device_queue_manager *dqm)
+{
+        BUG_ON(!dqm || !dqm->dev);
+        return dqm->dev->shared_resources.compute_pipe_count;
+}
+
 static inline unsigned int get_pipes_num_cpsch(void)
 {
         return PIPE_PER_ME_CP_SCHEDULING;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
index d64f86cda34f..488f51d19427 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
@@ -163,6 +163,8 @@ void program_sh_mem_settings(struct device_queue_manager *dqm,
                                         struct qcm_process_device *qpd);
 int init_pipelines(struct device_queue_manager *dqm,
                 unsigned int pipes_num, unsigned int first_pipe);
+unsigned int get_first_pipe(struct device_queue_manager *dqm);
+unsigned int get_pipes_num(struct device_queue_manager *dqm);
 
 extern inline unsigned int get_sh_mem_bases_32(struct kfd_process_device *pdd)
 {
@@ -175,10 +177,4 @@ get_sh_mem_bases_nybble_64(struct kfd_process_device *pdd)
         return (pdd->lds_base >> 60) & 0x0E;
 }
 
-extern inline unsigned int get_pipes_num(struct device_queue_manager *dqm)
-{
-        BUG_ON(!dqm || !dqm->dev);
-        return dqm->dev->shared_resources.compute_pipe_count;
-}
-
 #endif /* KFD_DEVICE_QUEUE_MANAGER_H_ */
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
index 6b072466e2a6..5469efe0523e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager_cik.c
@@ -131,5 +131,5 @@ static int register_process_cik(struct device_queue_manager *dqm,
 
 static int initialize_cpsch_cik(struct device_queue_manager *dqm)
 {
-        return init_pipelines(dqm, get_pipes_num(dqm), 0);
+        return init_pipelines(dqm, get_pipes_num(dqm), get_first_pipe(dqm));
 }
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index 0409b907de5d..b3e3068c6ec0 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -153,7 +153,7 @@ static int atmel_hlcdc_crtc_mode_set(struct drm_crtc *c,
                      (adj->crtc_hdisplay - 1) |
                      ((adj->crtc_vdisplay - 1) << 16));
 
-        cfg = ATMEL_HLCDC_CLKPOL;
+        cfg = 0;
 
         prate = clk_get_rate(crtc->dc->hlcdc->sys_clk);
         mode_rate = mode->crtc_clock * 1000;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
index 7320a6c6613f..c1cb17493e0d 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
@@ -311,8 +311,6 @@ static int atmel_hlcdc_dc_load(struct drm_device *dev)
 
         pm_runtime_enable(dev->dev);
 
-        pm_runtime_put_sync(dev->dev);
-
         ret = atmel_hlcdc_dc_modeset_init(dev);
         if (ret < 0) {
                 dev_err(dev->dev, "failed to initialize mode setting\n");
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
index 063d2a7b941f..e79bd9ba474b 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_layer.c
@@ -311,7 +311,8 @@ int atmel_hlcdc_layer_disable(struct atmel_hlcdc_layer *layer)
 
         /* Disable the layer */
         regmap_write(regmap, desc->regs_offset + ATMEL_HLCDC_LAYER_CHDR,
-                     ATMEL_HLCDC_LAYER_RST);
+                     ATMEL_HLCDC_LAYER_RST | ATMEL_HLCDC_LAYER_A2Q |
+                     ATMEL_HLCDC_LAYER_UPDATE);
 
         /* Clear all pending interrupts */
         regmap_read(regmap, desc->regs_offset + ATMEL_HLCDC_LAYER_ISR, &isr);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b00173d1be4..6b6b07ff720b 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2127,7 +2127,6 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         DRM_DEBUG_KMS("[CONNECTOR:%d:?]\n", out_resp->connector_id);
 
         mutex_lock(&dev->mode_config.mutex);
-        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
 
         connector = drm_connector_find(dev, out_resp->connector_id);
         if (!connector) {
@@ -2157,6 +2156,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
         out_resp->mm_height = connector->display_info.height_mm;
         out_resp->subpixel = connector->display_info.subpixel_order;
         out_resp->connection = connector->status;
+
+        drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
         encoder = drm_connector_get_encoder(connector);
         if (encoder)
                 out_resp->encoder_id = encoder->base.id;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 04a209e2b66d..7fc6f8bd4821 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -91,29 +91,29 @@
  */
 
 static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
-                                                unsigned long size,
+                                                u64 size,
                                                 unsigned alignment,
                                                 unsigned long color,
                                                 enum drm_mm_search_flags flags);
 static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_mm *mm,
-                                                unsigned long size,
+                                                u64 size,
                                                 unsigned alignment,
                                                 unsigned long color,
-                                                unsigned long start,
-                                                unsigned long end,
+                                                u64 start,
+                                                u64 end,
                                                 enum drm_mm_search_flags flags);
 
 static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
                                  struct drm_mm_node *node,
-                                 unsigned long size, unsigned alignment,
+                                 u64 size, unsigned alignment,
                                  unsigned long color,
                                  enum drm_mm_allocator_flags flags)
 {
         struct drm_mm *mm = hole_node->mm;
-        unsigned long hole_start = drm_mm_hole_node_start(hole_node);
-        unsigned long hole_end = drm_mm_hole_node_end(hole_node);
-        unsigned long adj_start = hole_start;
-        unsigned long adj_end = hole_end;
+        u64 hole_start = drm_mm_hole_node_start(hole_node);
+        u64 hole_end = drm_mm_hole_node_end(hole_node);
+        u64 adj_start = hole_start;
+        u64 adj_end = hole_end;
 
         BUG_ON(node->allocated);
 
@@ -124,12 +124,15 @@ static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
                 adj_start = adj_end - size;
 
         if (alignment) {
-                unsigned tmp = adj_start % alignment;
-                if (tmp) {
+                u64 tmp = adj_start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
+                if (rem) {
                         if (flags & DRM_MM_CREATE_TOP)
-                                adj_start -= tmp;
+                                adj_start -= rem;
                         else
-                                adj_start += alignment - tmp;
+                                adj_start += alignment - rem;
                 }
         }
 
@@ -176,9 +179,9 @@ static void drm_mm_insert_helper(struct drm_mm_node *hole_node,
 int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
 {
         struct drm_mm_node *hole;
-        unsigned long end = node->start + node->size;
-        unsigned long hole_start;
-        unsigned long hole_end;
+        u64 end = node->start + node->size;
+        u64 hole_start;
+        u64 hole_end;
 
         BUG_ON(node == NULL);
 
@@ -227,7 +230,7 @@ EXPORT_SYMBOL(drm_mm_reserve_node);
  * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_generic(struct drm_mm *mm, struct drm_mm_node *node,
-                               unsigned long size, unsigned alignment,
+                               u64 size, unsigned alignment,
                                unsigned long color,
                                enum drm_mm_search_flags sflags,
                                enum drm_mm_allocator_flags aflags)
@@ -246,16 +249,16 @@ EXPORT_SYMBOL(drm_mm_insert_node_generic);
 
 static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
                                        struct drm_mm_node *node,
-                                       unsigned long size, unsigned alignment,
+                                       u64 size, unsigned alignment,
                                        unsigned long color,
-                                       unsigned long start, unsigned long end,
+                                       u64 start, u64 end,
                                        enum drm_mm_allocator_flags flags)
 {
         struct drm_mm *mm = hole_node->mm;
-        unsigned long hole_start = drm_mm_hole_node_start(hole_node);
-        unsigned long hole_end = drm_mm_hole_node_end(hole_node);
-        unsigned long adj_start = hole_start;
-        unsigned long adj_end = hole_end;
+        u64 hole_start = drm_mm_hole_node_start(hole_node);
+        u64 hole_end = drm_mm_hole_node_end(hole_node);
+        u64 adj_start = hole_start;
+        u64 adj_end = hole_end;
 
         BUG_ON(!hole_node->hole_follows || node->allocated);
 
@@ -271,12 +274,15 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
                 mm->color_adjust(hole_node, color, &adj_start, &adj_end);
 
         if (alignment) {
-                unsigned tmp = adj_start % alignment;
-                if (tmp) {
+                u64 tmp = adj_start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
+                if (rem) {
                         if (flags & DRM_MM_CREATE_TOP)
-                                adj_start -= tmp;
+                                adj_start -= rem;
                         else
-                                adj_start += alignment - tmp;
+                                adj_start += alignment - rem;
                 }
         }
 
@@ -324,9 +330,9 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
  * 0 on success, -ENOSPC if there's no suitable hole.
  */
 int drm_mm_insert_node_in_range_generic(struct drm_mm *mm, struct drm_mm_node *node,
-                                        unsigned long size, unsigned alignment,
+                                        u64 size, unsigned alignment,
                                         unsigned long color,
-                                        unsigned long start, unsigned long end,
+                                        u64 start, u64 end,
                                         enum drm_mm_search_flags sflags,
                                         enum drm_mm_allocator_flags aflags)
 {
@@ -387,32 +393,34 @@ void drm_mm_remove_node(struct drm_mm_node *node)
 }
 EXPORT_SYMBOL(drm_mm_remove_node);
 
-static int check_free_hole(unsigned long start, unsigned long end,
-                           unsigned long size, unsigned alignment)
+static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
 {
         if (end - start < size)
                 return 0;
 
         if (alignment) {
-                unsigned tmp = start % alignment;
+                u64 tmp = start;
+                unsigned rem;
+
+                rem = do_div(tmp, alignment);
                 if (tmp)
-                        start += alignment - tmp;
+                        start += alignment - rem;
         }
 
         return end >= start + size;
 }
 
 static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
-                                                      unsigned long size,
+                                                      u64 size,
                                                       unsigned alignment,
                                                       unsigned long color,
                                                       enum drm_mm_search_flags flags)
 {
         struct drm_mm_node *entry;
         struct drm_mm_node *best;
-        unsigned long adj_start;
-        unsigned long adj_end;
-        unsigned long best_size;
+        u64 adj_start;
+        u64 adj_end;
+        u64 best_size;
 
         BUG_ON(mm->scanned_blocks);
 
@@ -421,7 +429,7 @@ static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
 
         __drm_mm_for_each_hole(entry, mm, adj_start, adj_end,
                                flags & DRM_MM_SEARCH_BELOW) {
-                unsigned long hole_size = adj_end - adj_start;
+                u64 hole_size = adj_end - adj_start;
 
                 if (mm->color_adjust) {
                         mm->color_adjust(entry, color, &adj_start, &adj_end);
@@ -445,18 +453,18 @@ static struct drm_mm_node *drm_mm_search_free_generic(const struct drm_mm *mm,
 }
 
 static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_mm *mm,
-                                                        unsigned long size,
+                                                        u64 size,
                                                         unsigned alignment,
                                                         unsigned long color,
-                                                        unsigned long start,
-                                                        unsigned long end,
+                                                        u64 start,
+                                                        u64 end,
                                                         enum drm_mm_search_flags flags)
 {
         struct drm_mm_node *entry;
         struct drm_mm_node *best;
-        unsigned long adj_start;
-        unsigned long adj_end;
-        unsigned long best_size;
+        u64 adj_start;
+        u64 adj_end;
+        u64 best_size;
 
         BUG_ON(mm->scanned_blocks);
 
@@ -465,7 +473,7 @@ static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_
 
         __drm_mm_for_each_hole(entry, mm, adj_start, adj_end,
                                flags & DRM_MM_SEARCH_BELOW) {
-                unsigned long hole_size = adj_end - adj_start;
+                u64 hole_size = adj_end - adj_start;
 
                 if (adj_start < start)
                         adj_start = start;
@@ -561,7 +569,7 @@ EXPORT_SYMBOL(drm_mm_replace_node);
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan(struct drm_mm *mm,
-                      unsigned long size,
+                      u64 size,
                       unsigned alignment,
                       unsigned long color)
 {
@@ -594,11 +602,11 @@ EXPORT_SYMBOL(drm_mm_init_scan);
  * adding/removing nodes to/from the scan list are allowed.
  */
 void drm_mm_init_scan_with_range(struct drm_mm *mm,
-                                 unsigned long size,
+                                 u64 size,
                                  unsigned alignment,
                                  unsigned long color,
-                                 unsigned long start,
-                                 unsigned long end)
+                                 u64 start,
+                                 u64 end)
 {
         mm->scan_color = color;
         mm->scan_alignment = alignment;
@@ -627,8 +635,8 @@ bool drm_mm_scan_add_block(struct drm_mm_node *node)
 {
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
-        unsigned long hole_start, hole_end;
-        unsigned long adj_start, adj_end;
+        u64 hole_start, hole_end;
+        u64 adj_start, adj_end;
 
         mm->scanned_blocks++;
 
@@ -731,7 +739,7 @@ EXPORT_SYMBOL(drm_mm_clean);
  *
  * Note that @mm must be cleared to 0 before calling this function.
  */
-void drm_mm_init(struct drm_mm * mm, unsigned long start, unsigned long size)
+void drm_mm_init(struct drm_mm * mm, u64 start, u64 size)
 {
         INIT_LIST_HEAD(&mm->hole_stack);
         mm->scanned_blocks = 0;
@@ -766,18 +774,17 @@ void drm_mm_takedown(struct drm_mm * mm)
 }
 EXPORT_SYMBOL(drm_mm_takedown);
 
-static unsigned long drm_mm_debug_hole(struct drm_mm_node *entry,
-                                       const char *prefix)
+static u64 drm_mm_debug_hole(struct drm_mm_node *entry,
+                                     const char *prefix)
 {
-        unsigned long hole_start, hole_end, hole_size;
+        u64 hole_start, hole_end, hole_size;
 
         if (entry->hole_follows) {
                 hole_start = drm_mm_hole_node_start(entry);
                 hole_end = drm_mm_hole_node_end(entry);
                 hole_size = hole_end - hole_start;
-                printk(KERN_DEBUG "%s 0x%08lx-0x%08lx: %8lu: free\n",
-                        prefix, hole_start, hole_end,
-                        hole_size);
+                pr_debug("%s %#llx-%#llx: %llu: free\n", prefix, hole_start,
+                         hole_end, hole_size);
                 return hole_size;
         }
 
@@ -792,35 +799,34 @@ static unsigned long drm_mm_debug_hole(struct drm_mm_node *entry,
 void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
 {
         struct drm_mm_node *entry;
-        unsigned long total_used = 0, total_free = 0, total = 0;
+        u64 total_used = 0, total_free = 0, total = 0;
 
         total_free += drm_mm_debug_hole(&mm->head_node, prefix);
 
         drm_mm_for_each_node(entry, mm) {
-                printk(KERN_DEBUG "%s 0x%08lx-0x%08lx: %8lu: used\n",
-                        prefix, entry->start, entry->start + entry->size,
-                        entry->size);
+                pr_debug("%s %#llx-%#llx: %llu: used\n", prefix, entry->start,
+                         entry->start + entry->size, entry->size);
                 total_used += entry->size;
                 total_free += drm_mm_debug_hole(entry, prefix);
         }
         total = total_free + total_used;
 
-        printk(KERN_DEBUG "%s total: %lu, used %lu free %lu\n", prefix, total,
-                total_used, total_free);
+        pr_debug("%s total: %llu, used %llu free %llu\n", prefix, total,
+                 total_used, total_free);
 }
 EXPORT_SYMBOL(drm_mm_debug_table);
 
 #if defined(CONFIG_DEBUG_FS)
-static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
+static u64 drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
 {
-        unsigned long hole_start, hole_end, hole_size;
+        u64 hole_start, hole_end, hole_size;
 
         if (entry->hole_follows) {
                 hole_start = drm_mm_hole_node_start(entry);
                 hole_end = drm_mm_hole_node_end(entry);
                 hole_size = hole_end - hole_start;
-                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
-                                hole_start, hole_end, hole_size);
+                seq_printf(m, "%#llx-%#llx: %llu: free\n", hole_start,
+                           hole_end, hole_size);
                 return hole_size;
         }
 
@@ -835,20 +841,20 @@ static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *en
 int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
 {
         struct drm_mm_node *entry;
-        unsigned long total_used = 0, total_free = 0, total = 0;
+        u64 total_used = 0, total_free = 0, total = 0;
 
         total_free += drm_mm_dump_hole(m, &mm->head_node);
 
         drm_mm_for_each_node(entry, mm) {
-                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
-                                entry->start, entry->start + entry->size,
-                                entry->size);
+                seq_printf(m, "%#016llx-%#016llx: %llu: used\n", entry->start,
+                           entry->start + entry->size, entry->size);
                 total_used += entry->size;
                 total_free += drm_mm_dump_hole(m, entry);
         }
         total = total_free + total_used;
 
-        seq_printf(m, "total: %lu, used %lu free %lu\n", total, total_used, total_free);
+        seq_printf(m, "total: %llu, used %llu free %llu\n", total,
+                   total_used, total_free);
         return 0;
 }
 EXPORT_SYMBOL(drm_mm_dump_table);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 96e811fe24ca..e8b18e542da4 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -152,12 +152,12 @@ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
                         seq_puts(m, " (pp");
                 else
                         seq_puts(m, " (g");
-                seq_printf(m, "gtt offset: %08lx, size: %08lx, type: %u)",
+                seq_printf(m, "gtt offset: %08llx, size: %08llx, type: %u)",
                            vma->node.start, vma->node.size,
                            vma->ggtt_view.type);
         }
         if (obj->stolen)
-                seq_printf(m, " (stolen: %08lx)", obj->stolen->start);
+                seq_printf(m, " (stolen: %08llx)", obj->stolen->start);
         if (obj->pin_mappable || obj->fault_mappable) {
                 char s[3], *t = s;
                 if (obj->pin_mappable)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 8039cec71fc2..cc6ea53d2b81 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -622,7 +622,7 @@ static int i915_drm_suspend(struct drm_device *dev)
         return 0;
 }
 
-static int i915_drm_suspend_late(struct drm_device *drm_dev)
+static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation)
 {
         struct drm_i915_private *dev_priv = drm_dev->dev_private;
         int ret;
@@ -636,7 +636,17 @@ static int i915_drm_suspend_late(struct drm_device *drm_dev)
         }
 
         pci_disable_device(drm_dev->pdev);
-        pci_set_power_state(drm_dev->pdev, PCI_D3hot);
+        /*
+         * During hibernation on some GEN4 platforms the BIOS may try to access
+         * the device even though it's already in D3 and hang the machine. So
+         * leave the device in D0 on those platforms and hope the BIOS will
+         * power down the device properly. Platforms where this was seen:
+         * Lenovo Thinkpad X301, X61s
+         */
+        if (!(hibernation &&
+              drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO &&
+              INTEL_INFO(dev_priv)->gen == 4))
+                pci_set_power_state(drm_dev->pdev, PCI_D3hot);
 
         return 0;
 }
@@ -662,7 +672,7 @@ int i915_suspend_legacy(struct drm_device *dev, pm_message_t state)
         if (error)
                 return error;
 
-        return i915_drm_suspend_late(dev);
+        return i915_drm_suspend_late(dev, false);
 }
 
 static int i915_drm_resume(struct drm_device *dev)
@@ -950,7 +960,17 @@ static int i915_pm_suspend_late(struct device *dev)
         if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                 return 0;
 
-        return i915_drm_suspend_late(drm_dev);
+        return i915_drm_suspend_late(drm_dev, false);
+}
+
+static int i915_pm_poweroff_late(struct device *dev)
+{
+        struct drm_device *drm_dev = dev_to_i915(dev)->dev;
+
+        if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                return 0;
+
+        return i915_drm_suspend_late(drm_dev, true);
 }
 
 static int i915_pm_resume_early(struct device *dev)
@@ -1520,7 +1540,7 @@ static const struct dev_pm_ops i915_pm_ops = {
         .thaw_early = i915_pm_resume_early,
         .thaw = i915_pm_resume,
         .poweroff = i915_pm_suspend,
-        .poweroff_late = i915_pm_suspend_late,
+        .poweroff_late = i915_pm_poweroff_late,
         .restore_early = i915_pm_resume_early,
         .restore = i915_pm_resume,
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index f2a825e39646..8727086cf48c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2114,6 +2114,9 @@ void i915_gem_track_fb(struct drm_i915_gem_object *old,
  * number comparisons on buffer last_read|write_seqno. It also allows an
  * emission time to be associated with the request for tracking how far ahead
  * of the GPU the submission is.
+ *
+ * The requests are reference counted, so upon creation they should have an
+ * initial reference taken using kref_init
  */
 struct drm_i915_gem_request {
         struct kref ref;
@@ -2137,7 +2140,16 @@ struct drm_i915_gem_request {
         /** Position in the ringbuffer of the end of the whole request */
         u32 tail;
 
-        /** Context related to this request */
+        /**
+         * Context related to this request
+         * Contexts are refcounted, so when this request is associated with a
+         * context, we must increment the context's refcount, to guarantee that
+         * it persists while any request is linked to it. Requests themselves
+         * are also refcounted, so the request will only be freed when the last
+         * reference to it is dismissed, and the code in
+         * i915_gem_request_free() will then decrement the refcount on the
+         * context.
+         */
         struct intel_context *ctx;
 
         /** Batch buffer related to this request if any */
@@ -2374,6 +2386,7 @@ struct drm_i915_cmd_table {
                                  (INTEL_DEVID(dev) & 0xFF00) == 0x0C00)
 #define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
                                  ((INTEL_DEVID(dev) & 0xf) == 0x6 ||    \
+                                 (INTEL_DEVID(dev) & 0xf) == 0xb ||     \
                                  (INTEL_DEVID(dev) & 0xf) == 0xe))
 #define IS_BDW_GT3(dev)         (IS_BROADWELL(dev) && \
                                  (INTEL_DEVID(dev) & 0x00F0) == 0x0020)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index c26d36cc4b31..e5daad5f75fb 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2659,8 +2659,7 @@ static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
                 if (submit_req->ctx != ring->default_context)
                         intel_lr_context_unpin(ring, submit_req->ctx);
 
-                i915_gem_context_unreference(submit_req->ctx);
-                kfree(submit_req);
+                i915_gem_request_unreference(submit_req);
         }
 
         /*
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 746f77fb57a3..dccdc8aad2e2 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1145,7 +1145,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
 
         ppgtt->base.clear_range(&ppgtt->base, 0, ppgtt->base.total, true);
 
-        DRM_DEBUG_DRIVER("Allocated pde space (%ldM) at GTT entry: %lx\n",
+        DRM_DEBUG_DRIVER("Allocated pde space (%lldM) at GTT entry: %llx\n",
                          ppgtt->node.size >> 20,
                          ppgtt->node.start / PAGE_SIZE);
 
@@ -1713,8 +1713,8 @@ void i915_gem_gtt_finish_object(struct drm_i915_gem_object *obj)
 
 static void i915_gtt_color_adjust(struct drm_mm_node *node,
                                   unsigned long color,
-                                  unsigned long *start,
-                                  unsigned long *end)
+                                  u64 *start,
+                                  u64 *end)
 {
         if (node->color != color)
                 *start += 4096;
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index a2045848bd1a..9c6f93ec886b 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -485,10 +485,8 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
                         stolen_offset, gtt_offset, size);
 
         /* KISS and expect everything to be page-aligned */
-        BUG_ON(stolen_offset & 4095);
-        BUG_ON(size & 4095);
-
-        if (WARN_ON(size == 0))
+        if (WARN_ON(size == 0) || WARN_ON(size & 4095) ||
+            WARN_ON(stolen_offset & 4095))
                 return NULL;
 
         stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 7a24bd1a51f6..6377b22269ad 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -335,9 +335,10 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
+        mutex_lock(&dev->struct_mutex);
         if (i915_gem_obj_is_pinned(obj) || obj->framebuffer_references) {
-                drm_gem_object_unreference_unlocked(&obj->base);
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         if (args->tiling_mode == I915_TILING_NONE) {
@@ -369,7 +370,6 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 }
         }
 
-        mutex_lock(&dev->struct_mutex);
         if (args->tiling_mode != obj->tiling_mode ||
             args->stride != obj->stride) {
                 /* We need to rebind the object if its current allocation
@@ -424,6 +424,7 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 obj->bit_17 = NULL;
         }
 
+err:
         drm_gem_object_unreference(&obj->base);
         mutex_unlock(&dev->struct_mutex);
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 4145d95902f5..ede5bbbd8a08 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1892,6 +1892,9 @@ static irqreturn_t valleyview_irq_handler(int irq, void *arg)
         u32 iir, gt_iir, pm_iir;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         while (true) {
                 /* Find, clear, then process each source of interrupt */
 
@@ -1936,6 +1939,9 @@ static irqreturn_t cherryview_irq_handler(int irq, void *arg)
         u32 master_ctl, iir;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         for (;;) {
                 master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
                 iir = I915_READ(VLV_IIR);
@@ -2208,6 +2214,9 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
         u32 de_iir, gt_iir, de_ier, sde_ier = 0;
         irqreturn_t ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         /* We get interrupts on unclaimed registers, so check for this before we
          * do any I915_{READ,WRITE}. */
         intel_uncore_check_errors(dev);
@@ -2279,6 +2288,9 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg)
         enum pipe pipe;
         u32 aux_mask = GEN8_AUX_CHANNEL_A;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         if (IS_GEN9(dev))
                 aux_mask |=  GEN9_AUX_CHANNEL_B | GEN9_AUX_CHANNEL_C |
                         GEN9_AUX_CHANNEL_D;
@@ -3771,6 +3783,9 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ16(IIR);
         if (iir == 0)
                 return IRQ_NONE;
@@ -3951,6 +3966,9 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
         int pipe, ret = IRQ_NONE;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ(IIR);
         do {
                 bool irq_received = (iir & ~flip_mask) != 0;
@@ -4171,6 +4189,9 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
                 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
                 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
 
+        if (!intel_irqs_enabled(dev_priv))
+                return IRQ_NONE;
+
         iir = I915_READ(IIR);
 
         for (;;) {
@@ -4520,6 +4541,7 @@ void intel_runtime_pm_disable_interrupts(struct drm_i915_private *dev_priv)
 {
         dev_priv->dev->driver->irq_uninstall(dev_priv->dev);
         dev_priv->pm.irqs_enabled = false;
+        synchronize_irq(dev_priv->dev->irq);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3d220a67f865..e730789b53b7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2371,13 +2371,19 @@ intel_alloc_plane_obj(struct intel_crtc *crtc,
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_gem_object *obj = NULL;
         struct drm_mode_fb_cmd2 mode_cmd = { 0 };
-        u32 base = plane_config->base;
+        u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
+        u32 size_aligned = round_up(plane_config->base + plane_config->size,
+                                    PAGE_SIZE);
+
+        size_aligned -= base_aligned;
 
         if (plane_config->size == 0)
                 return false;
 
-        obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
-                                                             plane_config->size);
+        obj = i915_gem_object_create_stolen_for_preallocated(dev,
+                                                             base_aligned,
+                                                             base_aligned,
+                                                             size_aligned);
         if (!obj)
                 return false;
 
@@ -2725,10 +2731,19 @@ static void skylake_update_primary_plane(struct drm_crtc *crtc,
         case DRM_FORMAT_XRGB8888:
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
                 break;
+        case DRM_FORMAT_ARGB8888:
+                plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
+                plane_ctl |= PLANE_CTL_ALPHA_SW_PREMULTIPLY;
+                break;
         case DRM_FORMAT_XBGR8888:
                 plane_ctl |= PLANE_CTL_ORDER_RGBX;
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
                 break;
+        case DRM_FORMAT_ABGR8888:
+                plane_ctl |= PLANE_CTL_ORDER_RGBX;
+                plane_ctl |= PLANE_CTL_FORMAT_XRGB_8888;
+                plane_ctl |= PLANE_CTL_ALPHA_SW_PREMULTIPLY;
+                break;
         case DRM_FORMAT_XRGB2101010:
                 plane_ctl |= PLANE_CTL_FORMAT_XRGB_2101010;
                 break;
@@ -6627,7 +6642,7 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
         aligned_height = intel_fb_align_height(dev, fb->height,
                                                plane_config->tiling);
 
-        plane_config->size = PAGE_ALIGN(fb->pitches[0] * aligned_height);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe/plane %c/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), plane, fb->width, fb->height,
@@ -7664,7 +7679,7 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
         aligned_height = intel_fb_align_height(dev, fb->height,
                                                plane_config->tiling);
 
-        plane_config->size = ALIGN(fb->pitches[0] * aligned_height, PAGE_SIZE);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe %c with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), fb->width, fb->height,
@@ -7755,7 +7770,7 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
         aligned_height = intel_fb_align_height(dev, fb->height,
                                                plane_config->tiling);
 
-        plane_config->size = PAGE_ALIGN(fb->pitches[0] * aligned_height);
+        plane_config->size = fb->pitches[0] * aligned_height;
 
         DRM_DEBUG_KMS("pipe %c with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
                       pipe_name(pipe), fb->width, fb->height,
@@ -8698,6 +8713,7 @@ retry:
                         old->release_fb->funcs->destroy(old->release_fb);
                 goto fail;
         }
+        crtc->primary->crtc = crtc;
 
         /* let the connector get through one full cycle before testing */
         intel_wait_for_vblank(dev, intel_crtc->pipe);
@@ -12182,9 +12198,6 @@ intel_check_cursor_plane(struct drm_plane *plane,
                 return -ENOMEM;
         }
 
-        if (fb == crtc->cursor->fb)
-                return 0;
-
         /* we only need to pin inside GTT if cursor is non-phy */
         mutex_lock(&dev->struct_mutex);
         if (!INTEL_INFO(dev)->cursor_needs_physical && obj->tiling_mode) {
@@ -13096,6 +13109,9 @@ static struct intel_quirk intel_quirks[] = {
 
         /* HP Chromebook 14 (Celeron 2955U) */
         { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
+
+        /* Dell Chromebook 11 */
+        { 0x0a06, 0x1028, 0x0a35, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_fifo_underrun.c b/drivers/gpu/drm/i915/intel_fifo_underrun.c
index 04e248dd2259..54daa66c6970 100644
--- a/drivers/gpu/drm/i915/intel_fifo_underrun.c
+++ b/drivers/gpu/drm/i915/intel_fifo_underrun.c
@@ -282,16 +282,6 @@ bool intel_set_cpu_fifo_underrun_reporting(struct drm_i915_private *dev_priv,
         return ret;
 }
 
-static bool
-__cpu_fifo_underrun_reporting_enabled(struct drm_i915_private *dev_priv,
-                                      enum pipe pipe)
-{
-        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-
-        return !intel_crtc->cpu_fifo_underrun_disabled;
-}
-
 /**
  * intel_set_pch_fifo_underrun_reporting - set PCH fifo underrun reporting state
  * @dev_priv: i915 device instance
@@ -352,9 +342,15 @@ bool intel_set_pch_fifo_underrun_reporting(struct drm_i915_private *dev_priv,
 void intel_cpu_fifo_underrun_irq_handler(struct drm_i915_private *dev_priv,
                                          enum pipe pipe)
 {
+        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        /* We may be called too early in init, thanks BIOS! */
+        if (crtc == NULL)
+                return;
+
         /* GMCH can't disable fifo underruns, filter them. */
         if (HAS_GMCH_DISPLAY(dev_priv->dev) &&
-            !__cpu_fifo_underrun_reporting_enabled(dev_priv, pipe))
+            to_intel_crtc(crtc)->cpu_fifo_underrun_disabled)
                 return;
 
         if (intel_set_cpu_fifo_underrun_reporting(dev_priv, pipe, false))
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 0f358c5999ec..e8d3da9f3373 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -503,18 +503,19 @@ static int execlists_context_queue(struct intel_engine_cs *ring,
                  * If there isn't a request associated with this submission,
                  * create one as a temporary holder.
                  */
-                WARN(1, "execlist context submission without request");
                 request = kzalloc(sizeof(*request), GFP_KERNEL);
                 if (request == NULL)
                         return -ENOMEM;
                 request->ring = ring;
                 request->ctx = to;
+                kref_init(&request->ref);
+                request->uniq = dev_priv->request_uniq++;
+                i915_gem_context_reference(request->ctx);
         } else {
+                i915_gem_request_reference(request);
                 WARN_ON(to != request->ctx);
         }
         request->tail = tail;
-        i915_gem_request_reference(request);
-        i915_gem_context_reference(request->ctx);
 
         intel_runtime_pm_get(dev_priv);
 
@@ -731,7 +732,6 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring)
                 if (ctx_obj && (ctx != ring->default_context))
                         intel_lr_context_unpin(ring, ctx);
                 intel_runtime_pm_put(dev_priv);
-                i915_gem_context_unreference(ctx);
                 list_del(&req->execlist_link);
                 i915_gem_request_unreference(req);
         }
diff --git a/drivers/gpu/drm/imx/dw_hdmi-imx.c b/drivers/gpu/drm/imx/dw_hdmi-imx.c
index 121d30ca2d44..87fe8ed92ebe 100644
--- a/drivers/gpu/drm/imx/dw_hdmi-imx.c
+++ b/drivers/gpu/drm/imx/dw_hdmi-imx.c
@@ -70,7 +70,9 @@ static const struct dw_hdmi_curr_ctrl imx_cur_ctr[] = {
                 118800000, { 0x091c, 0x091c, 0x06dc },
         }, {
                 216000000, { 0x06dc, 0x0b5c, 0x091c },
-        }
+        }, {
+                ~0UL, { 0x0000, 0x0000, 0x0000 },
+        },
 };
 
 static const struct dw_hdmi_sym_term imx_sym_term[] = {
@@ -136,11 +138,34 @@ static struct drm_encoder_funcs dw_hdmi_imx_encoder_funcs = {
         .destroy = drm_encoder_cleanup,
 };
 
+static enum drm_mode_status imx6q_hdmi_mode_valid(struct drm_connector *con,
+                                                  struct drm_display_mode *mode)
+{
+        if (mode->clock < 13500)
+                return MODE_CLOCK_LOW;
+        if (mode->clock > 266000)
+                return MODE_CLOCK_HIGH;
+
+        return MODE_OK;
+}
+
+static enum drm_mode_status imx6dl_hdmi_mode_valid(struct drm_connector *con,
+                                                   struct drm_display_mode *mode)
+{
+        if (mode->clock < 13500)
+                return MODE_CLOCK_LOW;
+        if (mode->clock > 270000)
+                return MODE_CLOCK_HIGH;
+
+        return MODE_OK;
+}
+
 static struct dw_hdmi_plat_data imx6q_hdmi_drv_data = {
-        .mpll_cfg = imx_mpll_cfg,
-        .cur_ctr  = imx_cur_ctr,
-        .sym_term = imx_sym_term,
-        .dev_type = IMX6Q_HDMI,
+        .mpll_cfg   = imx_mpll_cfg,
+        .cur_ctr    = imx_cur_ctr,
+        .sym_term   = imx_sym_term,
+        .dev_type   = IMX6Q_HDMI,
+        .mode_valid = imx6q_hdmi_mode_valid,
 };
 
 static struct dw_hdmi_plat_data imx6dl_hdmi_drv_data = {
@@ -148,6 +173,7 @@ static struct dw_hdmi_plat_data imx6dl_hdmi_drv_data = {
         .cur_ctr  = imx_cur_ctr,
         .sym_term = imx_sym_term,
         .dev_type = IMX6DL_HDMI,
+        .mode_valid = imx6dl_hdmi_mode_valid,
 };
 
 static const struct of_device_id dw_hdmi_imx_dt_ids[] = {
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 1b86aac0b341..2d6dc94e1e64 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -163,22 +163,7 @@ static void imx_ldb_encoder_prepare(struct drm_encoder *encoder)
 {
         struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
         struct imx_ldb *ldb = imx_ldb_ch->ldb;
-        struct drm_display_mode *mode = &encoder->crtc->hwmode;
         u32 pixel_fmt;
-        unsigned long serial_clk;
-        unsigned long di_clk = mode->clock * 1000;
-        int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
-
-        if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) {
-                /* dual channel LVDS mode */
-                serial_clk = 3500UL * mode->clock;
-                imx_ldb_set_clock(ldb, mux, 0, serial_clk, di_clk);
-                imx_ldb_set_clock(ldb, mux, 1, serial_clk, di_clk);
-        } else {
-                serial_clk = 7000UL * mode->clock;
-                imx_ldb_set_clock(ldb, mux, imx_ldb_ch->chno, serial_clk,
-                                di_clk);
-        }
 
         switch (imx_ldb_ch->chno) {
         case 0:
@@ -247,6 +232,9 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
         struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
         struct imx_ldb *ldb = imx_ldb_ch->ldb;
         int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
+        unsigned long serial_clk;
+        unsigned long di_clk = mode->clock * 1000;
+        int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
 
         if (mode->clock > 170000) {
                 dev_warn(ldb->dev,
@@ -257,6 +245,16 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
                          "%s: mode exceeds 85 MHz pixel clock\n", __func__);
         }
 
+        if (dual) {
+                serial_clk = 3500UL * mode->clock;
+                imx_ldb_set_clock(ldb, mux, 0, serial_clk, di_clk);
+                imx_ldb_set_clock(ldb, mux, 1, serial_clk, di_clk);
+        } else {
+                serial_clk = 7000UL * mode->clock;
+                imx_ldb_set_clock(ldb, mux, imx_ldb_ch->chno, serial_clk,
+                                  di_clk);
+        }
+
         /* FIXME - assumes straight connections DI0 --> CH0, DI1 --> CH1 */
         if (imx_ldb_ch == &ldb->channel[0]) {
                 if (mode->flags & DRM_MODE_FLAG_NVSYNC)
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 5e83e007080f..900dda6a8e71 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -236,8 +236,11 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
         }
 
         panel_node = of_parse_phandle(np, "fsl,panel", 0);
-        if (panel_node)
+        if (panel_node) {
                 imxpd->panel = of_drm_find_panel(panel_node);
+                if (!imxpd->panel)
+                        return -EPROBE_DEFER;
+        }
 
         imxpd->dev = dev;
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
index 8edd531cb621..7369ee7f0c55 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_irq.c
@@ -32,7 +32,10 @@ static void mdp4_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
 void mdp4_irq_preinstall(struct msm_kms *kms)
 {
         struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        mdp4_enable(mdp4_kms);
         mdp4_write(mdp4_kms, REG_MDP4_INTR_CLEAR, 0xffffffff);
+        mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+        mdp4_disable(mdp4_kms);
 }
 
 int mdp4_irq_postinstall(struct msm_kms *kms)
@@ -53,7 +56,9 @@ int mdp4_irq_postinstall(struct msm_kms *kms)
 void mdp4_irq_uninstall(struct msm_kms *kms)
 {
         struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+        mdp4_enable(mdp4_kms);
         mdp4_write(mdp4_kms, REG_MDP4_INTR_ENABLE, 0x00000000);
+        mdp4_disable(mdp4_kms);
 }
 
 irqreturn_t mdp4_irq(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
index 09b4a25eb553..c276624290af 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5.xml.h
@@ -8,17 +8,9 @@ http://github.com/freedreno/envytools/
 git clone https://github.com/freedreno/envytools.git
 
 The rules-ng-ng source files this header was generated from are:
-- /home/robclark/src/freedreno/envytools/rnndb/msm.xml                 (    676 bytes, from 2014-12-05 15:34:49)
-- /home/robclark/src/freedreno/envytools/rnndb/freedreno_copyright.xml (   1453 bytes, from 2013-03-31 16:51:27)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp4.xml            (  20908 bytes, from 2014-12-08 16:13:00)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp_common.xml      (   2357 bytes, from 2014-12-08 16:13:00)
-- /home/robclark/src/freedreno/envytools/rnndb/mdp/mdp5.xml            (  27208 bytes, from 2015-01-13 23:56:11)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/dsi.xml             (  11712 bytes, from 2013-08-17 17:13:43)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/sfpb.xml            (    344 bytes, from 2013-08-11 19:26:32)
-- /home/robclark/src/freedreno/envytools/rnndb/dsi/mmss_cc.xml         (   1686 bytes, from 2014-10-31 16:48:57)
-- /home/robclark/src/freedreno/envytools/rnndb/hdmi/qfprom.xml         (    600 bytes, from 2013-07-05 19:21:12)
-- /home/robclark/src/freedreno/envytools/rnndb/hdmi/hdmi.xml           (  26848 bytes, from 2015-01-13 23:55:57)
-- /home/robclark/src/freedreno/envytools/rnndb/edp/edp.xml             (   8253 bytes, from 2014-12-08 16:13:00)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/mdp/mdp5.xml            (  27229 bytes, from 2015-02-10 17:00:41)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/freedreno_copyright.xml (   1453 bytes, from 2014-06-02 18:31:15)
+- /local/mnt2/workspace2/sviau/envytools/rnndb/mdp/mdp_common.xml      (   2357 bytes, from 2015-01-23 16:20:19)
 
 Copyright (C) 2013-2015 by the following authors:
 - Rob Clark <robdclark@gmail.com> (robclark)
@@ -910,6 +902,7 @@ static inline uint32_t __offset_LM(uint32_t idx)
                 case 2: return (mdp5_cfg->lm.base[2]);
                 case 3: return (mdp5_cfg->lm.base[3]);
                 case 4: return (mdp5_cfg->lm.base[4]);
+                case 5: return (mdp5_cfg->lm.base[5]);
                 default: return INVALID_IDX(idx);
         }
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 46fac545dc2b..2f2863cf8b45 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -62,8 +62,8 @@ struct mdp5_crtc {
 
                 /* current cursor being scanned out: */
                 struct drm_gem_object *scanout_bo;
-                uint32_t width;
-                uint32_t height;
+                uint32_t width, height;
+                uint32_t x, y;
         } cursor;
 };
 #define to_mdp5_crtc(x) container_of(x, struct mdp5_crtc, base)
@@ -103,8 +103,8 @@ static void crtc_flush_all(struct drm_crtc *crtc)
         struct drm_plane *plane;
         uint32_t flush_mask = 0;
 
-        /* we could have already released CTL in the disable path: */
-        if (!mdp5_crtc->ctl)
+        /* this should not happen: */
+        if (WARN_ON(!mdp5_crtc->ctl))
                 return;
 
         drm_atomic_crtc_for_each_plane(plane, crtc) {
@@ -143,6 +143,11 @@ static void complete_flip(struct drm_crtc *crtc, struct drm_file *file)
         drm_atomic_crtc_for_each_plane(plane, crtc) {
                 mdp5_plane_complete_flip(plane);
         }
+
+        if (mdp5_crtc->ctl && !crtc->state->enable) {
+                mdp5_ctl_release(mdp5_crtc->ctl);
+                mdp5_crtc->ctl = NULL;
+        }
 }
 
 static void unref_cursor_worker(struct drm_flip_work *work, void *val)
@@ -386,14 +391,17 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc)
         mdp5_crtc->event = crtc->state->event;
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
+        /*
+         * If no CTL has been allocated in mdp5_crtc_atomic_check(),
+         * it means we are trying to flush a CRTC whose state is disabled:
+         * nothing else needs to be done.
+         */
+        if (unlikely(!mdp5_crtc->ctl))
+                return;
+
         blend_setup(crtc);
         crtc_flush_all(crtc);
         request_pending(crtc, PENDING_FLIP);
-
-        if (mdp5_crtc->ctl && !crtc->state->enable) {
-                mdp5_ctl_release(mdp5_crtc->ctl);
-                mdp5_crtc->ctl = NULL;
-        }
 }
 
 static int mdp5_crtc_set_property(struct drm_crtc *crtc,
@@ -403,6 +411,32 @@ static int mdp5_crtc_set_property(struct drm_crtc *crtc,
         return -EINVAL;
 }
 
+static void get_roi(struct drm_crtc *crtc, uint32_t *roi_w, uint32_t *roi_h)
+{
+        struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
+        uint32_t xres = crtc->mode.hdisplay;
+        uint32_t yres = crtc->mode.vdisplay;
+
+        /*
+         * Cursor Region Of Interest (ROI) is a plane read from cursor
+         * buffer to render. The ROI region is determined by the visibility of
+         * the cursor point. In the default Cursor image the cursor point will
+         * be at the top left of the cursor image, unless it is specified
+         * otherwise using hotspot feature.
+         *
+         * If the cursor point reaches the right (xres - x < cursor.width) or
+         * bottom (yres - y < cursor.height) boundary of the screen, then ROI
+         * width and ROI height need to be evaluated to crop the cursor image
+         * accordingly.
+         * (xres-x) will be new cursor width when x > (xres - cursor.width)
+         * (yres-y) will be new cursor height when y > (yres - cursor.height)
+         */
+        *roi_w = min(mdp5_crtc->cursor.width, xres -
+                        mdp5_crtc->cursor.x);
+        *roi_h = min(mdp5_crtc->cursor.height, yres -
+                        mdp5_crtc->cursor.y);
+}
+
 static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
                 struct drm_file *file, uint32_t handle,
                 uint32_t width, uint32_t height)
@@ -416,6 +450,7 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         unsigned int depth;
         enum mdp5_cursor_alpha cur_alpha = CURSOR_ALPHA_PER_PIXEL;
         uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
+        uint32_t roi_w, roi_h;
         unsigned long flags;
 
         if ((width > CURSOR_WIDTH) || (height > CURSOR_HEIGHT)) {
@@ -446,6 +481,12 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         old_bo = mdp5_crtc->cursor.scanout_bo;
 
+        mdp5_crtc->cursor.scanout_bo = cursor_bo;
+        mdp5_crtc->cursor.width = width;
+        mdp5_crtc->cursor.height = height;
+
+        get_roi(crtc, &roi_w, &roi_h);
+
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
                         MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
@@ -453,19 +494,14 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
                         MDP5_LM_CURSOR_IMG_SIZE_SRC_H(height) |
                         MDP5_LM_CURSOR_IMG_SIZE_SRC_W(width));
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
-                        MDP5_LM_CURSOR_SIZE_ROI_H(height) |
-                        MDP5_LM_CURSOR_SIZE_ROI_W(width));
+                        MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
+                        MDP5_LM_CURSOR_SIZE_ROI_W(roi_w));
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BASE_ADDR(lm), cursor_addr);
 
-
         blendcfg = MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_EN;
-        blendcfg |= MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_TRANSP_EN;
         blendcfg |= MDP5_LM_CURSOR_BLEND_CONFIG_BLEND_ALPHA_SEL(cur_alpha);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_BLEND_CONFIG(lm), blendcfg);
 
-        mdp5_crtc->cursor.scanout_bo = cursor_bo;
-        mdp5_crtc->cursor.width = width;
-        mdp5_crtc->cursor.height = height;
         spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
 
         ret = mdp5_ctl_set_cursor(mdp5_crtc->ctl, true);
@@ -489,31 +525,18 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
         struct mdp5_kms *mdp5_kms = get_kms(crtc);
         struct mdp5_crtc *mdp5_crtc = to_mdp5_crtc(crtc);
         uint32_t flush_mask = mdp_ctl_flush_mask_cursor(0);
-        uint32_t xres = crtc->mode.hdisplay;
-        uint32_t yres = crtc->mode.vdisplay;
         uint32_t roi_w;
         uint32_t roi_h;
         unsigned long flags;
 
-        x = (x > 0) ? x : 0;
-        y = (y > 0) ? y : 0;
+        /* In case the CRTC is disabled, just drop the cursor update */
+        if (unlikely(!crtc->state->enable))
+                return 0;
 
-        /*
-         * Cursor Region Of Interest (ROI) is a plane read from cursor
-         * buffer to render. The ROI region is determined by the visiblity of
-         * the cursor point. In the default Cursor image the cursor point will
-         * be at the top left of the cursor image, unless it is specified
-         * otherwise using hotspot feature.
-         *
-         * If the cursor point reaches the right (xres - x < cursor.width) or
-         * bottom (yres - y < cursor.height) boundary of the screen, then ROI
-         * width and ROI height need to be evaluated to crop the cursor image
-         * accordingly.
-         * (xres-x) will be new cursor width when x > (xres - cursor.width)
-         * (yres-y) will be new cursor height when y > (yres - cursor.height)
-         */
-        roi_w = min(mdp5_crtc->cursor.width, xres - x);
-        roi_h = min(mdp5_crtc->cursor.height, yres - y);
+        mdp5_crtc->cursor.x = x = max(x, 0);
+        mdp5_crtc->cursor.y = y = max(y, 0);
+
+        get_roi(crtc, &roi_w, &roi_h);
 
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(mdp5_crtc->lm),
@@ -544,8 +567,8 @@ static const struct drm_crtc_funcs mdp5_crtc_funcs = {
 static const struct drm_crtc_helper_funcs mdp5_crtc_helper_funcs = {
         .mode_fixup = mdp5_crtc_mode_fixup,
         .mode_set_nofb = mdp5_crtc_mode_set_nofb,
-        .prepare = mdp5_crtc_disable,
-        .commit = mdp5_crtc_enable,
+        .disable = mdp5_crtc_disable,
+        .enable = mdp5_crtc_enable,
         .atomic_check = mdp5_crtc_atomic_check,
         .atomic_begin = mdp5_crtc_atomic_begin,
         .atomic_flush = mdp5_crtc_atomic_flush,
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
index d6a14bb99988..af0e02fa4f48 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
@@ -267,14 +267,14 @@ static void mdp5_encoder_enable(struct drm_encoder *encoder)
         mdp5_write(mdp5_kms, REG_MDP5_INTF_TIMING_ENGINE_EN(intf), 1);
         spin_unlock_irqrestore(&mdp5_encoder->intf_lock, flags);
 
-        mdp5_encoder->enabled = false;
+        mdp5_encoder->enabled = true;
 }
 
 static const struct drm_encoder_helper_funcs mdp5_encoder_helper_funcs = {
         .mode_fixup = mdp5_encoder_mode_fixup,
         .mode_set = mdp5_encoder_mode_set,
-        .prepare = mdp5_encoder_disable,
-        .commit = mdp5_encoder_enable,
+        .disable = mdp5_encoder_disable,
+        .enable = mdp5_encoder_enable,
 };
 
 /* initialize encoder */
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
index 70ac81edd40f..a9407105b9b7 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -34,7 +34,10 @@ static void mdp5_irq_error_handler(struct mdp_irq *irq, uint32_t irqstatus)
 void mdp5_irq_preinstall(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        mdp5_enable(mdp5_kms);
         mdp5_write(mdp5_kms, REG_MDP5_INTR_CLEAR, 0xffffffff);
+        mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+        mdp5_disable(mdp5_kms);
 }
 
 int mdp5_irq_postinstall(struct msm_kms *kms)
@@ -57,7 +60,9 @@ int mdp5_irq_postinstall(struct msm_kms *kms)
 void mdp5_irq_uninstall(struct msm_kms *kms)
 {
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        mdp5_enable(mdp5_kms);
         mdp5_write(mdp5_kms, REG_MDP5_INTR_EN, 0x00000000);
+        mdp5_disable(mdp5_kms);
 }
 
 static void mdp5_irq_mdp(struct mdp_kms *mdp_kms)
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 871aa2108dc6..18fd643b6e69 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -219,8 +219,10 @@ int msm_atomic_commit(struct drm_device *dev,
          * mark our set of crtc's as busy:
          */
         ret = start_atomic(dev->dev_private, c->crtc_mask);
-        if (ret)
+        if (ret) {
+                kfree(c);
                 return ret;
+        }
 
         /*
          * This is the point of no return - everything below never fails except
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 79924e4b1b49..6751553abe4a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -418,7 +418,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
         nouveau_fbcon_zfill(dev, fbcon);
 
         /* To allow resizeing without swapping buffers */
-        NV_INFO(drm, "allocated %dx%d fb: 0x%lx, bo %p\n",
+        NV_INFO(drm, "allocated %dx%d fb: 0x%llx, bo %p\n",
                 nouveau_fb->base.width, nouveau_fb->base.height,
                 nvbo->bo.offset, nvbo);
 
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index ed644a4f6f57..86807ee91bd1 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                (x << 16) | y);
         viewport_w = crtc->mode.hdisplay;
         viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+        if ((rdev->family >= CHIP_BONAIRE) &&
+            (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
+                viewport_h *= 2;
         WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
                (viewport_w << 16) | viewport_h);
 
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 5bf825dfaa09..8d74de82456e 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -178,6 +178,13 @@ radeon_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
         switch (msg->request & ~DP_AUX_I2C_MOT) {
         case DP_AUX_NATIVE_WRITE:
         case DP_AUX_I2C_WRITE:
+                /* The atom implementation only supports writes with a max payload of
+                 * 12 bytes since it uses 4 bits for the total count (header + payload)
+                 * in the parameter space.  The atom interface supports 16 byte
+                 * payloads for reads. The hw itself supports up to 16 bytes of payload.
+                 */
+                if (WARN_ON_ONCE(msg->size > 12))
+                        return -E2BIG;
                 /* tx_size needs to be 4 even for bare address packets since the atom
                  * table needs the info in tx_buf[3].
                  */
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 7c9df1eac065..c39c1d0d9d4e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -731,7 +731,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 dig_connector = radeon_connector->con_priv;
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                     (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
-                        if (radeon_audio != 0 && ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
+                        if (radeon_audio != 0 &&
+                            drm_detect_monitor_audio(radeon_connector_edid(connector)) &&
+                            ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
                                 return ATOM_ENCODER_MODE_DP_AUDIO;
                         return ATOM_ENCODER_MODE_DP;
                 } else if (radeon_audio != 0) {
@@ -747,7 +749,9 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 }
                 break;
         case DRM_MODE_CONNECTOR_eDP:
-                if (radeon_audio != 0 && ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
+                if (radeon_audio != 0 &&
+                    drm_detect_monitor_audio(radeon_connector_edid(connector)) &&
+                    ASIC_IS_DCE4(rdev) && !ASIC_IS_DCE5(rdev))
                         return ATOM_ENCODER_MODE_DP_AUDIO;
                 return ATOM_ENCODER_MODE_DP;
         case DRM_MODE_CONNECTOR_DVIA:
@@ -1622,7 +1626,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
         struct radeon_connector *radeon_connector = NULL;
         struct radeon_connector_atom_dig *radeon_dig_connector = NULL;
         bool travis_quirk = false;
-        int encoder_mode;
 
         if (connector) {
                 radeon_connector = to_radeon_connector(connector);
@@ -1718,11 +1721,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                 }
                 break;
         }
-
-        encoder_mode = atombios_get_encoder_mode(encoder);
-        if (radeon_audio != 0 &&
-                (encoder_mode == ATOM_ENCODER_MODE_HDMI || ENCODER_MODE_IS_DP(encoder_mode)))
-                radeon_audio_dpms(encoder, mode);
 }
 
 static void
@@ -1731,10 +1729,19 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        int encoder_mode = atombios_get_encoder_mode(encoder);
 
         DRM_DEBUG_KMS("encoder dpms %d to mode %d, devices %08x, active_devices %08x\n",
                   radeon_encoder->encoder_id, mode, radeon_encoder->devices,
                   radeon_encoder->active_device);
+
+        if (connector && (radeon_audio != 0) &&
+            ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
+             (ENCODER_MODE_IS_DP(encoder_mode) &&
+              drm_detect_monitor_audio(radeon_connector_edid(connector)))))
+                radeon_audio_dpms(encoder, mode);
+
         switch (radeon_encoder->encoder_id) {
         case ENCODER_OBJECT_ID_INTERNAL_TMDS1:
         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
@@ -2136,6 +2143,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         int encoder_mode;
 
         radeon_encoder->pixel_clock = adjusted_mode->clock;
@@ -2163,10 +2171,6 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
                 /* handled in dpms */
-                encoder_mode = atombios_get_encoder_mode(encoder);
-                if (radeon_audio != 0 &&
-                        (encoder_mode == ATOM_ENCODER_MODE_HDMI || ENCODER_MODE_IS_DP(encoder_mode)))
-                        radeon_audio_mode_set(encoder, adjusted_mode);
                 break;
         case ENCODER_OBJECT_ID_INTERNAL_DDI:
         case ENCODER_OBJECT_ID_INTERNAL_DVO1:
@@ -2188,6 +2192,13 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         }
 
         atombios_apply_encoder_quirks(encoder, adjusted_mode);
+
+        encoder_mode = atombios_get_encoder_mode(encoder);
+        if (connector && (radeon_audio != 0) &&
+            ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
+             (ENCODER_MODE_IS_DP(encoder_mode) &&
+              drm_detect_monitor_audio(radeon_connector_edid(connector)))))
+                radeon_audio_mode_set(encoder, adjusted_mode);
 }
 
 static bool
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6a4ba236c70..3e670d344a20 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3613,6 +3613,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         WREG32(BIF_FB_EN, FB_READ_EN | FB_WRITE_EN);
 
@@ -7230,6 +7232,8 @@ static void cik_disable_interrupt_state(struct radeon_device *rdev)
         WREG32(CP_ME2_PIPE3_INT_CNTL, 0);
         /* grbm */
         WREG32(GRBM_INT_CNTL, 0);
+        /* SRBM */
+        WREG32(SRBM_INT_CNTL, 0);
         /* vline/vblank, etc. */
         WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(LB_INTERRUPT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
@@ -7551,6 +7555,9 @@ int cik_irq_set(struct radeon_device *rdev)
         WREG32(DC_HPD5_INT_CONTROL, hpd5);
         WREG32(DC_HPD6_INT_CONTROL, hpd6);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -8046,6 +8053,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/cikd.h b/drivers/gpu/drm/radeon/cikd.h
index 03003f8a6de6..c648e1996dab 100644
--- a/drivers/gpu/drm/radeon/cikd.h
+++ b/drivers/gpu/drm/radeon/cikd.h
@@ -482,6 +482,10 @@
 #define         SOFT_RESET_ORB                          (1 << 23)
 #define         SOFT_RESET_VCE                          (1 << 24)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define VM_L2_CNTL                                      0x1400
 #define         ENABLE_L2_CACHE                                 (1 << 0)
 #define         ENABLE_L2_FRAGMENT_PROCESSING                   (1 << 1)
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 192c80389151..3adc2afe32aa 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -26,6 +26,9 @@
 #include "radeon_audio.h"
 #include "sid.h"
 
+#define DCE8_DCCG_AUDIO_DTO1_PHASE      0x05b8
+#define DCE8_DCCG_AUDIO_DTO1_MODULE     0x05bc
+
 u32 dce6_endpoint_rreg(struct radeon_device *rdev,
                               u32 block_offset, u32 reg)
 {
@@ -252,72 +255,67 @@ void dce6_audio_enable(struct radeon_device *rdev,
 void dce6_hdmi_audio_set_dto(struct radeon_device *rdev,
         struct radeon_crtc *crtc, unsigned int clock)
 {
-    /* Two dtos; generally use dto0 for HDMI */
+        /* Two dtos; generally use dto0 for HDMI */
         u32 value = 0;
 
-    if (crtc)
+        if (crtc)
                 value |= DCCG_AUDIO_DTO0_SOURCE_SEL(crtc->crtc_id);
 
         WREG32(DCCG_AUDIO_DTO_SOURCE, value);
 
-    /* Express [24MHz / target pixel clock] as an exact rational
-     * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
-     * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
-     */
-    WREG32(DCCG_AUDIO_DTO0_PHASE, 24000);
-    WREG32(DCCG_AUDIO_DTO0_MODULE, clock);
+        /* Express [24MHz / target pixel clock] as an exact rational
+         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+         */
+        WREG32(DCCG_AUDIO_DTO0_PHASE, 24000);
+        WREG32(DCCG_AUDIO_DTO0_MODULE, clock);
 }
 
 void dce6_dp_audio_set_dto(struct radeon_device *rdev,
         struct radeon_crtc *crtc, unsigned int clock)
 {
-    /* Two dtos; generally use dto1 for DP */
+        /* Two dtos; generally use dto1 for DP */
         u32 value = 0;
         value |= DCCG_AUDIO_DTO_SEL;
 
-    if (crtc)
+        if (crtc)
                 value |= DCCG_AUDIO_DTO0_SOURCE_SEL(crtc->crtc_id);
 
         WREG32(DCCG_AUDIO_DTO_SOURCE, value);
 
-    /* Express [24MHz / target pixel clock] as an exact rational
-     * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
-     * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
-     */
-    WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
-    WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
+        /* Express [24MHz / target pixel clock] as an exact rational
+         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
+         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
+         */
+        if (ASIC_IS_DCE8(rdev)) {
+                WREG32(DCE8_DCCG_AUDIO_DTO1_PHASE, 24000);
+                WREG32(DCE8_DCCG_AUDIO_DTO1_MODULE, clock);
+        } else {
+                WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
+                WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
+        }
 }
 
-void dce6_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
+void dce6_dp_enable(struct drm_encoder *encoder, bool enable)
 {
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        uint32_t offset;
 
         if (!dig || !dig->afmt)
                 return;
 
-        offset = dig->afmt->offset;
-
         if (enable) {
-        if (dig->afmt->enabled)
-            return;
-
-                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + offset, EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset,
-                        EVERGREEN_DP_SEC_ASP_ENABLE |           /* Audio packet transmission */
-                        EVERGREEN_DP_SEC_ATP_ENABLE |           /* Audio timestamp packet transmission */
-                        EVERGREEN_DP_SEC_AIP_ENABLE |           /* Audio infoframe packet transmission */
-                        EVERGREEN_DP_SEC_STREAM_ENABLE);        /* Master enable for secondary stream engine */
-                radeon_audio_enable(rdev, dig->afmt->pin, true);
+                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_ASP_ENABLE |            /* Audio packet transmission */
+                       EVERGREEN_DP_SEC_ATP_ENABLE |            /* Audio timestamp packet transmission */
+                       EVERGREEN_DP_SEC_AIP_ENABLE |            /* Audio infoframe packet transmission */
+                       EVERGREEN_DP_SEC_STREAM_ENABLE); /* Master enable for secondary stream engine */
         } else {
-                if (!dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset, 0);
-                radeon_audio_enable(rdev, dig->afmt->pin, false);
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 78600f534c80..973df064c14f 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3253,6 +3253,8 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -4324,6 +4326,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
         tmp = RREG32(DMA_CNTL) & ~TRAP_ENABLE;
         WREG32(DMA_CNTL, tmp);
         WREG32(GRBM_INT_CNTL, 0);
+        WREG32(SRBM_INT_CNTL, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
         if (rdev->num_crtc >= 4) {
@@ -4590,6 +4593,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
         WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
         WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -5066,6 +5072,10 @@ restart_ih:
                                 DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
                                 break;
                         }
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 1d9aebc79595..c18d4ecbd95d 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -272,7 +272,7 @@ void dce4_hdmi_audio_set_dto(struct radeon_device *rdev,
 }
 
 void dce4_dp_audio_set_dto(struct radeon_device *rdev,
-        struct radeon_crtc *crtc, unsigned int clock)
+                           struct radeon_crtc *crtc, unsigned int clock)
 {
         u32 value;
 
@@ -294,7 +294,7 @@ void dce4_dp_audio_set_dto(struct radeon_device *rdev,
          * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
          */
         WREG32(DCCG_AUDIO_DTO1_PHASE, 24000);
-        WREG32(DCCG_AUDIO_DTO1_MODULE, rdev->clock.max_pixel_clock * 10);
+        WREG32(DCCG_AUDIO_DTO1_MODULE, clock);
 }
 
 void dce4_set_vbi_packet(struct drm_encoder *encoder, u32 offset)
@@ -350,20 +350,9 @@ void dce4_set_audio_packet(struct drm_encoder *encoder, u32 offset)
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
 
-        WREG32(HDMI_INFOFRAME_CONTROL0 + offset,
-                HDMI_AUDIO_INFO_SEND | /* enable audio info frames (frames won't be set until audio is enabled) */
-                HDMI_AUDIO_INFO_CONT); /* required for audio info values to be updated */
-
         WREG32(AFMT_INFOFRAME_CONTROL0 + offset,
                 AFMT_AUDIO_INFO_UPDATE); /* required for audio info values to be updated */
 
-        WREG32(HDMI_INFOFRAME_CONTROL1 + offset,
-                HDMI_AUDIO_INFO_LINE(2)); /* anything other than 0 */
-
-        WREG32(HDMI_AUDIO_PACKET_CONTROL + offset,
-                HDMI_AUDIO_DELAY_EN(1) | /* set the default audio delay */
-                HDMI_AUDIO_PACKETS_PER_LINE(3)); /* should be suffient for all audio modes and small enough for all hblanks */
-
         WREG32(AFMT_60958_0 + offset,
                 AFMT_60958_CS_CHANNEL_NUMBER_L(1));
 
@@ -408,15 +397,19 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!dig || !dig->afmt)
                 return;
 
-        /* Silent, r600_hdmi_enable will raise WARN for us */
-        if (enable && dig->afmt->enabled)
-                return;
-        if (!enable && !dig->afmt->enabled)
-                return;
+        if (enable) {
+                WREG32(HDMI_INFOFRAME_CONTROL1 + dig->afmt->offset,
+                       HDMI_AUDIO_INFO_LINE(2)); /* anything other than 0 */
+
+                WREG32(HDMI_AUDIO_PACKET_CONTROL + dig->afmt->offset,
+                       HDMI_AUDIO_DELAY_EN(1) | /* set the default audio delay */
+                       HDMI_AUDIO_PACKETS_PER_LINE(3)); /* should be suffient for all audio modes and small enough for all hblanks */
 
-        if (!enable && dig->afmt->pin) {
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                dig->afmt->pin = NULL;
+                WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset,
+                       HDMI_AUDIO_INFO_SEND | /* enable audio info frames (frames won't be set until audio is enabled) */
+                       HDMI_AUDIO_INFO_CONT); /* required for audio info values to be updated */
+        } else {
+                WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
@@ -425,33 +418,28 @@ void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable)
                   enable ? "En" : "Dis", dig->afmt->offset, radeon_encoder->encoder_id);
 }
 
-void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
+void evergreen_dp_enable(struct drm_encoder *encoder, bool enable)
 {
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        uint32_t offset;
 
         if (!dig || !dig->afmt)
                 return;
 
-        offset = dig->afmt->offset;
-
         if (enable) {
                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
                 struct radeon_connector *radeon_connector = to_radeon_connector(connector);
                 struct radeon_connector_atom_dig *dig_connector;
                 uint32_t val;
 
-                if (dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + offset, EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
+                WREG32(EVERGREEN_DP_SEC_TIMESTAMP + dig->afmt->offset,
+                       EVERGREEN_DP_SEC_TIMESTAMP_MODE(1));
 
                 if (radeon_connector->con_priv) {
                         dig_connector = radeon_connector->con_priv;
-                        val = RREG32(EVERGREEN_DP_SEC_AUD_N + offset);
+                        val = RREG32(EVERGREEN_DP_SEC_AUD_N + dig->afmt->offset);
                         val &= ~EVERGREEN_DP_SEC_N_BASE_MULTIPLE(0xf);
 
                         if (dig_connector->dp_clock == 162000)
@@ -459,21 +447,16 @@ void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable)
                         else
                                 val |= EVERGREEN_DP_SEC_N_BASE_MULTIPLE(5);
 
-                        WREG32(EVERGREEN_DP_SEC_AUD_N + offset, val);
+                        WREG32(EVERGREEN_DP_SEC_AUD_N + dig->afmt->offset, val);
                 }
 
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset,
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset,
                         EVERGREEN_DP_SEC_ASP_ENABLE |           /* Audio packet transmission */
                         EVERGREEN_DP_SEC_ATP_ENABLE |           /* Audio timestamp packet transmission */
                         EVERGREEN_DP_SEC_AIP_ENABLE |           /* Audio infoframe packet transmission */
                         EVERGREEN_DP_SEC_STREAM_ENABLE);        /* Master enable for secondary stream engine */
-                radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
         } else {
-                if (!dig->afmt->enabled)
-                        return;
-
-                WREG32(EVERGREEN_DP_SEC_CNTL + offset, 0);
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
+                WREG32(EVERGREEN_DP_SEC_CNTL + dig->afmt->offset, 0);
         }
 
         dig->afmt->enabled = enable;
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index ee83d2a88750..a8d1d5240fcb 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -1191,6 +1191,10 @@
 #define         SOFT_RESET_REGBB                        (1 << 22)
 #define         SOFT_RESET_ORB                          (1 << 23)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 /* display watermarks */
 #define DC_LB_MEMORY_SPLIT                                0x6b0c
 #define PRIORITY_A_CNT                                    0x6b18
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 24242a7f0ac3..dab00812abaa 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -962,6 +962,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 0x1);
+        WREG32(SRBM_INT_ACK, 0x1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -1086,12 +1088,12 @@ static void cayman_gpu_init(struct radeon_device *rdev)
 
         if ((rdev->config.cayman.max_backends_per_se == 1) &&
             (rdev->flags & RADEON_IS_IGP)) {
-                if ((disabled_rb_mask & 3) == 1) {
-                        /* RB0 disabled, RB1 enabled */
-                        tmp = 0x11111111;
-                } else {
+                if ((disabled_rb_mask & 3) == 2) {
                         /* RB1 disabled, RB0 enabled */
                         tmp = 0x00000000;
+                } else {
+                        /* RB0 disabled, RB1 enabled */
+                        tmp = 0x11111111;
                 }
         } else {
                 tmp = gb_addr_config & NUM_PIPES_MASK;
diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
index ad7125486894..6b44580440d0 100644
--- a/drivers/gpu/drm/radeon/nid.h
+++ b/drivers/gpu/drm/radeon/nid.h
@@ -82,6 +82,10 @@
 #define         SOFT_RESET_REGBB                        (1 << 22)
 #define         SOFT_RESET_ORB                          (1 << 23)
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define SRBM_STATUS2                                    0x0EC4
 #define         DMA_BUSY                                (1 << 5)
 #define         DMA1_BUSY                               (1 << 6)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 279801ca5110..04f2514f7564 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *rdev)
                 tmp |= RADEON_FP2_DETECT_MASK;
         }
         WREG32(RADEON_GEN_INT_CNTL, tmp);
+
+        /* read back to post the write */
+        RREG32(RADEON_GEN_INT_CNTL);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 07a71a2488c9..2fcad344492f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3784,6 +3784,9 @@ int r600_irq_set(struct radeon_device *rdev)
                 WREG32(RV770_CG_THERMAL_INT, thermal_int);
         }
 
+        /* posting read */
+        RREG32(R_000E50_SRBM_STATUS);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 843b65f46ece..fa2154493cf1 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -188,7 +188,7 @@ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
                 list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                         radeon_crtc = to_radeon_crtc(crtc);
                         if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-                                vrefresh = radeon_crtc->hw_mode.vrefresh;
+                                vrefresh = drm_mode_vrefresh(&radeon_crtc->hw_mode);
                                 break;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 62c91ed669ce..dd6606b8e23c 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -476,17 +476,6 @@ void r600_hdmi_enable(struct drm_encoder *encoder, bool enable)
         if (!dig || !dig->afmt)
                 return;
 
-        /* Silent, r600_hdmi_enable will raise WARN for us */
-        if (enable && dig->afmt->enabled)
-                return;
-        if (!enable && !dig->afmt->enabled)
-                return;
-
-        if (!enable && dig->afmt->pin) {
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                dig->afmt->pin = NULL;
-        }
-
         /* Older chipsets require setting HDMI and routing manually */
         if (!ASIC_IS_DCE3(rdev)) {
                 if (enable)
diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
index a3ceef6d9632..b21ef69a34ac 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -101,8 +101,8 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
         struct drm_display_mode *mode);
 void r600_hdmi_enable(struct drm_encoder *encoder, bool enable);
 void evergreen_hdmi_enable(struct drm_encoder *encoder, bool enable);
-void evergreen_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable);
-void dce6_enable_dp_audio_packets(struct drm_encoder *encoder, bool enable);
+void evergreen_dp_enable(struct drm_encoder *encoder, bool enable);
+void dce6_dp_enable(struct drm_encoder *encoder, bool enable);
 
 static const u32 pin_offsets[7] =
 {
@@ -210,7 +210,7 @@ static struct radeon_audio_funcs dce4_dp_funcs = {
         .set_avi_packet = evergreen_set_avi_packet,
         .set_audio_packet = dce4_set_audio_packet,
         .mode_set = radeon_audio_dp_mode_set,
-        .dpms = evergreen_enable_dp_audio_packets,
+        .dpms = evergreen_dp_enable,
 };
 
 static struct radeon_audio_funcs dce6_hdmi_funcs = {
@@ -240,7 +240,7 @@ static struct radeon_audio_funcs dce6_dp_funcs = {
         .set_avi_packet = evergreen_set_avi_packet,
         .set_audio_packet = dce4_set_audio_packet,
         .mode_set = radeon_audio_dp_mode_set,
-        .dpms = dce6_enable_dp_audio_packets,
+        .dpms = dce6_dp_enable,
 };
 
 static void radeon_audio_interface_init(struct radeon_device *rdev)
@@ -452,7 +452,7 @@ void radeon_audio_enable(struct radeon_device *rdev,
 }
 
 void radeon_audio_detect(struct drm_connector *connector,
-        enum drm_connector_status status)
+                         enum drm_connector_status status)
 {
         struct radeon_device *rdev;
         struct radeon_encoder *radeon_encoder;
@@ -483,14 +483,11 @@ void radeon_audio_detect(struct drm_connector *connector,
                 else
                         radeon_encoder->audio = rdev->audio.hdmi_funcs;
 
-                radeon_audio_write_speaker_allocation(connector->encoder);
-                radeon_audio_write_sad_regs(connector->encoder);
-                if (connector->encoder->crtc)
-                        radeon_audio_write_latency_fields(connector->encoder,
-                                &connector->encoder->crtc->mode);
+                dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
                 radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
         } else {
                 radeon_audio_enable(rdev, dig->afmt->pin, 0);
+                dig->afmt->pin = NULL;
         }
 }
 
@@ -694,23 +691,22 @@ static void radeon_audio_set_mute(struct drm_encoder *encoder, bool mute)
  * update the info frames with the data from the current display mode
  */
 static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                                       struct drm_display_mode *mode)
 {
-        struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 
         if (!dig || !dig->afmt)
                 return;
 
-        /* disable audio prior to setting up hw */
-        dig->afmt->pin = radeon_audio_get_pin(encoder);
-        radeon_audio_enable(rdev, dig->afmt->pin, 0);
+        radeon_audio_set_mute(encoder, true);
 
+        radeon_audio_write_speaker_allocation(encoder);
+        radeon_audio_write_sad_regs(encoder);
+        radeon_audio_write_latency_fields(encoder, mode);
         radeon_audio_set_dto(encoder, mode->clock);
         radeon_audio_set_vbi_packet(encoder);
         radeon_hdmi_set_color_depth(encoder);
-        radeon_audio_set_mute(encoder, false);
         radeon_audio_update_acr(encoder, mode->clock);
         radeon_audio_set_audio_packet(encoder);
         radeon_audio_select_pin(encoder);
@@ -718,8 +714,7 @@ static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
         if (radeon_audio_set_avi_packet(encoder, mode) < 0)
                 return;
 
-        /* enable audio after to setting up hw */
-        radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
+        radeon_audio_set_mute(encoder, false);
 }
 
 static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
@@ -729,23 +724,26 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        struct radeon_connector_atom_dig *dig_connector =
+                radeon_connector->con_priv;
 
         if (!dig || !dig->afmt)
                 return;
 
-        /* disable audio prior to setting up hw */
-        dig->afmt->pin = radeon_audio_get_pin(encoder);
-        radeon_audio_enable(rdev, dig->afmt->pin, 0);
-
-        radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+        radeon_audio_write_speaker_allocation(encoder);
+        radeon_audio_write_sad_regs(encoder);
+        radeon_audio_write_latency_fields(encoder, mode);
+        if (rdev->clock.dp_extclk || ASIC_IS_DCE5(rdev))
+                radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+        else
+                radeon_audio_set_dto(encoder, dig_connector->dp_clock);
         radeon_audio_set_audio_packet(encoder);
         radeon_audio_select_pin(encoder);
 
         if (radeon_audio_set_avi_packet(encoder, mode) < 0)
                 return;
-
-        /* enable audio after to setting up hw */
-        radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
 }
 
 void radeon_audio_mode_set(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index c830863bc98a..4d0f96cc3da4 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
         u32 ring = RADEON_CS_RING_GFX;
         s32 priority = 0;
 
+        INIT_LIST_HEAD(&p->validated);
+
         if (!cs->num_chunks) {
                 return 0;
         }
+
         /* get chunks */
-        INIT_LIST_HEAD(&p->validated);
         p->idx = 0;
         p->ib.sa_bo = NULL;
         p->const_ib.sa_bo = NULL;
@@ -715,6 +717,7 @@ int radeon_cs_packet_parse(struct radeon_cs_parser *p,
         struct radeon_cs_chunk *ib_chunk = p->chunk_ib;
         struct radeon_device *rdev = p->rdev;
         uint32_t header;
+        int ret = 0, i;
 
         if (idx >= ib_chunk->length_dw) {
                 DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
@@ -743,14 +746,25 @@ int radeon_cs_packet_parse(struct radeon_cs_parser *p,
                 break;
         default:
                 DRM_ERROR("Unknown packet type %d at %d !\n", pkt->type, idx);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto dump_ib;
         }
         if ((pkt->count + 1 + pkt->idx) >= ib_chunk->length_dw) {
                 DRM_ERROR("Packet (%d:%d:%d) end after CS buffer (%d) !\n",
                           pkt->idx, pkt->type, pkt->count, ib_chunk->length_dw);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto dump_ib;
         }
         return 0;
+
+dump_ib:
+        for (i = 0; i < ib_chunk->length_dw; i++) {
+                if (i == idx)
+                        printk("\t0x%08x <---\n", radeon_get_ib_value(p, i));
+                else
+                        printk("\t0x%08x\n", radeon_get_ib_value(p, i));
+        }
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 6b670b0bc47b..3a297037cc17 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -179,9 +179,12 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
                     (rdev->pdev->subsystem_vendor == 0x1734) &&
                     (rdev->pdev->subsystem_device == 0x1107))
                         use_bl = false;
+/* Older PPC macs use on-GPU backlight controller */
+#ifndef CONFIG_PPC_PMAC
                 /* disable native backlight control on older asics */
                 else if (rdev->family < CHIP_R600)
                         use_bl = false;
+#endif
                 else
                         use_bl = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 9f758d39420d..33cf4108386d 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -852,6 +852,12 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
                         single_display = false;
         }
 
+        /* 120hz tends to be problematic even if they are under the
+         * vblank limit.
+         */
+        if (single_display && (r600_dpm_get_vrefresh(rdev) >= 120))
+                single_display = false;
+
         /* certain older asics have a separare 3D performance state,
          * so try that first if the user selected performance
          */
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index d81182ad53ec..97a904835759 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -694,6 +694,10 @@ int rs600_irq_set(struct radeon_device *rdev)
         WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
         if (ASIC_IS_DCE2(rdev))
                 WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
+
+        /* posting read */
+        RREG32(R_000040_GEN_INT_CNTL);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 73107fe9e46f..e088e5558da0 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3162,6 +3162,8 @@ static void si_gpu_init(struct radeon_device *rdev)
         }
 
         WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        WREG32(SRBM_INT_CNTL, 1);
+        WREG32(SRBM_INT_ACK, 1);
 
         evergreen_fix_pci_max_read_req_size(rdev);
 
@@ -4699,12 +4701,6 @@ int si_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
                 switch (pkt.type) {
                 case RADEON_PACKET_TYPE0:
                         dev_err(rdev->dev, "Packet0 not allowed!\n");
-                        for (i = 0; i < ib->length_dw; i++) {
-                                if (i == idx)
-                                        printk("\t0x%08x <---\n", ib->ptr[i]);
-                                else
-                                        printk("\t0x%08x\n", ib->ptr[i]);
-                        }
                         ret = -EINVAL;
                         break;
                 case RADEON_PACKET_TYPE2:
@@ -4736,8 +4732,15 @@ int si_ib_parse(struct radeon_device *rdev, struct radeon_ib *ib)
                         ret = -EINVAL;
                         break;
                 }
-                if (ret)
+                if (ret) {
+                        for (i = 0; i < ib->length_dw; i++) {
+                                if (i == idx)
+                                        printk("\t0x%08x <---\n", ib->ptr[i]);
+                                else
+                                        printk("\t0x%08x\n", ib->ptr[i]);
+                        }
                         break;
+                }
         } while (idx < ib->length_dw);
 
         return ret;
@@ -5910,6 +5913,7 @@ static void si_disable_interrupt_state(struct radeon_device *rdev)
         tmp = RREG32(DMA_CNTL + DMA1_REGISTER_OFFSET) & ~TRAP_ENABLE;
         WREG32(DMA_CNTL + DMA1_REGISTER_OFFSET, tmp);
         WREG32(GRBM_INT_CNTL, 0);
+        WREG32(SRBM_INT_CNTL, 0);
         if (rdev->num_crtc >= 2) {
                 WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
                 WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
@@ -6199,6 +6203,9 @@ int si_irq_set(struct radeon_device *rdev)
 
         WREG32(CG_THERMAL_INT, thermal_int);
 
+        /* posting read */
+        RREG32(SRBM_STATUS);
+
         return 0;
 }
 
@@ -6609,6 +6616,10 @@ restart_ih:
                                 break;
                         }
                         break;
+                case 96:
+                        DRM_ERROR("SRBM_READ_ERROR: 0x%x\n", RREG32(SRBM_READ_ERROR));
+                        WREG32(SRBM_INT_ACK, 0x1);
+                        break;
                 case 124: /* UVD */
                         DRM_DEBUG("IH: UVD int: 0x%08x\n", src_data);
                         radeon_fence_process(rdev, R600_RING_TYPE_UVD_INDEX);
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index cbd91d226f3c..99a9835c9f61 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -358,6 +358,10 @@
 #define CC_SYS_RB_BACKEND_DISABLE                       0xe80
 #define GC_USER_SYS_RB_BACKEND_DISABLE                  0xe84
 
+#define SRBM_READ_ERROR                                 0xE98
+#define SRBM_INT_CNTL                                   0xEA0
+#define SRBM_INT_ACK                                    0xEA8
+
 #define SRBM_STATUS2                                    0x0EC4
 #define         DMA_BUSY                                (1 << 5)
 #define         DMA1_BUSY                               (1 << 6)
@@ -908,8 +912,8 @@
 
 #define DCCG_AUDIO_DTO0_PHASE                           0x05b0
 #define DCCG_AUDIO_DTO0_MODULE                          0x05b4
-#define DCCG_AUDIO_DTO1_PHASE                           0x05b8
-#define DCCG_AUDIO_DTO1_MODULE                          0x05bc
+#define DCCG_AUDIO_DTO1_PHASE                           0x05c0
+#define DCCG_AUDIO_DTO1_MODULE                          0x05c4
 
 #define AFMT_AUDIO_SRC_CONTROL                          0x713c
 #define         AFMT_AUDIO_SRC_SELECT(x)                (((x) & 7) << 0)
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 3aaa84ae2681..1a52522f5da7 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -997,8 +997,10 @@ static void tegra_crtc_reset(struct drm_crtc *crtc)
         crtc->state = NULL;
 
         state = kzalloc(sizeof(*state), GFP_KERNEL);
-        if (state)
+        if (state) {
                 crtc->state = &state->base;
+                crtc->state->crtc = crtc;
+        }
 }
 
 static struct drm_crtc_state *
@@ -1012,6 +1014,7 @@ tegra_crtc_atomic_duplicate_state(struct drm_crtc *crtc)
                 return NULL;
 
         copy->base.mode_changed = false;
+        copy->base.active_changed = false;
         copy->base.planes_changed = false;
         copy->base.event = NULL;
 
@@ -1227,9 +1230,6 @@ static void tegra_crtc_mode_set_nofb(struct drm_crtc *crtc)
         /* program display mode */
         tegra_dc_set_timings(dc, mode);
 
-        if (dc->soc->supports_border_color)
-                tegra_dc_writel(dc, 0, DC_DISP_BORDER_COLOR);
-
         /* interlacing isn't supported yet, so disable it */
         if (dc->soc->supports_interlacing) {
                 value = tegra_dc_readl(dc, DC_DISP_INTERLACE_CONTROL);
@@ -1252,42 +1252,7 @@ static void tegra_crtc_mode_set_nofb(struct drm_crtc *crtc)
 
 static void tegra_crtc_prepare(struct drm_crtc *crtc)
 {
-        struct tegra_dc *dc = to_tegra_dc(crtc);
-        unsigned int syncpt;
-        unsigned long value;
-
         drm_crtc_vblank_off(crtc);
-
-        if (dc->pipe)
-                syncpt = SYNCPT_VBLANK1;
-        else
-                syncpt = SYNCPT_VBLANK0;
-
-        /* initialize display controller */
-        tegra_dc_writel(dc, 0x00000100, DC_CMD_GENERAL_INCR_SYNCPT_CNTRL);
-        tegra_dc_writel(dc, 0x100 | syncpt, DC_CMD_CONT_SYNCPT_VSYNC);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT | WIN_A_OF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_TYPE);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT |
-                WIN_A_OF_INT | WIN_B_OF_INT | WIN_C_OF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_POLARITY);
-
-        /* initialize timer */
-        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(0x20) |
-                WINDOW_B_THRESHOLD(0x20) | WINDOW_C_THRESHOLD(0x20);
-        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY);
-
-        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(1) |
-                WINDOW_B_THRESHOLD(1) | WINDOW_C_THRESHOLD(1);
-        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY_TIMER);
-
-        value = VBLANK_INT | WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_ENABLE);
-
-        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
-        tegra_dc_writel(dc, value, DC_CMD_INT_MASK);
 }
 
 static void tegra_crtc_commit(struct drm_crtc *crtc)
@@ -1664,6 +1629,8 @@ static int tegra_dc_init(struct host1x_client *client)
         struct tegra_drm *tegra = drm->dev_private;
         struct drm_plane *primary = NULL;
         struct drm_plane *cursor = NULL;
+        unsigned int syncpt;
+        u32 value;
         int err;
 
         if (tegra->domain) {
@@ -1730,6 +1697,40 @@ static int tegra_dc_init(struct host1x_client *client)
                 goto cleanup;
         }
 
+        /* initialize display controller */
+        if (dc->pipe)
+                syncpt = SYNCPT_VBLANK1;
+        else
+                syncpt = SYNCPT_VBLANK0;
+
+        tegra_dc_writel(dc, 0x00000100, DC_CMD_GENERAL_INCR_SYNCPT_CNTRL);
+        tegra_dc_writel(dc, 0x100 | syncpt, DC_CMD_CONT_SYNCPT_VSYNC);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT | WIN_A_OF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_TYPE);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT |
+                WIN_A_OF_INT | WIN_B_OF_INT | WIN_C_OF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_POLARITY);
+
+        /* initialize timer */
+        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(0x20) |
+                WINDOW_B_THRESHOLD(0x20) | WINDOW_C_THRESHOLD(0x20);
+        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY);
+
+        value = CURSOR_THRESHOLD(0) | WINDOW_A_THRESHOLD(1) |
+                WINDOW_B_THRESHOLD(1) | WINDOW_C_THRESHOLD(1);
+        tegra_dc_writel(dc, value, DC_DISP_DISP_MEM_HIGH_PRIORITY_TIMER);
+
+        value = VBLANK_INT | WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_ENABLE);
+
+        value = WIN_A_UF_INT | WIN_B_UF_INT | WIN_C_UF_INT;
+        tegra_dc_writel(dc, value, DC_CMD_INT_MASK);
+
+        if (dc->soc->supports_border_color)
+                tegra_dc_writel(dc, 0, DC_DISP_BORDER_COLOR);
+
         return 0;
 
 cleanup:
diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
index 7e06657ae58b..7eaaee74a039 100644
--- a/drivers/gpu/drm/tegra/hdmi.c
+++ b/drivers/gpu/drm/tegra/hdmi.c
@@ -851,6 +851,14 @@ static void tegra_hdmi_encoder_mode_set(struct drm_encoder *encoder,
         h_back_porch = mode->htotal - mode->hsync_end;
         h_front_porch = mode->hsync_start - mode->hdisplay;
 
+        err = clk_set_rate(hdmi->clk, pclk);
+        if (err < 0) {
+                dev_err(hdmi->dev, "failed to set HDMI clock frequency: %d\n",
+                        err);
+        }
+
+        DRM_DEBUG_KMS("HDMI clock rate: %lu Hz\n", clk_get_rate(hdmi->clk));
+
         /* power up sequence */
         value = tegra_hdmi_readl(hdmi, HDMI_NV_PDISP_SOR_PLL0);
         value &= ~SOR_PLL_PDBG;
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index d395b0bef73b..8d9b7de25613 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -74,7 +74,7 @@ static void ttm_mem_type_debug(struct ttm_bo_device *bdev, int mem_type)
         pr_err("    has_type: %d\n", man->has_type);
         pr_err("    use_type: %d\n", man->use_type);
         pr_err("    flags: 0x%08X\n", man->flags);
-        pr_err("    gpu_offset: 0x%08lX\n", man->gpu_offset);
+        pr_err("    gpu_offset: 0x%08llX\n", man->gpu_offset);
         pr_err("    size: %llu\n", man->size);
         pr_err("    available_caching: 0x%08X\n", man->available_caching);
         pr_err("    default_caching: 0x%08X\n", man->default_caching);
diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c
index b61d6be97602..3ddfb3d0b64d 100644
--- a/drivers/gpu/ipu-v3/ipu-di.c
+++ b/drivers/gpu/ipu-v3/ipu-di.c
@@ -459,6 +459,8 @@ static void ipu_di_config_clock(struct ipu_di *di,
 
                 clkrate = clk_get_rate(di->clk_ipu);
                 div = DIV_ROUND_CLOSEST(clkrate, sig->mode.pixelclock);
+                if (div == 0)
+                        div = 1;
                 rate = clkrate / div;
 
                 error = rate / (sig->mode.pixelclock / 1000);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index db4fb6e1cc5b..7c669c328c4c 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1872,6 +1872,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
@@ -1926,6 +1927,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
 #endif
 #if IS_ENABLED(CONFIG_HID_SAITEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 46edb4d3ed28..204312bfab2c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -654,6 +654,7 @@
 #define USB_DEVICE_ID_MS_LK6K           0x00f9
 #define USB_DEVICE_ID_MS_PRESENTER_8K_BT        0x0701
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
+#define USB_DEVICE_ID_MS_NE7K           0x071d
 #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K       0x0730
 #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500     0x076c
 #define USB_DEVICE_ID_MS_SURFACE_PRO_2   0x0799
@@ -802,6 +803,7 @@
 #define USB_VENDOR_ID_SAITEK            0x06a3
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
 #define USB_DEVICE_ID_SAITEK_PS1000     0x0621
+#define USB_DEVICE_ID_SAITEK_RAT7_OLD   0x0ccb
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
 
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index fbaea6eb882e..af935eb198c9 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -264,6 +264,8 @@ static const struct hid_device_id ms_devices[] = {
                 .driver_data = MS_ERGONOMY },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP),
                 .driver_data = MS_ERGONOMY },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE7K),
+                .driver_data = MS_ERGONOMY },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K),
                 .driver_data = MS_ERGONOMY | MS_RDESC },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB),
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 5632c54eadf0..a014f21275d8 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -177,6 +177,8 @@ static int saitek_event(struct hid_device *hdev, struct hid_field *field,
 static const struct hid_device_id saitek_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000),
                 .driver_data = SAITEK_FIX_PS1000 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_OLD),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 6a58b6c723aa..e54ce1097e2c 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -135,8 +135,9 @@ static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
 {
         struct hid_sensor_hub_callbacks_list *callback;
         struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
+        unsigned long flags;
 
-        spin_lock(&pdata->dyn_callback_lock);
+        spin_lock_irqsave(&pdata->dyn_callback_lock, flags);
         list_for_each_entry(callback, &pdata->dyn_callback_list, list)
                 if (callback->usage_id == usage_id &&
                         (collection_index >=
@@ -145,10 +146,11 @@ static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
                                 callback->hsdev->end_collection_index)) {
                         *priv = callback->priv;
                         *hsdev = callback->hsdev;
-                        spin_unlock(&pdata->dyn_callback_lock);
+                        spin_unlock_irqrestore(&pdata->dyn_callback_lock,
+                                               flags);
                         return callback->usage_callback;
                 }
-        spin_unlock(&pdata->dyn_callback_lock);
+        spin_unlock_irqrestore(&pdata->dyn_callback_lock, flags);
 
         return NULL;
 }
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 31e9d2561106..1896c019e302 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -804,7 +804,7 @@ union sixaxis_output_report_01 {
 #define DS4_REPORT_0x81_SIZE 7
 #define SIXAXIS_REPORT_0xF2_SIZE 18
 
-static spinlock_t sony_dev_list_lock;
+static DEFINE_SPINLOCK(sony_dev_list_lock);
 static LIST_HEAD(sony_device_list);
 static DEFINE_IDA(sony_device_id_allocator);
 
@@ -1944,6 +1944,8 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 return -ENOMEM;
         }
 
+        spin_lock_init(&sc->lock);
+
         sc->quirks = quirks;
         hid_set_drvdata(hdev, sc);
         sc->hdev = hdev;
@@ -2147,8 +2149,8 @@ static void __exit sony_exit(void)
 {
         dbg_hid("Sony:%s\n", __func__);
 
-        ida_destroy(&sony_device_id_allocator);
         hid_unregister_driver(&sony_driver);
+        ida_destroy(&sony_device_id_allocator);
 }
 module_init(sony_init);
 module_exit(sony_exit);
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index d43e967e7533..36053f33d6d9 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -370,7 +370,10 @@ static int i2c_hid_hwreset(struct i2c_client *client)
 static void i2c_hid_get_input(struct i2c_hid *ihid)
 {
         int ret, ret_size;
-        int size = ihid->bufsize;
+        int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+
+        if (size > ihid->bufsize)
+                size = ihid->bufsize;
 
         ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
         if (ret != size) {
@@ -785,7 +788,7 @@ static int i2c_hid_init_irq(struct i2c_client *client)
         dev_dbg(&client->dev, "Requesting IRQ: %d\n", client->irq);
 
         ret = request_threaded_irq(client->irq, NULL, i2c_hid_irq,
-                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                        IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                         client->name, ihid);
         if (ret < 0) {
                 dev_warn(&client->dev,
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 1a6507999a65..046351cf17f3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -778,6 +778,11 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
                         input_report_abs(input, ABS_X, be16_to_cpup((__be16 *)&data[4]));
                         input_report_abs(input, ABS_Y, be16_to_cpup((__be16 *)&data[6]));
                         input_report_abs(input, ABS_Z, be16_to_cpup((__be16 *)&data[8]));
+                        if ((data[2] & 0x07) | data[4] | data[5] | data[6] | data[7] | data[8] | data[9]) {
+                                input_report_abs(input, ABS_MISC, PAD_DEVICE_ID);
+                        } else {
+                                input_report_abs(input, ABS_MISC, 0);
+                        }
                 } else if (features->type == CINTIQ_HYBRID) {
                         /*
                          * Do not send hardware buttons under Android. They
@@ -2725,9 +2730,9 @@ static const struct wacom_features wacom_features_0xF6 =
           .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf8, .touch_max = 10,
           .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE };
 static const struct wacom_features wacom_features_0x32A =
-        { "Wacom Cintiq 27QHD", 119740, 67520, 2047,
-          63, WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
-          WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+        { "Wacom Cintiq 27QHD", 119740, 67520, 2047, 63,
+          WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
+          WACOM_CINTIQ_OFFSET, WACOM_CINTIQ_OFFSET };
 static const struct wacom_features wacom_features_0x32B =
         { "Wacom Cintiq 27QHD touch", 119740, 67520, 2047, 63,
           WACOM_27QHD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES,
diff --git a/drivers/hwmon/ads7828.c b/drivers/hwmon/ads7828.c
index bce4e9ff21bf..6c99ee7bafa3 100644
--- a/drivers/hwmon/ads7828.c
+++ b/drivers/hwmon/ads7828.c
@@ -147,6 +147,9 @@ static int ads7828_probe(struct i2c_client *client,
                                                     &ads2830_regmap_config);
         }
 
+        if (IS_ERR(data->regmap))
+                return PTR_ERR(data->regmap);
+
         data->cmd_byte = ext_vref ? ADS7828_CMD_PD1 : ADS7828_CMD_PD3;
         if (!diff_input)
                 data->cmd_byte |= ADS7828_CMD_SD_SE;
diff --git a/drivers/i2c/busses/i2c-designware-baytrail.c b/drivers/i2c/busses/i2c-designware-baytrail.c
index 5f1ff4cc5c34..7d7ae97476e2 100644
--- a/drivers/i2c/busses/i2c-designware-baytrail.c
+++ b/drivers/i2c/busses/i2c-designware-baytrail.c
@@ -17,27 +17,31 @@
 #include <linux/acpi.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
+
 #include <asm/iosf_mbi.h>
+
 #include "i2c-designware-core.h"
 
 #define SEMAPHORE_TIMEOUT       100
 #define PUNIT_SEMAPHORE         0x7
+#define PUNIT_SEMAPHORE_BIT     BIT(0)
+#define PUNIT_SEMAPHORE_ACQUIRE BIT(1)
 
 static unsigned long acquired;
 
 static int get_sem(struct device *dev, u32 *sem)
 {
-        u32 reg_val;
+        u32 data;
         int ret;
 
         ret = iosf_mbi_read(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_READ, PUNIT_SEMAPHORE,
-                            &reg_val);
+                                &data);
         if (ret) {
                 dev_err(dev, "iosf failed to read punit semaphore\n");
                 return ret;
         }
 
-        *sem = reg_val & 0x1;
+        *sem = data & PUNIT_SEMAPHORE_BIT;
 
         return 0;
 }
@@ -52,27 +56,29 @@ static void reset_semaphore(struct device *dev)
                 return;
         }
 
-        data = data & 0xfffffffe;
+        data &= ~PUNIT_SEMAPHORE_BIT;
         if (iosf_mbi_write(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_WRITE,
-                                 PUNIT_SEMAPHORE, data))
+                                PUNIT_SEMAPHORE, data))
                 dev_err(dev, "iosf failed to reset punit semaphore during write\n");
 }
 
-int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
+static int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
 {
-        u32 sem = 0;
+        u32 sem;
         int ret;
         unsigned long start, end;
 
+        might_sleep();
+
         if (!dev || !dev->dev)
                 return -ENODEV;
 
-        if (!dev->acquire_lock)
+        if (!dev->release_lock)
                 return 0;
 
-        /* host driver writes 0x2 to side band semaphore register */
+        /* host driver writes to side band semaphore register */
         ret = iosf_mbi_write(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_WRITE,
-                                 PUNIT_SEMAPHORE, 0x2);
+                                PUNIT_SEMAPHORE, PUNIT_SEMAPHORE_ACQUIRE);
         if (ret) {
                 dev_err(dev->dev, "iosf punit semaphore request failed\n");
                 return ret;
@@ -81,7 +87,7 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
         /* host driver waits for bit 0 to be set in semaphore register */
         start = jiffies;
         end = start + msecs_to_jiffies(SEMAPHORE_TIMEOUT);
-        while (!time_after(jiffies, end)) {
+        do {
                 ret = get_sem(dev->dev, &sem);
                 if (!ret && sem) {
                         acquired = jiffies;
@@ -91,14 +97,14 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
                 }
 
                 usleep_range(1000, 2000);
-        }
+        } while (time_before(jiffies, end));
 
         dev_err(dev->dev, "punit semaphore timed out, resetting\n");
         reset_semaphore(dev->dev);
 
         ret = iosf_mbi_read(BT_MBI_UNIT_PMC, BT_MBI_BUNIT_READ,
-                PUNIT_SEMAPHORE, &sem);
-        if (!ret)
+                                PUNIT_SEMAPHORE, &sem);
+        if (ret)
                 dev_err(dev->dev, "iosf failed to read punit semaphore\n");
         else
                 dev_err(dev->dev, "PUNIT SEM: %d\n", sem);
@@ -107,9 +113,8 @@ int baytrail_i2c_acquire(struct dw_i2c_dev *dev)
 
         return -ETIMEDOUT;
 }
-EXPORT_SYMBOL(baytrail_i2c_acquire);
 
-void baytrail_i2c_release(struct dw_i2c_dev *dev)
+static void baytrail_i2c_release(struct dw_i2c_dev *dev)
 {
         if (!dev || !dev->dev)
                 return;
@@ -121,7 +126,6 @@ void baytrail_i2c_release(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "punit semaphore held for %ums\n",
                 jiffies_to_msecs(jiffies - acquired));
 }
-EXPORT_SYMBOL(baytrail_i2c_release);
 
 int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
 {
@@ -137,7 +141,6 @@ int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
                 return 0;
 
         status = acpi_evaluate_integer(handle, "_SEM", NULL, &shared_host);
-
         if (ACPI_FAILURE(status))
                 return 0;
 
@@ -153,7 +156,6 @@ int i2c_dw_eval_lock_support(struct dw_i2c_dev *dev)
 
         return 0;
 }
-EXPORT_SYMBOL(i2c_dw_eval_lock_support);
 
 MODULE_AUTHOR("David E. Box <david.e.box@linux.intel.com>");
 MODULE_DESCRIPTION("Baytrail I2C Semaphore driver");
diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 51672256072b..b96c636470ef 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -58,20 +58,11 @@
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SAMP_FREQ), \
         }
 
-/* LSB is in nV to eliminate floating point */
-static const u32 rates_to_lsb[] = {1000000, 250000, 62500, 15625};
-
-/*
- *  scales calculated as:
- *  rates_to_lsb[sample_rate] / (1 << pga);
- *  pga is 1 for 0, 2
- */
-
 static const int mcp3422_scales[4][4] = {
-        { 1000000, 250000, 62500, 15625 },
-        { 500000 , 125000, 31250, 7812 },
-        { 250000 , 62500 , 15625, 3906 },
-        { 125000 , 31250 , 7812 , 1953 } };
+        { 1000000, 500000, 250000, 125000 },
+        { 250000 , 125000, 62500 , 31250  },
+        { 62500  , 31250 , 15625 , 7812   },
+        { 15625  , 7812  , 3906  , 1953   } };
 
 /* Constant msleep times for data acquisitions */
 static const int mcp3422_read_times[4] = {
diff --git a/drivers/iio/adc/qcom-spmi-iadc.c b/drivers/iio/adc/qcom-spmi-iadc.c
index b9666f2f5e51..fabd24edc2a1 100644
--- a/drivers/iio/adc/qcom-spmi-iadc.c
+++ b/drivers/iio/adc/qcom-spmi-iadc.c
@@ -296,7 +296,8 @@ static int iadc_do_conversion(struct iadc_chip *iadc, int chan, u16 *data)
         if (iadc->poll_eoc) {
                 ret = iadc_poll_wait_eoc(iadc, wait);
         } else {
-                ret = wait_for_completion_timeout(&iadc->complete, wait);
+                ret = wait_for_completion_timeout(&iadc->complete,
+                        usecs_to_jiffies(wait));
                 if (!ret)
                         ret = -ETIMEDOUT;
                 else
diff --git a/drivers/iio/common/ssp_sensors/ssp_dev.c b/drivers/iio/common/ssp_sensors/ssp_dev.c
index 52d70435f5a1..55a90082a29b 100644
--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
@@ -640,6 +640,7 @@ static int ssp_remove(struct spi_device *spi)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int ssp_suspend(struct device *dev)
 {
         int ret;
@@ -688,6 +689,7 @@ static int ssp_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 
 static const struct dev_pm_ops ssp_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(ssp_suspend, ssp_resume)
diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
index f57562aa396f..15c73e20272d 100644
--- a/drivers/iio/dac/ad5686.c
+++ b/drivers/iio/dac/ad5686.c
@@ -322,7 +322,7 @@ static int ad5686_probe(struct spi_device *spi)
         st = iio_priv(indio_dev);
         spi_set_drvdata(spi, indio_dev);
 
-        st->reg = devm_regulator_get(&spi->dev, "vcc");
+        st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
         if (!IS_ERR(st->reg)) {
                 ret = regulator_enable(st->reg);
                 if (ret)
diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
index 623c145d8a97..7d79a1ac5f5f 100644
--- a/drivers/iio/humidity/dht11.c
+++ b/drivers/iio/humidity/dht11.c
@@ -29,6 +29,7 @@
 #include <linux/wait.h>
 #include <linux/bitops.h>
 #include <linux/completion.h>
+#include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/gpio.h>
 #include <linux/of_gpio.h>
@@ -39,8 +40,12 @@
 
 #define DHT11_DATA_VALID_TIME   2000000000  /* 2s in ns */
 
-#define DHT11_EDGES_PREAMBLE 4
+#define DHT11_EDGES_PREAMBLE 2
 #define DHT11_BITS_PER_READ 40
+/*
+ * Note that when reading the sensor actually 84 edges are detected, but
+ * since the last edge is not significant, we only store 83:
+ */
 #define DHT11_EDGES_PER_READ (2*DHT11_BITS_PER_READ + DHT11_EDGES_PREAMBLE + 1)
 
 /* Data transmission timing (nano seconds) */
@@ -57,6 +62,7 @@ struct dht11 {
         int                             irq;
 
         struct completion               completion;
+        struct mutex                    lock;
 
         s64                             timestamp;
         int                             temperature;
@@ -88,7 +94,7 @@ static int dht11_decode(struct dht11 *dht11, int offset)
         unsigned char temp_int, temp_dec, hum_int, hum_dec, checksum;
 
         /* Calculate timestamp resolution */
-        for (i = 0; i < dht11->num_edges; ++i) {
+        for (i = 1; i < dht11->num_edges; ++i) {
                 t = dht11->edges[i].ts - dht11->edges[i-1].ts;
                 if (t > 0 && t < timeres)
                         timeres = t;
@@ -138,6 +144,27 @@ static int dht11_decode(struct dht11 *dht11, int offset)
         return 0;
 }
 
+/*
+ * IRQ handler called on GPIO edges
+ */
+static irqreturn_t dht11_handle_irq(int irq, void *data)
+{
+        struct iio_dev *iio = data;
+        struct dht11 *dht11 = iio_priv(iio);
+
+        /* TODO: Consider making the handler safe for IRQ sharing */
+        if (dht11->num_edges < DHT11_EDGES_PER_READ && dht11->num_edges >= 0) {
+                dht11->edges[dht11->num_edges].ts = iio_get_time_ns();
+                dht11->edges[dht11->num_edges++].value =
+                                                gpio_get_value(dht11->gpio);
+
+                if (dht11->num_edges >= DHT11_EDGES_PER_READ)
+                        complete(&dht11->completion);
+        }
+
+        return IRQ_HANDLED;
+}
+
 static int dht11_read_raw(struct iio_dev *iio_dev,
                         const struct iio_chan_spec *chan,
                         int *val, int *val2, long m)
@@ -145,6 +172,7 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
         struct dht11 *dht11 = iio_priv(iio_dev);
         int ret;
 
+        mutex_lock(&dht11->lock);
         if (dht11->timestamp + DHT11_DATA_VALID_TIME < iio_get_time_ns()) {
                 reinit_completion(&dht11->completion);
 
@@ -157,8 +185,17 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 if (ret)
                         goto err;
 
+                ret = request_irq(dht11->irq, dht11_handle_irq,
+                                  IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+                                  iio_dev->name, iio_dev);
+                if (ret)
+                        goto err;
+
                 ret = wait_for_completion_killable_timeout(&dht11->completion,
                                                                  HZ);
+
+                free_irq(dht11->irq, iio_dev);
+
                 if (ret == 0 && dht11->num_edges < DHT11_EDGES_PER_READ - 1) {
                         dev_err(&iio_dev->dev,
                                         "Only %d signal edges detected\n",
@@ -185,6 +222,7 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 ret = -EINVAL;
 err:
         dht11->num_edges = -1;
+        mutex_unlock(&dht11->lock);
         return ret;
 }
 
@@ -193,27 +231,6 @@ static const struct iio_info dht11_iio_info = {
         .read_raw               = dht11_read_raw,
 };
 
-/*
- * IRQ handler called on GPIO edges
-*/
-static irqreturn_t dht11_handle_irq(int irq, void *data)
-{
-        struct iio_dev *iio = data;
-        struct dht11 *dht11 = iio_priv(iio);
-
-        /* TODO: Consider making the handler safe for IRQ sharing */
-        if (dht11->num_edges < DHT11_EDGES_PER_READ && dht11->num_edges >= 0) {
-                dht11->edges[dht11->num_edges].ts = iio_get_time_ns();
-                dht11->edges[dht11->num_edges++].value =
-                                                gpio_get_value(dht11->gpio);
-
-                if (dht11->num_edges >= DHT11_EDGES_PER_READ)
-                        complete(&dht11->completion);
-        }
-
-        return IRQ_HANDLED;
-}
-
 static const struct iio_chan_spec dht11_chan_spec[] = {
         { .type = IIO_TEMP,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED), },
@@ -256,11 +273,6 @@ static int dht11_probe(struct platform_device *pdev)
                 dev_err(dev, "GPIO %d has no interrupt\n", dht11->gpio);
                 return -EINVAL;
         }
-        ret = devm_request_irq(dev, dht11->irq, dht11_handle_irq,
-                                IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                                pdev->name, iio);
-        if (ret)
-                return ret;
 
         dht11->timestamp = iio_get_time_ns() - DHT11_DATA_VALID_TIME - 1;
         dht11->num_edges = -1;
@@ -268,6 +280,7 @@ static int dht11_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, iio);
 
         init_completion(&dht11->completion);
+        mutex_init(&dht11->lock);
         iio->name = pdev->name;
         iio->dev.parent = &pdev->dev;
         iio->info = &dht11_iio_info;
diff --git a/drivers/iio/humidity/si7020.c b/drivers/iio/humidity/si7020.c
index b54164677b89..fa3b809aff5e 100644
--- a/drivers/iio/humidity/si7020.c
+++ b/drivers/iio/humidity/si7020.c
@@ -45,12 +45,12 @@ static int si7020_read_raw(struct iio_dev *indio_dev,
                            struct iio_chan_spec const *chan, int *val,
                            int *val2, long mask)
 {
-        struct i2c_client *client = iio_priv(indio_dev);
+        struct i2c_client **client = iio_priv(indio_dev);
         int ret;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                ret = i2c_smbus_read_word_data(client,
+                ret = i2c_smbus_read_word_data(*client,
                                                chan->type == IIO_TEMP ?
                                                SI7020CMD_TEMP_HOLD :
                                                SI7020CMD_RH_HOLD);
@@ -126,7 +126,7 @@ static int si7020_probe(struct i2c_client *client,
         /* Wait the maximum power-up time after software reset. */
         msleep(15);
 
-        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*client));
+        indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
         if (!indio_dev)
                 return -ENOMEM;
 
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index b70873de04ea..fa795dcd5f75 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -26,6 +26,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/debugfs.h>
+#include <linux/bitops.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -414,7 +415,7 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                 mutex_unlock(&indio_dev->mlock);
                 if (ret)
                         return ret;
-                val16 = ((val16 & 0xFFF) << 4) >> 4;
+                val16 = sign_extend32(val16, 11);
                 *val = val16;
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_OFFSET:
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index f73e60b7a796..d8d5bed65e07 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -780,7 +780,11 @@ static int inv_mpu_probe(struct i2c_client *client,
 
         i2c_set_clientdata(client, indio_dev);
         indio_dev->dev.parent = &client->dev;
-        indio_dev->name = id->name;
+        /* id will be NULL when enumerated via ACPI */
+        if (id)
+                indio_dev->name = (char *)id->name;
+        else
+                indio_dev->name = (char *)dev_name(&client->dev);
         indio_dev->channels = inv_mpu_channels;
         indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
 
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index ae68c64bdad3..a224afd6380c 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -73,6 +73,7 @@ config CM36651
 config GP2AP020A00F
         tristate "Sharp GP2AP020A00F Proximity/ALS sensor"
         depends on I2C
+        select REGMAP_I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select IRQ_WORK
@@ -126,6 +127,7 @@ config HID_SENSOR_PROX
 config JSA1212
         tristate "JSA1212 ALS and proximity sensor driver"
         depends on I2C
+        select REGMAP_I2C
         help
          Say Y here if you want to build a IIO driver for JSA1212
          proximity & ALS sensor device.
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index 4c7a4c52dd06..a5d6de72c523 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -18,6 +18,8 @@ config AK8975
 
 config AK09911
         tristate "Asahi Kasei AK09911 3-axis Compass"
+        depends on I2C
+        depends on GPIOLIB
         select AK8975
         help
           Deprecated: AK09911 is now supported by AK8975 driver.
diff --git a/drivers/input/keyboard/tc3589x-keypad.c b/drivers/input/keyboard/tc3589x-keypad.c
index 8ff612d160b0..563932500ff1 100644
--- a/drivers/input/keyboard/tc3589x-keypad.c
+++ b/drivers/input/keyboard/tc3589x-keypad.c
@@ -411,9 +411,9 @@ static int tc3589x_keypad_probe(struct platform_device *pdev)
 
         input_set_drvdata(input, keypad);
 
-        error = request_threaded_irq(irq, NULL,
-                        tc3589x_keypad_irq, plat->irqtype,
-                        "tc3589x-keypad", keypad);
+        error = request_threaded_irq(irq, NULL, tc3589x_keypad_irq,
+                                     plat->irqtype | IRQF_ONESHOT,
+                                     "tc3589x-keypad", keypad);
         if (error < 0) {
                 dev_err(&pdev->dev,
                                 "Could not allocate irq %d,error %d\n",
diff --git a/drivers/input/misc/mma8450.c b/drivers/input/misc/mma8450.c
index 59d4dcddf6de..98228773a111 100644
--- a/drivers/input/misc/mma8450.c
+++ b/drivers/input/misc/mma8450.c
@@ -187,6 +187,7 @@ static int mma8450_probe(struct i2c_client *c,
         idev->private           = m;
         idev->input->name       = MMA8450_DRV_NAME;
         idev->input->id.bustype = BUS_I2C;
+        idev->input->dev.parent = &c->dev;
         idev->poll              = mma8450_poll;
         idev->poll_interval     = POLL_INTERVAL;
         idev->poll_interval_max = POLL_INTERVAL_MAX;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index d28726a0ef85..1bd15ebc01f2 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2605,8 +2605,10 @@ int alps_detect(struct psmouse *psmouse, bool set_properties)
                 return -ENOMEM;
 
         error = alps_identify(psmouse, priv);
-        if (error)
+        if (error) {
+                kfree(priv);
                 return error;
+        }
 
         if (set_properties) {
                 psmouse->vendor = "ALPS";
diff --git a/drivers/input/mouse/cyapa_gen3.c b/drivers/input/mouse/cyapa_gen3.c
index 77e9d70a986b..1e2291c378fe 100644
--- a/drivers/input/mouse/cyapa_gen3.c
+++ b/drivers/input/mouse/cyapa_gen3.c
@@ -20,7 +20,7 @@
 #include <linux/input/mt.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/unaligned/access_ok.h>
+#include <asm/unaligned.h>
 #include "cyapa.h"
 
 
diff --git a/drivers/input/mouse/cyapa_gen5.c b/drivers/input/mouse/cyapa_gen5.c
index ddf5393a1180..5b611dd71e79 100644
--- a/drivers/input/mouse/cyapa_gen5.c
+++ b/drivers/input/mouse/cyapa_gen5.c
@@ -17,7 +17,7 @@
 #include <linux/mutex.h>
 #include <linux/completion.h>
 #include <linux/slab.h>
-#include <linux/unaligned/access_ok.h>
+#include <asm/unaligned.h>
 #include <linux/crc-itu-t.h>
 #include "cyapa.h"
 
@@ -1926,7 +1926,7 @@ static int cyapa_gen5_read_idac_data(struct cyapa *cyapa,
                                 electrodes_tx = cyapa->electrodes_x;
                         max_element_cnt = ((cyapa->aligned_electrodes_rx + 7) &
                                                 ~7u) * electrodes_tx;
-                } else if (idac_data_type == GEN5_RETRIEVE_SELF_CAP_PWC_DATA) {
+                } else {
                         offset = 2;
                         max_element_cnt = cyapa->electrodes_x +
                                                 cyapa->electrodes_y;
diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
index 757f78a94aec..23d259416f2f 100644
--- a/drivers/input/mouse/focaltech.c
+++ b/drivers/input/mouse/focaltech.c
@@ -67,9 +67,6 @@ static void focaltech_reset(struct psmouse *psmouse)
 
 #define FOC_MAX_FINGERS 5
 
-#define FOC_MAX_X 2431
-#define FOC_MAX_Y 1663
-
 /*
  * Current state of a single finger on the touchpad.
  */
@@ -129,9 +126,17 @@ static void focaltech_report_state(struct psmouse *psmouse)
                 input_mt_slot(dev, i);
                 input_mt_report_slot_state(dev, MT_TOOL_FINGER, active);
                 if (active) {
-                        input_report_abs(dev, ABS_MT_POSITION_X, finger->x);
+                        unsigned int clamped_x, clamped_y;
+                        /*
+                         * The touchpad might report invalid data, so we clamp
+                         * the resulting values so that we do not confuse
+                         * userspace.
+                         */
+                        clamped_x = clamp(finger->x, 0U, priv->x_max);
+                        clamped_y = clamp(finger->y, 0U, priv->y_max);
+                        input_report_abs(dev, ABS_MT_POSITION_X, clamped_x);
                         input_report_abs(dev, ABS_MT_POSITION_Y,
-                                         FOC_MAX_Y - finger->y);
+                                         priv->y_max - clamped_y);
                 }
         }
         input_mt_report_pointer_emulation(dev, true);
@@ -180,16 +185,6 @@ static void focaltech_process_abs_packet(struct psmouse *psmouse,
 
         state->pressed = (packet[0] >> 4) & 1;
 
-        /*
-         * packet[5] contains some kind of tool size in the most
-         * significant nibble. 0xff is a special value (latching) that
-         * signals a large contact area.
-         */
-        if (packet[5] == 0xff) {
-                state->fingers[finger].valid = false;
-                return;
-        }
-
         state->fingers[finger].x = ((packet[1] & 0xf) << 8) | packet[2];
         state->fingers[finger].y = (packet[3] << 8) | packet[4];
         state->fingers[finger].valid = true;
@@ -381,6 +376,23 @@ static int focaltech_read_size(struct psmouse *psmouse)
 
         return 0;
 }
+
+void focaltech_set_resolution(struct psmouse *psmouse, unsigned int resolution)
+{
+        /* not supported yet */
+}
+
+static void focaltech_set_rate(struct psmouse *psmouse, unsigned int rate)
+{
+        /* not supported yet */
+}
+
+static void focaltech_set_scale(struct psmouse *psmouse,
+                                enum psmouse_scale scale)
+{
+        /* not supported yet */
+}
+
 int focaltech_init(struct psmouse *psmouse)
 {
         struct focaltech_data *priv;
@@ -415,6 +427,14 @@ int focaltech_init(struct psmouse *psmouse)
         psmouse->cleanup = focaltech_reset;
         /* resync is not supported yet */
         psmouse->resync_time = 0;
+        /*
+         * rate/resolution/scale changes are not supported yet, and
+         * the generic implementations of these functions seem to
+         * confuse some touchpads
+         */
+        psmouse->set_resolution = focaltech_set_resolution;
+        psmouse->set_rate = focaltech_set_rate;
+        psmouse->set_scale = focaltech_set_scale;
 
         return 0;
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 4ccd01d7a48d..8bc61237bc1b 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -454,6 +454,17 @@ static void psmouse_set_rate(struct psmouse *psmouse, unsigned int rate)
 }
 
 /*
+ * Here we set the mouse scaling.
+ */
+
+static void psmouse_set_scale(struct psmouse *psmouse, enum psmouse_scale scale)
+{
+        ps2_command(&psmouse->ps2dev, NULL,
+                    scale == PSMOUSE_SCALE21 ? PSMOUSE_CMD_SETSCALE21 :
+                                               PSMOUSE_CMD_SETSCALE11);
+}
+
+/*
  * psmouse_poll() - default poll handler. Everyone except for ALPS uses it.
  */
 
@@ -689,6 +700,7 @@ static void psmouse_apply_defaults(struct psmouse *psmouse)
 
         psmouse->set_rate = psmouse_set_rate;
         psmouse->set_resolution = psmouse_set_resolution;
+        psmouse->set_scale = psmouse_set_scale;
         psmouse->poll = psmouse_poll;
         psmouse->protocol_handler = psmouse_process_byte;
         psmouse->pktsize = 3;
@@ -1160,7 +1172,7 @@ static void psmouse_initialize(struct psmouse *psmouse)
         if (psmouse_max_proto != PSMOUSE_PS2) {
                 psmouse->set_rate(psmouse, psmouse->rate);
                 psmouse->set_resolution(psmouse, psmouse->resolution);
-                ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11);
+                psmouse->set_scale(psmouse, PSMOUSE_SCALE11);
         }
 }
 
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index c2ff137ecbdb..d02e1bdc9ae4 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -36,6 +36,11 @@ typedef enum {
         PSMOUSE_FULL_PACKET
 } psmouse_ret_t;
 
+enum psmouse_scale {
+        PSMOUSE_SCALE11,
+        PSMOUSE_SCALE21
+};
+
 struct psmouse {
         void *private;
         struct input_dev *dev;
@@ -67,6 +72,7 @@ struct psmouse {
         psmouse_ret_t (*protocol_handler)(struct psmouse *psmouse);
         void (*set_rate)(struct psmouse *psmouse, unsigned int rate);
         void (*set_resolution)(struct psmouse *psmouse, unsigned int resolution);
+        void (*set_scale)(struct psmouse *psmouse, enum psmouse_scale scale);
 
         int (*reconnect)(struct psmouse *psmouse);
         void (*disconnect)(struct psmouse *psmouse);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 58917525126e..6261fd6d7c3c 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -943,6 +943,7 @@ config TOUCHSCREEN_SUN4I
         tristate "Allwinner sun4i resistive touchscreen controller support"
         depends on ARCH_SUNXI || COMPILE_TEST
         depends on HWMON
+        depends on THERMAL || !THERMAL_OF
         help
           This selects support for the resistive touchscreen controller
           found on Allwinner sunxi SoCs.
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 3c92780bda09..ff48da61c94c 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -1755,7 +1755,7 @@ init_card(struct hfc_pci *hc)
                 enable_hwirq(hc);
                 spin_unlock_irqrestore(&hc->lock, flags);
                 /* Timeout 80ms */
-                current->state = TASK_UNINTERRUPTIBLE;
+                set_current_state(TASK_UNINTERRUPTIBLE);
                 schedule_timeout((80 * HZ) / 1000);
                 printk(KERN_INFO "HFC PCI: IRQ %d count %d\n",
                        hc->irq, hc->irqcnt);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c8d2bac4e28b..cadf9cc02b25 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2555,7 +2555,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
         return err ? err : len;
 }
 static struct rdev_sysfs_entry rdev_state =
-__ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
+__ATTR_PREALLOC(state, S_IRUGO|S_IWUSR, state_show, state_store);
 
 static ssize_t
 errors_show(struct md_rdev *rdev, char *page)
@@ -3638,7 +3638,8 @@ resync_start_store(struct mddev *mddev, const char *buf, size_t len)
         return err ?: len;
 }
 static struct md_sysfs_entry md_resync_start =
-__ATTR(resync_start, S_IRUGO|S_IWUSR, resync_start_show, resync_start_store);
+__ATTR_PREALLOC(resync_start, S_IRUGO|S_IWUSR,
+                resync_start_show, resync_start_store);
 
 /*
  * The array state can be:
@@ -3851,7 +3852,7 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len)
         return err ?: len;
 }
 static struct md_sysfs_entry md_array_state =
-__ATTR(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
+__ATTR_PREALLOC(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
 
 static ssize_t
 max_corrected_read_errors_show(struct mddev *mddev, char *page) {
@@ -4101,7 +4102,7 @@ out_unlock:
 }
 
 static struct md_sysfs_entry md_metadata =
-__ATTR(metadata_version, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
+__ATTR_PREALLOC(metadata_version, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
 
 static ssize_t
 action_show(struct mddev *mddev, char *page)
@@ -4189,7 +4190,7 @@ action_store(struct mddev *mddev, const char *page, size_t len)
 }
 
 static struct md_sysfs_entry md_scan_mode =
-__ATTR(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
+__ATTR_PREALLOC(sync_action, S_IRUGO|S_IWUSR, action_show, action_store);
 
 static ssize_t
 last_sync_action_show(struct mddev *mddev, char *page)
@@ -4335,7 +4336,8 @@ sync_completed_show(struct mddev *mddev, char *page)
         return sprintf(page, "%llu / %llu\n", resync, max_sectors);
 }
 
-static struct md_sysfs_entry md_sync_completed = __ATTR_RO(sync_completed);
+static struct md_sysfs_entry md_sync_completed =
+        __ATTR_PREALLOC(sync_completed, S_IRUGO, sync_completed_show, NULL);
 
 static ssize_t
 min_sync_show(struct mddev *mddev, char *page)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 4153da5d4011..d34e238afa54 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -560,7 +560,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                 if (test_bit(WriteMostly, &rdev->flags)) {
                         /* Don't balance among write-mostly, just
                          * use the first as a last resort */
-                        if (best_disk < 0) {
+                        if (best_dist_disk < 0) {
                                 if (is_badblock(rdev, this_sector, sectors,
                                                 &first_bad, &bad_sectors)) {
                                         if (first_bad < this_sector)
@@ -569,7 +569,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                                         best_good_sectors = first_bad - this_sector;
                                 } else
                                         best_good_sectors = sectors;
-                                best_disk = disk;
+                                best_dist_disk = disk;
+                                best_pending_disk = disk;
                         }
                         continue;
                 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e75d48c0421a..cd2f96b2c572 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5121,12 +5121,17 @@ static inline sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int
                 schedule_timeout_uninterruptible(1);
         }
         /* Need to check if array will still be degraded after recovery/resync
-         * We don't need to check the 'failed' flag as when that gets set,
-         * recovery aborts.
+         * Note in case of > 1 drive failures it's possible we're rebuilding
+         * one drive while leaving another faulty drive in array.
          */
-        for (i = 0; i < conf->raid_disks; i++)
-                if (conf->disks[i].rdev == NULL)
+        rcu_read_lock();
+        for (i = 0; i < conf->raid_disks; i++) {
+                struct md_rdev *rdev = ACCESS_ONCE(conf->disks[i].rdev);
+
+                if (rdev == NULL || test_bit(Faulty, &rdev->flags))
                         still_degraded = 1;
+        }
+        rcu_read_unlock();
 
         bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, still_degraded);
 
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 9306219d5675..6ad049a08e4d 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -341,6 +341,8 @@ void mei_stop(struct mei_device *dev)
 
         dev->dev_state = MEI_DEV_POWER_DOWN;
         mei_reset(dev);
+        /* move device to disabled state unconditionally */
+        dev->dev_state = MEI_DEV_DISABLED;
 
         mutex_unlock(&dev->device_lock);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 84673ebcf428..df51d6025a90 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -157,7 +157,7 @@ config IPVLAN
       making it transparent to the connected L2 switch.
 
       Ipvlan devices can be added using the "ip" command from the
-      iproute2 package starting with the iproute2-X.Y.ZZ release:
+      iproute2 package starting with the iproute2-3.19 release:
 
       "ip link add link <main-dev> [ NAME ] type ipvlan"
 
diff --git a/drivers/net/appletalk/Kconfig b/drivers/net/appletalk/Kconfig
index 4ce6ca5f3d36..dc6b78e5342f 100644
--- a/drivers/net/appletalk/Kconfig
+++ b/drivers/net/appletalk/Kconfig
@@ -40,7 +40,7 @@ config DEV_APPLETALK
 
 config LTPC
         tristate "Apple/Farallon LocalTalk PC support"
-        depends on DEV_APPLETALK && (ISA || EISA) && ISA_DMA_API
+        depends on DEV_APPLETALK && (ISA || EISA) && ISA_DMA_API && VIRT_TO_BUS
         help
           This allows you to use the AppleTalk PC card to connect to LocalTalk
           networks. The card is also known as the Farallon PhoneNet PC card.
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3c82e02e3dae..b0f69248cb71 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -579,6 +579,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
+
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
 
@@ -603,6 +607,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
+
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
 
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 2928f7003041..a316fa4b91ab 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 Valeo S.A.
  */
 
+#include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -584,8 +585,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                 while (pos <= actual_len - MSG_HEADER_LEN) {
                         tmp = buf + pos;
 
-                        if (!tmp->len)
-                                break;
+                        /* Handle messages crossing the USB endpoint max packet
+                         * size boundary. Check kvaser_usb_read_bulk_callback()
+                         * for further details.
+                         */
+                        if (tmp->len == 0) {
+                                pos = round_up(pos,
+                                               dev->bulk_in->wMaxPacketSize);
+                                continue;
+                        }
 
                         if (pos + tmp->len > actual_len) {
                                 dev_err(dev->udev->dev.parent,
@@ -787,7 +795,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                 netdev_err(netdev, "Error transmitting URB\n");
                 usb_unanchor_urb(urb);
                 usb_free_urb(urb);
-                kfree(buf);
                 return err;
         }
 
@@ -1317,8 +1324,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
         while (pos <= urb->actual_length - MSG_HEADER_LEN) {
                 msg = urb->transfer_buffer + pos;
 
-                if (!msg->len)
-                        break;
+                /* The Kvaser firmware can only read and write messages that
+                 * does not cross the USB's endpoint wMaxPacketSize boundary.
+                 * If a follow-up command crosses such boundary, firmware puts
+                 * a placeholder zero-length command in its place then aligns
+                 * the real command to the next max packet size.
+                 *
+                 * Handle such cases or we're going to miss a significant
+                 * number of events in case of a heavy rx load on the bus.
+                 */
+                if (msg->len == 0) {
+                        pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+                        continue;
+                }
 
                 if (pos + msg->len > urb->actual_length) {
                         dev_err(dev->udev->dev.parent, "Format error\n");
@@ -1326,7 +1344,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                 }
 
                 kvaser_usb_handle_message(dev, msg);
-
                 pos += msg->len;
         }
 
@@ -1615,8 +1632,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         struct urb *urb;
         void *buf;
         struct kvaser_msg *msg;
-        int i, err;
-        int ret = NETDEV_TX_OK;
+        int i, err, ret = NETDEV_TX_OK;
         u8 *msg_tx_can_flags = NULL;            /* GCC */
 
         if (can_dropped_invalid_skb(netdev, skb))
@@ -1634,7 +1650,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         if (!buf) {
                 stats->tx_dropped++;
                 dev_kfree_skb(skb);
-                goto nobufmem;
+                goto freeurb;
         }
 
         msg = buf;
@@ -1681,8 +1697,10 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         /* This should never happen; it implies a flow control bug */
         if (!context) {
                 netdev_warn(netdev, "cannot find free context\n");
+
+                kfree(buf);
                 ret =  NETDEV_TX_BUSY;
-                goto releasebuf;
+                goto freeurb;
         }
 
         context->priv = priv;
@@ -1719,16 +1737,12 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 else
                         netdev_warn(netdev, "Failed tx_urb %d\n", err);
 
-                goto releasebuf;
+                goto freeurb;
         }
 
-        usb_free_urb(urb);
-
-        return NETDEV_TX_OK;
+        ret = NETDEV_TX_OK;
 
-releasebuf:
-        kfree(buf);
-nobufmem:
+freeurb:
         usb_free_urb(urb);
         return ret;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 962c3f027383..0bac0f14edc3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -879,6 +879,10 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
 
                 pdev->usb_if = ppdev->usb_if;
                 pdev->cmd_buffer_addr = ppdev->cmd_buffer_addr;
+
+                /* do a copy of the ctrlmode[_supported] too */
+                dev->can.ctrlmode = ppdev->dev.can.ctrlmode;
+                dev->can.ctrlmode_supported = ppdev->dev.can.ctrlmode_supported;
         }
 
         pdev->usb_if->dev[dev->ctrl_idx] = dev;
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index ee9f650d5026..7b7053d3c5fa 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -105,8 +105,8 @@ static inline u64 name##_readq(struct bcm_sf2_priv *priv, u32 off)	\
 {                                                                       \
         u32 indir, dir;                                                 \
         spin_lock(&priv->indir_lock);                                   \
-        indir = reg_readl(priv, REG_DIR_DATA_READ);                     \
         dir = __raw_readl(priv->name + off);                            \
+        indir = reg_readl(priv, REG_DIR_DATA_READ);                     \
         spin_unlock(&priv->indir_lock);                                 \
         return (u64)indir << 32 | dir;                                  \
 }                                                                       \
diff --git a/drivers/net/ethernet/8390/axnet_cs.c b/drivers/net/ethernet/8390/axnet_cs.c
index 7769c05543f1..ec6eac1f8c95 100644
--- a/drivers/net/ethernet/8390/axnet_cs.c
+++ b/drivers/net/ethernet/8390/axnet_cs.c
@@ -484,11 +484,8 @@ static int axnet_open(struct net_device *dev)
     link->open++;
 
     info->link_status = 0x00;
-    init_timer(&info->watchdog);
-    info->watchdog.function = ei_watchdog;
-    info->watchdog.data = (u_long)dev;
-    info->watchdog.expires = jiffies + HZ;
-    add_timer(&info->watchdog);
+    setup_timer(&info->watchdog, ei_watchdog, (u_long)dev);
+    mod_timer(&info->watchdog, jiffies + HZ);
 
     return ax_open(dev);
 } /* axnet_open */
diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 9fb7b9d4fd6c..2777289a26c0 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -918,11 +918,8 @@ static int pcnet_open(struct net_device *dev)
 
     info->phy_id = info->eth_phy;
     info->link_status = 0x00;
-    init_timer(&info->watchdog);
-    info->watchdog.function = ei_watchdog;
-    info->watchdog.data = (u_long)dev;
-    info->watchdog.expires = jiffies + HZ;
-    add_timer(&info->watchdog);
+    setup_timer(&info->watchdog, ei_watchdog, (u_long)dev);
+    mod_timer(&info->watchdog, jiffies + HZ);
 
     return ei_open(dev);
 } /* pcnet_open */
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 760c72c6e2ac..6725dc00750b 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -376,7 +376,8 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
         u16 pktlength;
         u16 pktstatus;
 
-        while ((rxstatus = priv->dmaops->get_rx_status(priv)) != 0) {
+        while (((rxstatus = priv->dmaops->get_rx_status(priv)) != 0) &&
+               (count < limit))  {
                 pktstatus = rxstatus >> 16;
                 pktlength = rxstatus & 0xffff;
 
@@ -491,28 +492,27 @@ static int tse_poll(struct napi_struct *napi, int budget)
         struct altera_tse_private *priv =
                         container_of(napi, struct altera_tse_private, napi);
         int rxcomplete = 0;
-        int txcomplete = 0;
         unsigned long int flags;
 
-        txcomplete = tse_tx_complete(priv);
+        tse_tx_complete(priv);
 
         rxcomplete = tse_rx(priv, budget);
 
-        if (rxcomplete >= budget || txcomplete > 0)
-                return rxcomplete;
+        if (rxcomplete < budget) {
 
-        napi_gro_flush(napi, false);
-        __napi_complete(napi);
+                napi_gro_flush(napi, false);
+                __napi_complete(napi);
 
-        netdev_dbg(priv->dev,
-                   "NAPI Complete, did %d packets with budget %d\n",
-                   txcomplete+rxcomplete, budget);
+                netdev_dbg(priv->dev,
+                           "NAPI Complete, did %d packets with budget %d\n",
+                           rxcomplete, budget);
 
-        spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
-        priv->dmaops->enable_rxirq(priv);
-        priv->dmaops->enable_txirq(priv);
-        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
-        return rxcomplete + txcomplete;
+                spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
+                priv->dmaops->enable_rxirq(priv);
+                priv->dmaops->enable_txirq(priv);
+                spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
+        }
+        return rxcomplete;
 }
 
 /* DMA TX & RX FIFO interrupt routing
@@ -521,7 +521,6 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct altera_tse_private *priv;
-        unsigned long int flags;
 
         if (unlikely(!dev)) {
                 pr_err("%s: invalid dev pointer\n", __func__);
@@ -529,20 +528,20 @@ static irqreturn_t altera_isr(int irq, void *dev_id)
         }
         priv = netdev_priv(dev);
 
-        /* turn off desc irqs and enable napi rx */
-        spin_lock_irqsave(&priv->rxdma_irq_lock, flags);
+        spin_lock(&priv->rxdma_irq_lock);
+        /* reset IRQs */
+        priv->dmaops->clear_rxirq(priv);
+        priv->dmaops->clear_txirq(priv);
+        spin_unlock(&priv->rxdma_irq_lock);
 
         if (likely(napi_schedule_prep(&priv->napi))) {
+                spin_lock(&priv->rxdma_irq_lock);
                 priv->dmaops->disable_rxirq(priv);
                 priv->dmaops->disable_txirq(priv);
+                spin_unlock(&priv->rxdma_irq_lock);
                 __napi_schedule(&priv->napi);
         }
 
-        /* reset IRQs */
-        priv->dmaops->clear_rxirq(priv);
-        priv->dmaops->clear_txirq(priv);
-
-        spin_unlock_irqrestore(&priv->rxdma_irq_lock, flags);
 
         return IRQ_HANDLED;
 }
@@ -1399,7 +1398,7 @@ static int altera_tse_probe(struct platform_device *pdev)
         }
 
         if (of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth",
-                                 &priv->rx_fifo_depth)) {
+                                 &priv->tx_fifo_depth)) {
                 dev_err(&pdev->dev, "cannot obtain tx-fifo-depth\n");
                 ret = -ENXIO;
                 goto err_free_netdev;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index b93d4404d975..885b02b5be07 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -609,6 +609,68 @@ static void xgbe_napi_disable(struct xgbe_prv_data *pdata, unsigned int del)
         }
 }
 
+static int xgbe_request_irqs(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_channel *channel;
+        struct net_device *netdev = pdata->netdev;
+        unsigned int i;
+        int ret;
+
+        ret = devm_request_irq(pdata->dev, pdata->dev_irq, xgbe_isr, 0,
+                               netdev->name, pdata);
+        if (ret) {
+                netdev_alert(netdev, "error requesting irq %d\n",
+                             pdata->dev_irq);
+                return ret;
+        }
+
+        if (!pdata->per_channel_irq)
+                return 0;
+
+        channel = pdata->channel;
+        for (i = 0; i < pdata->channel_count; i++, channel++) {
+                snprintf(channel->dma_irq_name,
+                         sizeof(channel->dma_irq_name) - 1,
+                         "%s-TxRx-%u", netdev_name(netdev),
+                         channel->queue_index);
+
+                ret = devm_request_irq(pdata->dev, channel->dma_irq,
+                                       xgbe_dma_isr, 0,
+                                       channel->dma_irq_name, channel);
+                if (ret) {
+                        netdev_alert(netdev, "error requesting irq %d\n",
+                                     channel->dma_irq);
+                        goto err_irq;
+                }
+        }
+
+        return 0;
+
+err_irq:
+        /* Using an unsigned int, 'i' will go to UINT_MAX and exit */
+        for (i--, channel--; i < pdata->channel_count; i--, channel--)
+                devm_free_irq(pdata->dev, channel->dma_irq, channel);
+
+        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
+
+        return ret;
+}
+
+static void xgbe_free_irqs(struct xgbe_prv_data *pdata)
+{
+        struct xgbe_channel *channel;
+        unsigned int i;
+
+        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
+
+        if (!pdata->per_channel_irq)
+                return;
+
+        channel = pdata->channel;
+        for (i = 0; i < pdata->channel_count; i++, channel++)
+                devm_free_irq(pdata->dev, channel->dma_irq, channel);
+}
+
 void xgbe_init_tx_coalesce(struct xgbe_prv_data *pdata)
 {
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
@@ -810,20 +872,20 @@ int xgbe_powerdown(struct net_device *netdev, unsigned int caller)
                 return -EINVAL;
         }
 
-        phy_stop(pdata->phydev);
-
         spin_lock_irqsave(&pdata->lock, flags);
 
         if (caller == XGMAC_DRIVER_CONTEXT)
                 netif_device_detach(netdev);
 
         netif_tx_stop_all_queues(netdev);
-        xgbe_napi_disable(pdata, 0);
 
-        /* Powerdown Tx/Rx */
         hw_if->powerdown_tx(pdata);
         hw_if->powerdown_rx(pdata);
 
+        xgbe_napi_disable(pdata, 0);
+
+        phy_stop(pdata->phydev);
+
         pdata->power_down = 1;
 
         spin_unlock_irqrestore(&pdata->lock, flags);
@@ -854,14 +916,14 @@ int xgbe_powerup(struct net_device *netdev, unsigned int caller)
 
         phy_start(pdata->phydev);
 
-        /* Enable Tx/Rx */
+        xgbe_napi_enable(pdata, 0);
+
         hw_if->powerup_tx(pdata);
         hw_if->powerup_rx(pdata);
 
         if (caller == XGMAC_DRIVER_CONTEXT)
                 netif_device_attach(netdev);
 
-        xgbe_napi_enable(pdata, 0);
         netif_tx_start_all_queues(netdev);
 
         spin_unlock_irqrestore(&pdata->lock, flags);
@@ -875,6 +937,7 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 {
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct net_device *netdev = pdata->netdev;
+        int ret;
 
         DBGPR("-->xgbe_start\n");
 
@@ -884,17 +947,31 @@ static int xgbe_start(struct xgbe_prv_data *pdata)
 
         phy_start(pdata->phydev);
 
+        xgbe_napi_enable(pdata, 1);
+
+        ret = xgbe_request_irqs(pdata);
+        if (ret)
+                goto err_napi;
+
         hw_if->enable_tx(pdata);
         hw_if->enable_rx(pdata);
 
         xgbe_init_tx_timers(pdata);
 
-        xgbe_napi_enable(pdata, 1);
         netif_tx_start_all_queues(netdev);
 
         DBGPR("<--xgbe_start\n");
 
         return 0;
+
+err_napi:
+        xgbe_napi_disable(pdata, 1);
+
+        phy_stop(pdata->phydev);
+
+        hw_if->exit(pdata);
+
+        return ret;
 }
 
 static void xgbe_stop(struct xgbe_prv_data *pdata)
@@ -907,16 +984,21 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
 
         DBGPR("-->xgbe_stop\n");
 
-        phy_stop(pdata->phydev);
-
         netif_tx_stop_all_queues(netdev);
-        xgbe_napi_disable(pdata, 1);
 
         xgbe_stop_tx_timers(pdata);
 
         hw_if->disable_tx(pdata);
         hw_if->disable_rx(pdata);
 
+        xgbe_free_irqs(pdata);
+
+        xgbe_napi_disable(pdata, 1);
+
+        phy_stop(pdata->phydev);
+
+        hw_if->exit(pdata);
+
         channel = pdata->channel;
         for (i = 0; i < pdata->channel_count; i++, channel++) {
                 if (!channel->tx_ring)
@@ -931,10 +1013,6 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
 
 static void xgbe_restart_dev(struct xgbe_prv_data *pdata)
 {
-        struct xgbe_channel *channel;
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
-        unsigned int i;
-
         DBGPR("-->xgbe_restart_dev\n");
 
         /* If not running, "restart" will happen on open */
@@ -942,19 +1020,10 @@ static void xgbe_restart_dev(struct xgbe_prv_data *pdata)
                 return;
 
         xgbe_stop(pdata);
-        synchronize_irq(pdata->dev_irq);
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++)
-                        synchronize_irq(channel->dma_irq);
-        }
 
         xgbe_free_tx_data(pdata);
         xgbe_free_rx_data(pdata);
 
-        /* Issue software reset to device */
-        hw_if->exit(pdata);
-
         xgbe_start(pdata);
 
         DBGPR("<--xgbe_restart_dev\n");
@@ -1283,10 +1352,7 @@ static void xgbe_packet_info(struct xgbe_prv_data *pdata,
 static int xgbe_open(struct net_device *netdev)
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct xgbe_desc_if *desc_if = &pdata->desc_if;
-        struct xgbe_channel *channel = NULL;
-        unsigned int i = 0;
         int ret;
 
         DBGPR("-->xgbe_open\n");
@@ -1329,55 +1395,14 @@ static int xgbe_open(struct net_device *netdev)
         INIT_WORK(&pdata->restart_work, xgbe_restart);
         INIT_WORK(&pdata->tx_tstamp_work, xgbe_tx_tstamp);
 
-        /* Request interrupts */
-        ret = devm_request_irq(pdata->dev, pdata->dev_irq, xgbe_isr, 0,
-                               netdev->name, pdata);
-        if (ret) {
-                netdev_alert(netdev, "error requesting irq %d\n",
-                             pdata->dev_irq);
-                goto err_rings;
-        }
-
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++) {
-                        snprintf(channel->dma_irq_name,
-                                 sizeof(channel->dma_irq_name) - 1,
-                                 "%s-TxRx-%u", netdev_name(netdev),
-                                 channel->queue_index);
-
-                        ret = devm_request_irq(pdata->dev, channel->dma_irq,
-                                               xgbe_dma_isr, 0,
-                                               channel->dma_irq_name, channel);
-                        if (ret) {
-                                netdev_alert(netdev,
-                                             "error requesting irq %d\n",
-                                             channel->dma_irq);
-                                goto err_irq;
-                        }
-                }
-        }
-
         ret = xgbe_start(pdata);
         if (ret)
-                goto err_start;
+                goto err_rings;
 
         DBGPR("<--xgbe_open\n");
 
         return 0;
 
-err_start:
-        hw_if->exit(pdata);
-
-err_irq:
-        if (pdata->per_channel_irq) {
-                /* Using an unsigned int, 'i' will go to UINT_MAX and exit */
-                for (i--, channel--; i < pdata->channel_count; i--, channel--)
-                        devm_free_irq(pdata->dev, channel->dma_irq, channel);
-        }
-
-        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
-
 err_rings:
         desc_if->free_ring_resources(pdata);
 
@@ -1399,30 +1424,16 @@ err_phy_init:
 static int xgbe_close(struct net_device *netdev)
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
-        struct xgbe_hw_if *hw_if = &pdata->hw_if;
         struct xgbe_desc_if *desc_if = &pdata->desc_if;
-        struct xgbe_channel *channel;
-        unsigned int i;
 
         DBGPR("-->xgbe_close\n");
 
         /* Stop the device */
         xgbe_stop(pdata);
 
-        /* Issue software reset to device */
-        hw_if->exit(pdata);
-
         /* Free the ring descriptors and buffers */
         desc_if->free_ring_resources(pdata);
 
-        /* Release the interrupts */
-        devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
-        if (pdata->per_channel_irq) {
-                channel = pdata->channel;
-                for (i = 0; i < pdata->channel_count; i++, channel++)
-                        devm_free_irq(pdata->dev, channel->dma_irq, channel);
-        }
-
         /* Free the channel and ring structures */
         xgbe_free_channels(pdata);
 
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 869d97fcf781..b927021c6c40 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -593,7 +593,7 @@ static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
         if (!xgene_ring_mgr_init(pdata))
                 return -ENODEV;
 
-        if (!efi_enabled(EFI_BOOT)) {
+        if (pdata->clk) {
                 clk_prepare_enable(pdata->clk);
                 clk_disable_unprepare(pdata->clk);
                 clk_prepare_enable(pdata->clk);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 4de62b210c85..635a83be7e5e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1025,6 +1025,8 @@ static int xgene_enet_remove(struct platform_device *pdev)
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgene_enet_acpi_match[] = {
         { "APMC0D05", },
+        { "APMC0D30", },
+        { "APMC0D31", },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
@@ -1033,6 +1035,8 @@ MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
 #ifdef CONFIG_OF
 static struct of_device_id xgene_enet_of_match[] = {
         {.compatible = "apm,xgene-enet",},
+        {.compatible = "apm,xgene1-sgenet",},
+        {.compatible = "apm,xgene1-xgenet",},
         {},
 };
 
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 21206d33b638..a7f2cc3e485e 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -486,7 +486,7 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
 {
         struct bcm_enet_priv *priv;
         struct net_device *dev;
-        int tx_work_done, rx_work_done;
+        int rx_work_done;
 
         priv = container_of(napi, struct bcm_enet_priv, napi);
         dev = priv->net_dev;
@@ -498,14 +498,14 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
                          ENETDMAC_IR, priv->tx_chan);
 
         /* reclaim sent skb */
-        tx_work_done = bcm_enet_tx_reclaim(dev, 0);
+        bcm_enet_tx_reclaim(dev, 0);
 
         spin_lock(&priv->rx_lock);
         rx_work_done = bcm_enet_receive_queue(dev, budget);
         spin_unlock(&priv->rx_lock);
 
-        if (rx_work_done >= budget || tx_work_done > 0) {
-                /* rx/tx queue is not yet empty/clean */
+        if (rx_work_done >= budget) {
+                /* rx queue is not yet empty/clean */
                 return rx_work_done;
         }
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 5b308a4a4d0e..783543ad1fcf 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -274,9 +274,9 @@ static const struct bcm_sysport_stats bcm_sysport_gstrings_stats[] = {
         /* RBUF misc statistics */
         STAT_RBUF("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt, RBUF_OVFL_DISC_CNTR),
         STAT_RBUF("rbuf_err_cnt", mib.rbuf_err_cnt, RBUF_ERR_PKT_CNTR),
-        STAT_MIB_RX("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
-        STAT_MIB_RX("rx_dma_failed", mib.rx_dma_failed),
-        STAT_MIB_TX("tx_dma_failed", mib.tx_dma_failed),
+        STAT_MIB_SOFT("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
+        STAT_MIB_SOFT("rx_dma_failed", mib.rx_dma_failed),
+        STAT_MIB_SOFT("tx_dma_failed", mib.tx_dma_failed),
 };
 
 #define BCM_SYSPORT_STATS_LEN   ARRAY_SIZE(bcm_sysport_gstrings_stats)
@@ -345,6 +345,7 @@ static void bcm_sysport_update_mib_counters(struct bcm_sysport_priv *priv)
                 s = &bcm_sysport_gstrings_stats[i];
                 switch (s->type) {
                 case BCM_SYSPORT_STAT_NETDEV:
+                case BCM_SYSPORT_STAT_SOFT:
                         continue;
                 case BCM_SYSPORT_STAT_MIB_RX:
                 case BCM_SYSPORT_STAT_MIB_TX:
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index fc19417d82a5..7e3d87a88c76 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -570,6 +570,7 @@ enum bcm_sysport_stat_type {
         BCM_SYSPORT_STAT_RUNT,
         BCM_SYSPORT_STAT_RXCHK,
         BCM_SYSPORT_STAT_RBUF,
+        BCM_SYSPORT_STAT_SOFT,
 };
 
 /* Macros to help define ethtool statistics */
@@ -590,6 +591,7 @@ enum bcm_sysport_stat_type {
 #define STAT_MIB_RX(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_MIB_RX)
 #define STAT_MIB_TX(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_MIB_TX)
 #define STAT_RUNT(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_RUNT)
+#define STAT_MIB_SOFT(str, m) STAT_MIB(str, m, BCM_SYSPORT_STAT_SOFT)
 
 #define STAT_RXCHK(str, m, ofs) { \
         .stat_string = str, \
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 676ffe093180..0469f72c6e7e 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -302,9 +302,6 @@ static int bgmac_dma_rx_skb_for_slot(struct bgmac *bgmac,
         slot->skb = skb;
         slot->dma_addr = dma_addr;
 
-        if (slot->dma_addr & 0xC0000000)
-                bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
-
         return 0;
 }
 
@@ -505,8 +502,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                                   ring->mmio_base);
                         goto err_dma_free;
                 }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
                 ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                       BGMAC_DMA_RING_TX);
@@ -536,8 +531,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                         err = -ENOMEM;
                         goto err_dma_free;
                 }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
 
                 ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                       BGMAC_DMA_RING_RX);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 7155e1d2c208..bef750a09027 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12722,6 +12722,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
         pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                                PCICFG_VENDOR_ID_OFFSET);
 
+        /* Set PCIe reset type to fundamental for EEH recovery */
+        pdev->needs_freset = 1;
+
         /* AER (Advanced Error reporting) configuration */
         rc = pci_enable_pcie_error_reporting(pdev);
         if (!rc)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index ff83c46bc389..6befde61c203 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -487,6 +487,7 @@ enum bcmgenet_stat_type {
         BCMGENET_STAT_MIB_TX,
         BCMGENET_STAT_RUNT,
         BCMGENET_STAT_MISC,
+        BCMGENET_STAT_SOFT,
 };
 
 struct bcmgenet_stats {
@@ -515,6 +516,7 @@ struct bcmgenet_stats {
 #define STAT_GENET_MIB_RX(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_MIB_RX)
 #define STAT_GENET_MIB_TX(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_MIB_TX)
 #define STAT_GENET_RUNT(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_RUNT)
+#define STAT_GENET_SOFT_MIB(str, m) STAT_GENET_MIB(str, m, BCMGENET_STAT_SOFT)
 
 #define STAT_GENET_MISC(str, m, offset) { \
         .stat_string = str, \
@@ -614,9 +616,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = {
                         UMAC_RBUF_OVFL_CNT),
         STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT),
         STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT),
-        STAT_GENET_MIB_RX("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
-        STAT_GENET_MIB_RX("rx_dma_failed", mib.rx_dma_failed),
-        STAT_GENET_MIB_TX("tx_dma_failed", mib.tx_dma_failed),
+        STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
+        STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed),
+        STAT_GENET_SOFT_MIB("tx_dma_failed", mib.tx_dma_failed),
 };
 
 #define BCMGENET_STATS_LEN      ARRAY_SIZE(bcmgenet_gstrings_stats)
@@ -668,6 +670,7 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
                 s = &bcmgenet_gstrings_stats[i];
                 switch (s->type) {
                 case BCMGENET_STAT_NETDEV:
+                case BCMGENET_STAT_SOFT:
                         continue;
                 case BCMGENET_STAT_MIB_RX:
                 case BCMGENET_STAT_MIB_TX:
@@ -971,13 +974,14 @@ static inline void bcmgenet_tx_ring_int_disable(struct bcmgenet_priv *priv,
 }
 
 /* Unlocked version of the reclaim routine */
-static void __bcmgenet_tx_reclaim(struct net_device *dev,
-                                  struct bcmgenet_tx_ring *ring)
+static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
+                                          struct bcmgenet_tx_ring *ring)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         int last_tx_cn, last_c_index, num_tx_bds;
         struct enet_cb *tx_cb_ptr;
         struct netdev_queue *txq;
+        unsigned int pkts_compl = 0;
         unsigned int bds_compl;
         unsigned int c_index;
 
@@ -1005,6 +1009,7 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
                 tx_cb_ptr = ring->cbs + last_c_index;
                 bds_compl = 0;
                 if (tx_cb_ptr->skb) {
+                        pkts_compl++;
                         bds_compl = skb_shinfo(tx_cb_ptr->skb)->nr_frags + 1;
                         dev->stats.tx_bytes += tx_cb_ptr->skb->len;
                         dma_unmap_single(&dev->dev,
@@ -1028,23 +1033,45 @@ static void __bcmgenet_tx_reclaim(struct net_device *dev,
                 last_c_index &= (num_tx_bds - 1);
         }
 
-        if (ring->free_bds > (MAX_SKB_FRAGS + 1))
-                ring->int_disable(priv, ring);
-
-        if (netif_tx_queue_stopped(txq))
-                netif_tx_wake_queue(txq);
+        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
+                if (netif_tx_queue_stopped(txq))
+                        netif_tx_wake_queue(txq);
+        }
 
         ring->c_index = c_index;
+
+        return pkts_compl;
 }
 
-static void bcmgenet_tx_reclaim(struct net_device *dev,
+static unsigned int bcmgenet_tx_reclaim(struct net_device *dev,
                                 struct bcmgenet_tx_ring *ring)
 {
+        unsigned int released;
         unsigned long flags;
 
         spin_lock_irqsave(&ring->lock, flags);
-        __bcmgenet_tx_reclaim(dev, ring);
+        released = __bcmgenet_tx_reclaim(dev, ring);
         spin_unlock_irqrestore(&ring->lock, flags);
+
+        return released;
+}
+
+static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
+{
+        struct bcmgenet_tx_ring *ring =
+                container_of(napi, struct bcmgenet_tx_ring, napi);
+        unsigned int work_done = 0;
+
+        work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
+
+        if (work_done == 0) {
+                napi_complete(napi);
+                ring->int_enable(ring->priv, ring);
+
+                return 0;
+        }
+
+        return budget;
 }
 
 static void bcmgenet_tx_reclaim_all(struct net_device *dev)
@@ -1302,10 +1329,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
         bcmgenet_tdma_ring_writel(priv, ring->index,
                                   ring->prod_index, TDMA_PROD_INDEX);
 
-        if (ring->free_bds <= (MAX_SKB_FRAGS + 1)) {
+        if (ring->free_bds <= (MAX_SKB_FRAGS + 1))
                 netif_tx_stop_queue(txq);
-                ring->int_enable(priv, ring);
-        }
 
 out:
         spin_unlock_irqrestore(&ring->lock, flags);
@@ -1621,6 +1646,7 @@ static int init_umac(struct bcmgenet_priv *priv)
         struct device *kdev = &priv->pdev->dev;
         int ret;
         u32 reg, cpu_mask_clear;
+        int index;
 
         dev_dbg(&priv->pdev->dev, "bcmgenet: init_umac\n");
 
@@ -1647,7 +1673,7 @@ static int init_umac(struct bcmgenet_priv *priv)
 
         bcmgenet_intr_disable(priv);
 
-        cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE;
+        cpu_mask_clear = UMAC_IRQ_RXDMA_BDONE | UMAC_IRQ_TXDMA_BDONE;
 
         dev_dbg(kdev, "%s:Enabling RXDMA_BDONE interrupt\n", __func__);
 
@@ -1674,6 +1700,10 @@ static int init_umac(struct bcmgenet_priv *priv)
 
         bcmgenet_intrl2_0_writel(priv, cpu_mask_clear, INTRL2_CPU_MASK_CLEAR);
 
+        for (index = 0; index < priv->hw_params->tx_queues; index++)
+                bcmgenet_intrl2_1_writel(priv, (1 << index),
+                                         INTRL2_CPU_MASK_CLEAR);
+
         /* Enable rx/tx engine.*/
         dev_dbg(kdev, "done init umac\n");
 
@@ -1693,6 +1723,8 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
         unsigned int first_bd;
 
         spin_lock_init(&ring->lock);
+        ring->priv = priv;
+        netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll, 64);
         ring->index = index;
         if (index == DESC_INDEX) {
                 ring->queue = 0;
@@ -1738,6 +1770,17 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
                                   TDMA_WRITE_PTR);
         bcmgenet_tdma_ring_writel(priv, index, end_ptr * words_per_bd - 1,
                                   DMA_END_ADDR);
+
+        napi_enable(&ring->napi);
+}
+
+static void bcmgenet_fini_tx_ring(struct bcmgenet_priv *priv,
+                                  unsigned int index)
+{
+        struct bcmgenet_tx_ring *ring = &priv->tx_rings[index];
+
+        napi_disable(&ring->napi);
+        netif_napi_del(&ring->napi);
 }
 
 /* Initialize a RDMA ring */
@@ -1907,7 +1950,7 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
         return ret;
 }
 
-static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+static void __bcmgenet_fini_dma(struct bcmgenet_priv *priv)
 {
         int i;
 
@@ -1926,6 +1969,18 @@ static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
         kfree(priv->tx_cbs);
 }
 
+static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
+{
+        int i;
+
+        bcmgenet_fini_tx_ring(priv, DESC_INDEX);
+
+        for (i = 0; i < priv->hw_params->tx_queues; i++)
+                bcmgenet_fini_tx_ring(priv, i);
+
+        __bcmgenet_fini_dma(priv);
+}
+
 /* init_edma: Initialize DMA control register */
 static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
 {
@@ -1952,7 +2007,7 @@ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
         priv->tx_cbs = kcalloc(priv->num_tx_bds, sizeof(struct enet_cb),
                                GFP_KERNEL);
         if (!priv->tx_cbs) {
-                bcmgenet_fini_dma(priv);
+                __bcmgenet_fini_dma(priv);
                 return -ENOMEM;
         }
 
@@ -1975,9 +2030,6 @@ static int bcmgenet_poll(struct napi_struct *napi, int budget)
                         struct bcmgenet_priv, napi);
         unsigned int work_done;
 
-        /* tx reclaim */
-        bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
-
         work_done = bcmgenet_desc_rx(priv, budget);
 
         /* Advancing our consumer index*/
@@ -2022,28 +2074,34 @@ static void bcmgenet_irq_task(struct work_struct *work)
 static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
 {
         struct bcmgenet_priv *priv = dev_id;
+        struct bcmgenet_tx_ring *ring;
         unsigned int index;
 
         /* Save irq status for bottom-half processing. */
         priv->irq1_stat =
                 bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
-                ~priv->int1_mask;
+                ~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
         /* clear interrupts */
         bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
                   "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
+
         /* Check the MBDONE interrupts.
          * packet is done, reclaim descriptors
          */
-        if (priv->irq1_stat & 0x0000ffff) {
-                index = 0;
-                for (index = 0; index < 16; index++) {
-                        if (priv->irq1_stat & (1 << index))
-                                bcmgenet_tx_reclaim(priv->dev,
-                                                    &priv->tx_rings[index]);
+        for (index = 0; index < priv->hw_params->tx_queues; index++) {
+                if (!(priv->irq1_stat & BIT(index)))
+                        continue;
+
+                ring = &priv->tx_rings[index];
+
+                if (likely(napi_schedule_prep(&ring->napi))) {
+                        ring->int_disable(priv, ring);
+                        __napi_schedule(&ring->napi);
                 }
         }
+
         return IRQ_HANDLED;
 }
 
@@ -2075,8 +2133,12 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
         }
         if (priv->irq0_stat &
                         (UMAC_IRQ_TXDMA_BDONE | UMAC_IRQ_TXDMA_PDONE)) {
-                /* Tx reclaim */
-                bcmgenet_tx_reclaim(priv->dev, &priv->tx_rings[DESC_INDEX]);
+                struct bcmgenet_tx_ring *ring = &priv->tx_rings[DESC_INDEX];
+
+                if (likely(napi_schedule_prep(&ring->napi))) {
+                        ring->int_disable(priv, ring);
+                        __napi_schedule(&ring->napi);
+                }
         }
         if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
                                 UMAC_IRQ_PHY_DET_F |
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index b36ddec0cc0a..0d370d168aee 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -520,6 +520,7 @@ struct bcmgenet_hw_params {
 
 struct bcmgenet_tx_ring {
         spinlock_t      lock;           /* ring lock */
+        struct napi_struct napi;        /* NAPI per tx queue */
         unsigned int    index;          /* ring index */
         unsigned int    queue;          /* queue index */
         struct enet_cb  *cbs;           /* tx ring buffer control block*/
@@ -534,6 +535,7 @@ struct bcmgenet_tx_ring {
                            struct bcmgenet_tx_ring *);
         void (*int_disable)(struct bcmgenet_priv *priv,
                             struct bcmgenet_tx_ring *);
+        struct bcmgenet_priv *priv;
 };
 
 /* device context */
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index 149a0d70c108..b97122926d3a 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -73,15 +73,17 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & ~(WAKE_MAGIC | WAKE_MAGICSECURE))
                 return -EINVAL;
 
+        reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
         if (wol->wolopts & WAKE_MAGICSECURE) {
                 bcmgenet_umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
                                      UMAC_MPD_PW_MS);
                 bcmgenet_umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
                                      UMAC_MPD_PW_LS);
-                reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
                 reg |= MPD_PW_EN;
-                bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
+        } else {
+                reg &= ~MPD_PW_EN;
         }
+        bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
 
         /* Flag the device and relevant IRQ as wakeup capable */
         if (wol->wolopts) {
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ad76b8e35a00..81d41539fcba 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -2113,17 +2113,17 @@ static const struct net_device_ops macb_netdev_ops = {
 };
 
 #if defined(CONFIG_OF)
-static struct macb_config pc302gem_config = {
+static const struct macb_config pc302gem_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
         .dma_burst_length = 16,
 };
 
-static struct macb_config sama5d3_config = {
+static const struct macb_config sama5d3_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
         .dma_burst_length = 16,
 };
 
-static struct macb_config sama5d4_config = {
+static const struct macb_config sama5d4_config = {
         .caps = 0,
         .dma_burst_length = 4,
 };
@@ -2154,7 +2154,7 @@ static void macb_configure_caps(struct macb *bp)
         if (bp->pdev->dev.of_node) {
                 match = of_match_node(macb_dt_ids, bp->pdev->dev.of_node);
                 if (match && match->data) {
-                        config = (const struct macb_config *)match->data;
+                        config = match->data;
 
                         bp->caps = config->caps;
                         /*
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 31dc080f2437..ff85619a9732 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -351,7 +351,7 @@
 
 /* Bitfields in MID */
 #define MACB_IDNUM_OFFSET                       16
-#define MACB_IDNUM_SIZE                         16
+#define MACB_IDNUM_SIZE                         12
 #define MACB_REV_OFFSET                         0
 #define MACB_REV_SIZE                           16
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
index 9062a8434246..c308429dd9c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c
@@ -35,10 +35,10 @@ static inline unsigned int ipv6_clip_hash(struct clip_tbl *d, const u32 *key)
 }
 
 static unsigned int clip_addr_hash(struct clip_tbl *ctbl, const u32 *addr,
-                                   int addr_len)
+                                   u8 v6)
 {
-        return addr_len == 4 ? ipv4_clip_hash(ctbl, addr) :
-                                ipv6_clip_hash(ctbl, addr);
+        return v6 ? ipv6_clip_hash(ctbl, addr) :
+                        ipv4_clip_hash(ctbl, addr);
 }
 
 static int clip6_get_mbox(const struct net_device *dev,
@@ -78,23 +78,22 @@ int cxgb4_clip_get(const struct net_device *dev, const u32 *lip, u8 v6)
         struct clip_entry *ce, *cte;
         u32 *addr = (u32 *)lip;
         int hash;
-        int addr_len;
-        int ret = 0;
+        int ret = -1;
 
         if (!ctbl)
                 return 0;
 
-        if (v6)
-                addr_len = 16;
-        else
-                addr_len = 4;
-
-        hash = clip_addr_hash(ctbl, addr, addr_len);
+        hash = clip_addr_hash(ctbl, addr, v6);
 
         read_lock_bh(&ctbl->lock);
         list_for_each_entry(cte, &ctbl->hash_list[hash], list) {
-                if (addr_len == cte->addr_len &&
-                    memcmp(lip, cte->addr, cte->addr_len) == 0) {
+                if (cte->addr6.sin6_family == AF_INET6 && v6)
+                        ret = memcmp(lip, cte->addr6.sin6_addr.s6_addr,
+                                     sizeof(struct in6_addr));
+                else if (cte->addr.sin_family == AF_INET && !v6)
+                        ret = memcmp(lip, (char *)(&cte->addr.sin_addr),
+                                     sizeof(struct in_addr));
+                if (!ret) {
                         ce = cte;
                         read_unlock_bh(&ctbl->lock);
                         goto found;
@@ -111,15 +110,20 @@ int cxgb4_clip_get(const struct net_device *dev, const u32 *lip, u8 v6)
                 spin_lock_init(&ce->lock);
                 atomic_set(&ce->refcnt, 0);
                 atomic_dec(&ctbl->nfree);
-                ce->addr_len = addr_len;
-                memcpy(ce->addr, lip, addr_len);
                 list_add_tail(&ce->list, &ctbl->hash_list[hash]);
                 if (v6) {
+                        ce->addr6.sin6_family = AF_INET6;
+                        memcpy(ce->addr6.sin6_addr.s6_addr,
+                               lip, sizeof(struct in6_addr));
                         ret = clip6_get_mbox(dev, (const struct in6_addr *)lip);
                         if (ret) {
                                 write_unlock_bh(&ctbl->lock);
                                 return ret;
                         }
+                } else {
+                        ce->addr.sin_family = AF_INET;
+                        memcpy((char *)(&ce->addr.sin_addr), lip,
+                               sizeof(struct in_addr));
                 }
         } else {
                 write_unlock_bh(&ctbl->lock);
@@ -140,19 +144,19 @@ void cxgb4_clip_release(const struct net_device *dev, const u32 *lip, u8 v6)
         struct clip_entry *ce, *cte;
         u32 *addr = (u32 *)lip;
         int hash;
-        int addr_len;
-
-        if (v6)
-                addr_len = 16;
-        else
-                addr_len = 4;
+        int ret = -1;
 
-        hash = clip_addr_hash(ctbl, addr, addr_len);
+        hash = clip_addr_hash(ctbl, addr, v6);
 
         read_lock_bh(&ctbl->lock);
         list_for_each_entry(cte, &ctbl->hash_list[hash], list) {
-                if (addr_len == cte->addr_len &&
-                    memcmp(lip, cte->addr, cte->addr_len) == 0) {
+                if (cte->addr6.sin6_family == AF_INET6 && v6)
+                        ret = memcmp(lip, cte->addr6.sin6_addr.s6_addr,
+                                     sizeof(struct in6_addr));
+                else if (cte->addr.sin_family == AF_INET && !v6)
+                        ret = memcmp(lip, (char *)(&cte->addr.sin_addr),
+                                     sizeof(struct in_addr));
+                if (!ret) {
                         ce = cte;
                         read_unlock_bh(&ctbl->lock);
                         goto found;
@@ -249,10 +253,7 @@ int clip_tbl_show(struct seq_file *seq, void *v)
         for (i = 0 ; i < ctbl->clipt_size;  ++i) {
                 list_for_each_entry(ce, &ctbl->hash_list[i], list) {
                         ip[0] = '\0';
-                        if (ce->addr_len == 16)
-                                sprintf(ip, "%pI6c", ce->addr);
-                        else
-                                sprintf(ip, "%pI4c", ce->addr);
+                        sprintf(ip, "%pISc", &ce->addr);
                         seq_printf(seq, "%-25s   %u\n", ip,
                                    atomic_read(&ce->refcnt));
                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
index 2eaba0161cf8..35eb43c6bcbb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/clip_tbl.h
@@ -14,8 +14,10 @@ struct clip_entry {
         spinlock_t lock;        /* Hold while modifying clip reference */
         atomic_t refcnt;
         struct list_head list;
-        u32 addr[4];
-        int addr_len;
+        union {
+                struct sockaddr_in addr;
+                struct sockaddr_in6 addr6;
+        };
 };
 
 struct clip_tbl {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index d6cda17efe6e..97842d03675b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1103,7 +1103,7 @@ int t4_restart_aneg(struct adapter *adap, unsigned int mbox, unsigned int port);
 #define T4_MEMORY_WRITE 0
 #define T4_MEMORY_READ  1
 int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr, u32 len,
-                 __be32 *buf, int dir);
+                 void *buf, int dir);
 static inline int t4_memory_write(struct adapter *adap, int mtype, u32 addr,
                                   u32 len, __be32 *buf)
 {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4d643b65265e..853c38997c82 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -449,7 +449,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
  *      @mtype: memory type: MEM_EDC0, MEM_EDC1 or MEM_MC
  *      @addr: address within indicated memory type
  *      @len: amount of memory to transfer
- *      @buf: host memory buffer
+ *      @hbuf: host memory buffer
  *      @dir: direction of transfer T4_MEMORY_READ (1) or T4_MEMORY_WRITE (0)
  *
  *      Reads/writes an [almost] arbitrary memory region in the firmware: the
@@ -460,15 +460,17 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
  *      caller's responsibility to perform appropriate byte order conversions.
  */
 int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
-                 u32 len, __be32 *buf, int dir)
+                 u32 len, void *hbuf, int dir)
 {
         u32 pos, offset, resid, memoffset;
         u32 edc_size, mc_size, win_pf, mem_reg, mem_aperture, mem_base;
+        u32 *buf;
 
         /* Argument sanity checks ...
          */
-        if (addr & 0x3)
+        if (addr & 0x3 || (uintptr_t)hbuf & 0x3)
                 return -EINVAL;
+        buf = (u32 *)hbuf;
 
         /* It's convenient to be able to handle lengths which aren't a
          * multiple of 32-bits because we often end up transferring files to
@@ -532,14 +534,45 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
 
         /* Transfer data to/from the adapter as long as there's an integral
          * number of 32-bit transfers to complete.
+         *
+         * A note on Endianness issues:
+         *
+         * The "register" reads and writes below from/to the PCI-E Memory
+         * Window invoke the standard adapter Big-Endian to PCI-E Link
+         * Little-Endian "swizzel."  As a result, if we have the following
+         * data in adapter memory:
+         *
+         *     Memory:  ... | b0 | b1 | b2 | b3 | ...
+         *     Address:      i+0  i+1  i+2  i+3
+         *
+         * Then a read of the adapter memory via the PCI-E Memory Window
+         * will yield:
+         *
+         *     x = readl(i)
+         *         31                  0
+         *         [ b3 | b2 | b1 | b0 ]
+         *
+         * If this value is stored into local memory on a Little-Endian system
+         * it will show up correctly in local memory as:
+         *
+         *     ( ..., b0, b1, b2, b3, ... )
+         *
+         * But on a Big-Endian system, the store will show up in memory
+         * incorrectly swizzled as:
+         *
+         *     ( ..., b3, b2, b1, b0, ... )
+         *
+         * So we need to account for this in the reads and writes to the
+         * PCI-E Memory Window below by undoing the register read/write
+         * swizzels.
          */
         while (len > 0) {
                 if (dir == T4_MEMORY_READ)
-                        *buf++ = (__force __be32) t4_read_reg(adap,
-                                                        mem_base + offset);
+                        *buf++ = le32_to_cpu((__force __le32)t4_read_reg(adap,
+                                                mem_base + offset));
                 else
                         t4_write_reg(adap, mem_base + offset,
-                                     (__force u32) *buf++);
+                                     (__force u32)cpu_to_le32(*buf++));
                 offset += sizeof(__be32);
                 len -= sizeof(__be32);
 
@@ -568,15 +601,16 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
          */
         if (resid) {
                 union {
-                        __be32 word;
+                        u32 word;
                         char byte[4];
                 } last;
                 unsigned char *bp;
                 int i;
 
                 if (dir == T4_MEMORY_READ) {
-                        last.word = (__force __be32) t4_read_reg(adap,
-                                                        mem_base + offset);
+                        last.word = le32_to_cpu(
+                                        (__force __le32)t4_read_reg(adap,
+                                                mem_base + offset));
                         for (bp = (unsigned char *)buf, i = resid; i < 4; i++)
                                 bp[i] = last.byte[i];
                 } else {
@@ -584,7 +618,7 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
                         for (i = resid; i < 4; i++)
                                 last.byte[i] = 0;
                         t4_write_reg(adap, mem_base + offset,
-                                     (__force u32) last.word);
+                                     (__force u32)cpu_to_le32(last.word));
                 }
         }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 9cbe038a388e..a5179bfcdc2c 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -272,8 +272,8 @@ static irqreturn_t enic_isr_legacy(int irq, void *data)
         }
 
         if (ENIC_TEST_INTR(pba, notify_intr)) {
-                vnic_intr_return_all_credits(&enic->intr[notify_intr]);
                 enic_notify_check(enic);
+                vnic_intr_return_all_credits(&enic->intr[notify_intr]);
         }
 
         if (ENIC_TEST_INTR(pba, err_intr)) {
@@ -346,8 +346,8 @@ static irqreturn_t enic_isr_msix_notify(int irq, void *data)
         struct enic *enic = data;
         unsigned int intr = enic_msix_notify_intr(enic);
 
-        vnic_intr_return_all_credits(&enic->intr[intr]);
         enic_notify_check(enic);
+        vnic_intr_return_all_credits(&enic->intr[intr]);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 9bb6220663b2..99492b7e3713 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1597,7 +1597,7 @@ fec_enet_interrupt(int irq, void *dev_id)
         writel(int_events, fep->hwp + FEC_IEVENT);
         fec_enet_collect_events(fep, int_events);
 
-        if (fep->work_tx || fep->work_rx) {
+        if ((fep->work_tx || fep->work_rx) && fep->link) {
                 ret = IRQ_HANDLED;
 
                 if (napi_schedule_prep(&fep->napi)) {
@@ -3383,7 +3383,6 @@ fec_drv_remove(struct platform_device *pdev)
                 regulator_disable(fep->reg_phy);
         if (fep->ptp_clock)
                 ptp_clock_unregister(fep->ptp_clock);
-        fec_enet_clk_enable(ndev, false);
         of_node_put(fep->phy_node);
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 43df78882e48..7bf3682cdf47 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -747,6 +747,18 @@ static int gfar_parse_group(struct device_node *np,
         return 0;
 }
 
+static int gfar_of_group_count(struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+
+        for_each_available_child_of_node(np, child)
+                if (!of_node_cmp(child->name, "queue-group"))
+                        num++;
+
+        return num;
+}
+
 static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 {
         const char *model;
@@ -784,7 +796,7 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
                 num_rx_qs = 1;
         } else { /* MQ_MG_MODE */
                 /* get the actual number of supported groups */
-                unsigned int num_grps = of_get_available_child_count(np);
+                unsigned int num_grps = gfar_of_group_count(np);
 
                 if (num_grps == 0 || num_grps > MAXGROUPS) {
                         dev_err(&ofdev->dev, "Invalid # of int groups(%d)\n",
@@ -851,7 +863,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 
         /* Parse and initialize group specific information */
         if (priv->mode == MQ_MG_MODE) {
-                for_each_child_of_node(np, child) {
+                for_each_available_child_of_node(np, child) {
+                        if (of_node_cmp(child->name, "queue-group"))
+                                continue;
+
                         err = gfar_parse_group(child, priv, model);
                         if (err)
                                 goto err_grp_init;
@@ -3162,8 +3177,8 @@ static void adjust_link(struct net_device *dev)
         struct phy_device *phydev = priv->phydev;
 
         if (unlikely(phydev->link != priv->oldlink ||
-                     phydev->duplex != priv->oldduplex ||
-                     phydev->speed != priv->oldspeed))
+                     (phydev->link && (phydev->duplex != priv->oldduplex ||
+                                       phydev->speed != priv->oldspeed))))
                 gfar_update_link_state(priv);
 }
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index e8a1adb7a962..c05e50759621 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3262,6 +3262,139 @@ static void ehea_remove_device_sysfs(struct platform_device *dev)
         device_remove_file(&dev->dev, &dev_attr_remove_port);
 }
 
+static int ehea_reboot_notifier(struct notifier_block *nb,
+                                unsigned long action, void *unused)
+{
+        if (action == SYS_RESTART) {
+                pr_info("Reboot: freeing all eHEA resources\n");
+                ibmebus_unregister_driver(&ehea_driver);
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block ehea_reboot_nb = {
+        .notifier_call = ehea_reboot_notifier,
+};
+
+static int ehea_mem_notifier(struct notifier_block *nb,
+                             unsigned long action, void *data)
+{
+        int ret = NOTIFY_BAD;
+        struct memory_notify *arg = data;
+
+        mutex_lock(&dlpar_mem_lock);
+
+        switch (action) {
+        case MEM_CANCEL_OFFLINE:
+                pr_info("memory offlining canceled");
+                /* Fall through: re-add canceled memory block */
+
+        case MEM_ONLINE:
+                pr_info("memory is going online");
+                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
+                if (ehea_add_sect_bmap(arg->start_pfn, arg->nr_pages))
+                        goto out_unlock;
+                ehea_rereg_mrs();
+                break;
+
+        case MEM_GOING_OFFLINE:
+                pr_info("memory is going offline");
+                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
+                if (ehea_rem_sect_bmap(arg->start_pfn, arg->nr_pages))
+                        goto out_unlock;
+                ehea_rereg_mrs();
+                break;
+
+        default:
+                break;
+        }
+
+        ehea_update_firmware_handles();
+        ret = NOTIFY_OK;
+
+out_unlock:
+        mutex_unlock(&dlpar_mem_lock);
+        return ret;
+}
+
+static struct notifier_block ehea_mem_nb = {
+        .notifier_call = ehea_mem_notifier,
+};
+
+static void ehea_crash_handler(void)
+{
+        int i;
+
+        if (ehea_fw_handles.arr)
+                for (i = 0; i < ehea_fw_handles.num_entries; i++)
+                        ehea_h_free_resource(ehea_fw_handles.arr[i].adh,
+                                             ehea_fw_handles.arr[i].fwh,
+                                             FORCE_FREE);
+
+        if (ehea_bcmc_regs.arr)
+                for (i = 0; i < ehea_bcmc_regs.num_entries; i++)
+                        ehea_h_reg_dereg_bcmc(ehea_bcmc_regs.arr[i].adh,
+                                              ehea_bcmc_regs.arr[i].port_id,
+                                              ehea_bcmc_regs.arr[i].reg_type,
+                                              ehea_bcmc_regs.arr[i].macaddr,
+                                              0, H_DEREG_BCMC);
+}
+
+static atomic_t ehea_memory_hooks_registered;
+
+/* Register memory hooks on probe of first adapter */
+static int ehea_register_memory_hooks(void)
+{
+        int ret = 0;
+
+        if (atomic_inc_and_test(&ehea_memory_hooks_registered))
+                return 0;
+
+        ret = ehea_create_busmap();
+        if (ret) {
+                pr_info("ehea_create_busmap failed\n");
+                goto out;
+        }
+
+        ret = register_reboot_notifier(&ehea_reboot_nb);
+        if (ret) {
+                pr_info("register_reboot_notifier failed\n");
+                goto out;
+        }
+
+        ret = register_memory_notifier(&ehea_mem_nb);
+        if (ret) {
+                pr_info("register_memory_notifier failed\n");
+                goto out2;
+        }
+
+        ret = crash_shutdown_register(ehea_crash_handler);
+        if (ret) {
+                pr_info("crash_shutdown_register failed\n");
+                goto out3;
+        }
+
+        return 0;
+
+out3:
+        unregister_memory_notifier(&ehea_mem_nb);
+out2:
+        unregister_reboot_notifier(&ehea_reboot_nb);
+out:
+        return ret;
+}
+
+static void ehea_unregister_memory_hooks(void)
+{
+        if (atomic_read(&ehea_memory_hooks_registered))
+                return;
+
+        unregister_reboot_notifier(&ehea_reboot_nb);
+        if (crash_shutdown_unregister(ehea_crash_handler))
+                pr_info("failed unregistering crash handler\n");
+        unregister_memory_notifier(&ehea_mem_nb);
+}
+
 static int ehea_probe_adapter(struct platform_device *dev)
 {
         struct ehea_adapter *adapter;
@@ -3269,6 +3402,10 @@ static int ehea_probe_adapter(struct platform_device *dev)
         int ret;
         int i;
 
+        ret = ehea_register_memory_hooks();
+        if (ret)
+                return ret;
+
         if (!dev || !dev->dev.of_node) {
                 pr_err("Invalid ibmebus device probed\n");
                 return -EINVAL;
@@ -3392,81 +3529,6 @@ static int ehea_remove(struct platform_device *dev)
         return 0;
 }
 
-static void ehea_crash_handler(void)
-{
-        int i;
-
-        if (ehea_fw_handles.arr)
-                for (i = 0; i < ehea_fw_handles.num_entries; i++)
-                        ehea_h_free_resource(ehea_fw_handles.arr[i].adh,
-                                             ehea_fw_handles.arr[i].fwh,
-                                             FORCE_FREE);
-
-        if (ehea_bcmc_regs.arr)
-                for (i = 0; i < ehea_bcmc_regs.num_entries; i++)
-                        ehea_h_reg_dereg_bcmc(ehea_bcmc_regs.arr[i].adh,
-                                              ehea_bcmc_regs.arr[i].port_id,
-                                              ehea_bcmc_regs.arr[i].reg_type,
-                                              ehea_bcmc_regs.arr[i].macaddr,
-                                              0, H_DEREG_BCMC);
-}
-
-static int ehea_mem_notifier(struct notifier_block *nb,
-                             unsigned long action, void *data)
-{
-        int ret = NOTIFY_BAD;
-        struct memory_notify *arg = data;
-
-        mutex_lock(&dlpar_mem_lock);
-
-        switch (action) {
-        case MEM_CANCEL_OFFLINE:
-                pr_info("memory offlining canceled");
-                /* Readd canceled memory block */
-        case MEM_ONLINE:
-                pr_info("memory is going online");
-                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
-                if (ehea_add_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        goto out_unlock;
-                ehea_rereg_mrs();
-                break;
-        case MEM_GOING_OFFLINE:
-                pr_info("memory is going offline");
-                set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
-                if (ehea_rem_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        goto out_unlock;
-                ehea_rereg_mrs();
-                break;
-        default:
-                break;
-        }
-
-        ehea_update_firmware_handles();
-        ret = NOTIFY_OK;
-
-out_unlock:
-        mutex_unlock(&dlpar_mem_lock);
-        return ret;
-}
-
-static struct notifier_block ehea_mem_nb = {
-        .notifier_call = ehea_mem_notifier,
-};
-
-static int ehea_reboot_notifier(struct notifier_block *nb,
-                                unsigned long action, void *unused)
-{
-        if (action == SYS_RESTART) {
-                pr_info("Reboot: freeing all eHEA resources\n");
-                ibmebus_unregister_driver(&ehea_driver);
-        }
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block ehea_reboot_nb = {
-        .notifier_call = ehea_reboot_notifier,
-};
-
 static int check_module_parm(void)
 {
         int ret = 0;
@@ -3520,26 +3582,10 @@ static int __init ehea_module_init(void)
         if (ret)
                 goto out;
 
-        ret = ehea_create_busmap();
-        if (ret)
-                goto out;
-
-        ret = register_reboot_notifier(&ehea_reboot_nb);
-        if (ret)
-                pr_info("failed registering reboot notifier\n");
-
-        ret = register_memory_notifier(&ehea_mem_nb);
-        if (ret)
-                pr_info("failed registering memory remove notifier\n");
-
-        ret = crash_shutdown_register(ehea_crash_handler);
-        if (ret)
-                pr_info("failed registering crash handler\n");
-
         ret = ibmebus_register_driver(&ehea_driver);
         if (ret) {
                 pr_err("failed registering eHEA device driver on ebus\n");
-                goto out2;
+                goto out;
         }
 
         ret = driver_create_file(&ehea_driver.driver,
@@ -3547,32 +3593,22 @@ static int __init ehea_module_init(void)
         if (ret) {
                 pr_err("failed to register capabilities attribute, ret=%d\n",
                        ret);
-                goto out3;
+                goto out2;
         }
 
         return ret;
 
-out3:
-        ibmebus_unregister_driver(&ehea_driver);
 out2:
-        unregister_memory_notifier(&ehea_mem_nb);
-        unregister_reboot_notifier(&ehea_reboot_nb);
-        crash_shutdown_unregister(ehea_crash_handler);
+        ibmebus_unregister_driver(&ehea_driver);
 out:
         return ret;
 }
 
 static void __exit ehea_module_exit(void)
 {
-        int ret;
-
         driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
         ibmebus_unregister_driver(&ehea_driver);
-        unregister_reboot_notifier(&ehea_reboot_nb);
-        ret = crash_shutdown_unregister(ehea_crash_handler);
-        if (ret)
-                pr_info("failed unregistering crash handler\n");
-        unregister_memory_notifier(&ehea_mem_nb);
+        ehea_unregister_memory_hooks();
         kfree(ehea_fw_handles.arr);
         kfree(ehea_bcmc_regs.arr);
         ehea_destroy_busmap();
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 21978cc019e7..072426a72745 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1327,6 +1327,28 @@ static unsigned long ibmveth_get_desired_dma(struct vio_dev *vdev)
         return ret;
 }
 
+static int ibmveth_set_mac_addr(struct net_device *dev, void *p)
+{
+        struct ibmveth_adapter *adapter = netdev_priv(dev);
+        struct sockaddr *addr = p;
+        u64 mac_address;
+        int rc;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        mac_address = ibmveth_encode_mac_addr(addr->sa_data);
+        rc = h_change_logical_lan_mac(adapter->vdev->unit_address, mac_address);
+        if (rc) {
+                netdev_err(adapter->netdev, "h_change_logical_lan_mac failed with rc=%d\n", rc);
+                return rc;
+        }
+
+        ether_addr_copy(dev->dev_addr, addr->sa_data);
+
+        return 0;
+}
+
 static const struct net_device_ops ibmveth_netdev_ops = {
         .ndo_open               = ibmveth_open,
         .ndo_stop               = ibmveth_close,
@@ -1337,7 +1359,7 @@ static const struct net_device_ops ibmveth_netdev_ops = {
         .ndo_fix_features       = ibmveth_fix_features,
         .ndo_set_features       = ibmveth_set_features,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ibmveth_set_mac_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ibmveth_poll_controller,
 #endif
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index 11a9ffebf8d8..6aea65dae5ed 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -868,8 +868,9 @@ i40e_status i40e_pf_reset(struct i40e_hw *hw)
          * The grst delay value is in 100ms units, and we'll wait a
          * couple counts longer to be sure we don't just miss the end.
          */
-        grst_del = rd32(hw, I40E_GLGEN_RSTCTL) & I40E_GLGEN_RSTCTL_GRSTDEL_MASK
-                        >> I40E_GLGEN_RSTCTL_GRSTDEL_SHIFT;
+        grst_del = (rd32(hw, I40E_GLGEN_RSTCTL) &
+                    I40E_GLGEN_RSTCTL_GRSTDEL_MASK) >>
+                    I40E_GLGEN_RSTCTL_GRSTDEL_SHIFT;
         for (cnt = 0; cnt < grst_del + 2; cnt++) {
                 reg = rd32(hw, I40E_GLGEN_RSTAT);
                 if (!(reg & I40E_GLGEN_RSTAT_DEVSTATE_MASK))
@@ -2846,7 +2847,7 @@ i40e_status i40e_aq_add_udp_tunnel(struct i40e_hw *hw,
 
         status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
 
-        if (!status)
+        if (!status && filter_index)
                 *filter_index = resp->index;
 
         return status;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
index 183dcb63ce98..a11c70ca5a28 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
@@ -40,7 +40,7 @@ static void i40e_get_pfc_delay(struct i40e_hw *hw, u16 *delay)
         u32 val;
 
         val = rd32(hw, I40E_PRTDCB_GENC);
-        *delay = (u16)(val & I40E_PRTDCB_GENC_PFCLDA_MASK >>
+        *delay = (u16)((val & I40E_PRTDCB_GENC_PFCLDA_MASK) >>
                        I40E_PRTDCB_GENC_PFCLDA_SHIFT);
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 61236f983971..c17ee77100d3 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -989,8 +989,10 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
         if (!cmd_buf)
                 return count;
         bytes_not_copied = copy_from_user(cmd_buf, buffer, count);
-        if (bytes_not_copied < 0)
+        if (bytes_not_copied < 0) {
+                kfree(cmd_buf);
                 return bytes_not_copied;
+        }
         if (bytes_not_copied > 0)
                 count -= bytes_not_copied;
         cmd_buf[count] = '\0';
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index cbe281be1c9f..dadda3c5d658 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1512,7 +1512,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
         vsi->tc_config.numtc = numtc;
         vsi->tc_config.enabled_tc = enabled_tc ? enabled_tc : 1;
         /* Number of queues per enabled TC */
-        num_tc_qps = vsi->alloc_queue_pairs/numtc;
+        /* In MFP case we can have a much lower count of MSIx
+         * vectors available and so we need to lower the used
+         * q count.
+         */
+        qcount = min_t(int, vsi->alloc_queue_pairs, pf->num_lan_msix);
+        num_tc_qps = qcount / numtc;
         num_tc_qps = min_t(int, num_tc_qps, I40E_MAX_QUEUES_PER_TC);
 
         /* Setup queue offset/count for all TCs for given VSI */
@@ -2684,8 +2689,15 @@ static void i40e_vsi_config_dcb_rings(struct i40e_vsi *vsi)
         u16 qoffset, qcount;
         int i, n;
 
-        if (!(vsi->back->flags & I40E_FLAG_DCB_ENABLED))
-                return;
+        if (!(vsi->back->flags & I40E_FLAG_DCB_ENABLED)) {
+                /* Reset the TC information */
+                for (i = 0; i < vsi->num_queue_pairs; i++) {
+                        rx_ring = vsi->rx_rings[i];
+                        tx_ring = vsi->tx_rings[i];
+                        rx_ring->dcb_tc = 0;
+                        tx_ring->dcb_tc = 0;
+                }
+        }
 
         for (n = 0; n < I40E_MAX_TRAFFIC_CLASS; n++) {
                 if (!(vsi->tc_config.enabled_tc & (1 << n)))
@@ -3830,6 +3842,12 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf)
 {
         int i;
 
+        i40e_stop_misc_vector(pf);
+        if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
+                synchronize_irq(pf->msix_entries[0].vector);
+                free_irq(pf->msix_entries[0].vector, pf);
+        }
+
         i40e_put_lump(pf->irq_pile, 0, I40E_PILE_VALID_BIT-1);
         for (i = 0; i < pf->num_alloc_vsi; i++)
                 if (pf->vsi[i])
@@ -5254,8 +5272,14 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
 
         /* Wait for the PF's Tx queues to be disabled */
         ret = i40e_pf_wait_txq_disabled(pf);
-        if (!ret)
+        if (ret) {
+                /* Schedule PF reset to recover */
+                set_bit(__I40E_PF_RESET_REQUESTED, &pf->state);
+                i40e_service_event_schedule(pf);
+        } else {
                 i40e_pf_unquiesce_all_vsi(pf);
+        }
+
 exit:
         return ret;
 }
@@ -5587,7 +5611,8 @@ static void i40e_check_hang_subtask(struct i40e_pf *pf)
         int i, v;
 
         /* If we're down or resetting, just bail */
-        if (test_bit(__I40E_CONFIG_BUSY, &pf->state))
+        if (test_bit(__I40E_DOWN, &pf->state) ||
+            test_bit(__I40E_CONFIG_BUSY, &pf->state))
                 return;
 
         /* for each VSI/netdev
@@ -9533,6 +9558,7 @@ static void i40e_remove(struct pci_dev *pdev)
         set_bit(__I40E_DOWN, &pf->state);
         del_timer_sync(&pf->service_timer);
         cancel_work_sync(&pf->service_task);
+        i40e_fdir_teardown(pf);
 
         if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
                 i40e_free_vfs(pf);
@@ -9559,12 +9585,6 @@ static void i40e_remove(struct pci_dev *pdev)
         if (pf->vsi[pf->lan_vsi])
                 i40e_vsi_release(pf->vsi[pf->lan_vsi]);
 
-        i40e_stop_misc_vector(pf);
-        if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
-                synchronize_irq(pf->msix_entries[0].vector);
-                free_irq(pf->msix_entries[0].vector, pf);
-        }
-
         /* shutdown and destroy the HMC */
         if (pf->hw.hmc.hmc_obj) {
                 ret_code = i40e_shutdown_lan_hmc(&pf->hw);
@@ -9718,6 +9738,8 @@ static void i40e_shutdown(struct pci_dev *pdev)
         wr32(hw, I40E_PFPM_APM, (pf->wol_en ? I40E_PFPM_APM_APME_MASK : 0));
         wr32(hw, I40E_PFPM_WUFC, (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
 
+        i40e_clear_interrupt_scheme(pf);
+
         if (system_state == SYSTEM_POWER_OFF) {
                 pci_wake_from_d3(pdev, pf->wol_en);
                 pci_set_power_state(pdev, PCI_D3hot);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 3e70f2e45a47..5defe0d63514 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -679,9 +679,11 @@ static i40e_status i40e_nvmupd_state_writing(struct i40e_hw *hw,
 {
         i40e_status status;
         enum i40e_nvmupd_cmd upd_cmd;
+        bool retry_attempt = false;
 
         upd_cmd = i40e_nvmupd_validate_command(hw, cmd, errno);
 
+retry:
         switch (upd_cmd) {
         case I40E_NVMUPD_WRITE_CON:
                 status = i40e_nvmupd_nvm_write(hw, cmd, bytes, errno);
@@ -725,6 +727,39 @@ static i40e_status i40e_nvmupd_state_writing(struct i40e_hw *hw,
                 *errno = -ESRCH;
                 break;
         }
+
+        /* In some circumstances, a multi-write transaction takes longer
+         * than the default 3 minute timeout on the write semaphore.  If
+         * the write failed with an EBUSY status, this is likely the problem,
+         * so here we try to reacquire the semaphore then retry the write.
+         * We only do one retry, then give up.
+         */
+        if (status && (hw->aq.asq_last_status == I40E_AQ_RC_EBUSY) &&
+            !retry_attempt) {
+                i40e_status old_status = status;
+                u32 old_asq_status = hw->aq.asq_last_status;
+                u32 gtime;
+
+                gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+                if (gtime >= hw->nvm.hw_semaphore_timeout) {
+                        i40e_debug(hw, I40E_DEBUG_ALL,
+                                   "NVMUPD: write semaphore expired (%d >= %lld), retrying\n",
+                                   gtime, hw->nvm.hw_semaphore_timeout);
+                        i40e_release_nvm(hw);
+                        status = i40e_acquire_nvm(hw, I40E_RESOURCE_WRITE);
+                        if (status) {
+                                i40e_debug(hw, I40E_DEBUG_ALL,
+                                           "NVMUPD: write semaphore reacquire failed aq_err = %d\n",
+                                           hw->aq.asq_last_status);
+                                status = old_status;
+                                hw->aq.asq_last_status = old_asq_status;
+                        } else {
+                                retry_attempt = true;
+                                goto retry;
+                        }
+                }
+        }
+
         return status;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 2206d2d36f0f..bbf1b1247ac4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -586,6 +586,20 @@ void i40e_free_tx_resources(struct i40e_ring *tx_ring)
 }
 
 /**
+ * i40e_get_head - Retrieve head from head writeback
+ * @tx_ring:  tx ring to fetch head of
+ *
+ * Returns value of Tx ring head based on value stored
+ * in head write-back location
+ **/
+static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
+{
+        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
+
+        return le32_to_cpu(*(volatile __le32 *)head);
+}
+
+/**
  * i40e_get_tx_pending - how many tx descriptors not processed
  * @tx_ring: the ring of descriptors
  *
@@ -594,10 +608,16 @@ void i40e_free_tx_resources(struct i40e_ring *tx_ring)
  **/
 static u32 i40e_get_tx_pending(struct i40e_ring *ring)
 {
-        u32 ntu = ((ring->next_to_clean <= ring->next_to_use)
-                        ? ring->next_to_use
-                        : ring->next_to_use + ring->count);
-        return ntu - ring->next_to_clean;
+        u32 head, tail;
+
+        head = i40e_get_head(ring);
+        tail = readl(ring->tail);
+
+        if (head != tail)
+                return (head < tail) ?
+                        tail - head : (tail + ring->count - head);
+
+        return 0;
 }
 
 /**
@@ -606,6 +626,8 @@ static u32 i40e_get_tx_pending(struct i40e_ring *ring)
  **/
 static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
 {
+        u32 tx_done = tx_ring->stats.packets;
+        u32 tx_done_old = tx_ring->tx_stats.tx_done_old;
         u32 tx_pending = i40e_get_tx_pending(tx_ring);
         struct i40e_pf *pf = tx_ring->vsi->back;
         bool ret = false;
@@ -623,41 +645,25 @@ static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
          * run the check_tx_hang logic with a transmit completion
          * pending but without time to complete it yet.
          */
-        if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-            (tx_pending >= I40E_MIN_DESC_PENDING)) {
+        if ((tx_done_old == tx_done) && tx_pending) {
                 /* make sure it is true for two checks in a row */
                 ret = test_and_set_bit(__I40E_HANG_CHECK_ARMED,
                                        &tx_ring->state);
-        } else if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-                   (tx_pending < I40E_MIN_DESC_PENDING) &&
-                   (tx_pending > 0)) {
+        } else if (tx_done_old == tx_done &&
+                   (tx_pending < I40E_MIN_DESC_PENDING) && (tx_pending > 0)) {
                 if (I40E_DEBUG_FLOW & pf->hw.debug_mask)
                         dev_info(tx_ring->dev, "HW needs some more descs to do a cacheline flush. tx_pending %d, queue %d",
                                  tx_pending, tx_ring->queue_index);
                 pf->tx_sluggish_count++;
         } else {
                 /* update completed stats and disarm the hang check */
-                tx_ring->tx_stats.tx_done_old = tx_ring->stats.packets;
+                tx_ring->tx_stats.tx_done_old = tx_done;
                 clear_bit(__I40E_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
         return ret;
 }
 
-/**
- * i40e_get_head - Retrieve head from head writeback
- * @tx_ring:  tx ring to fetch head of
- *
- * Returns value of Tx ring head based on value stored
- * in head write-back location
- **/
-static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
-{
-        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
-
-        return le32_to_cpu(*(volatile __le32 *)head);
-}
-
 #define WB_STRIDE 0x3
 
 /**
@@ -2140,6 +2146,67 @@ static int i40e_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
 }
 
 /**
+ * i40e_chk_linearize - Check if there are more than 8 fragments per packet
+ * @skb:      send buffer
+ * @tx_flags: collected send information
+ * @hdr_len:  size of the packet header
+ *
+ * Note: Our HW can't scatter-gather more than 8 fragments to build
+ * a packet on the wire and so we need to figure out the cases where we
+ * need to linearize the skb.
+ **/
+static bool i40e_chk_linearize(struct sk_buff *skb, u32 tx_flags,
+                               const u8 hdr_len)
+{
+        struct skb_frag_struct *frag;
+        bool linearize = false;
+        unsigned int size = 0;
+        u16 num_frags;
+        u16 gso_segs;
+
+        num_frags = skb_shinfo(skb)->nr_frags;
+        gso_segs = skb_shinfo(skb)->gso_segs;
+
+        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) {
+                u16 j = 1;
+
+                if (num_frags < (I40E_MAX_BUFFER_TXD))
+                        goto linearize_chk_done;
+                /* try the simple math, if we have too many frags per segment */
+                if (DIV_ROUND_UP((num_frags + gso_segs), gso_segs) >
+                    I40E_MAX_BUFFER_TXD) {
+                        linearize = true;
+                        goto linearize_chk_done;
+                }
+                frag = &skb_shinfo(skb)->frags[0];
+                size = hdr_len;
+                /* we might still have more fragments per segment */
+                do {
+                        size += skb_frag_size(frag);
+                        frag++; j++;
+                        if (j == I40E_MAX_BUFFER_TXD) {
+                                if (size < skb_shinfo(skb)->gso_size) {
+                                        linearize = true;
+                                        break;
+                                }
+                                j = 1;
+                                size -= skb_shinfo(skb)->gso_size;
+                                if (size)
+                                        j++;
+                                size += hdr_len;
+                        }
+                        num_frags--;
+                } while (num_frags);
+        } else {
+                if (num_frags >= I40E_MAX_BUFFER_TXD)
+                        linearize = true;
+        }
+
+linearize_chk_done:
+        return linearize;
+}
+
+/**
  * i40e_tx_map - Build the Tx descriptor
  * @tx_ring:  ring to send buffer on
  * @skb:      send buffer
@@ -2396,6 +2463,10 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
         if (tsyn)
                 tx_flags |= I40E_TX_FLAGS_TSYN;
 
+        if (i40e_chk_linearize(skb, tx_flags, hdr_len))
+                if (skb_linearize(skb))
+                        goto out_drop;
+
         skb_tx_timestamp(skb);
 
         /* always enable CRC insertion offload */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index 18b00231d2f1..dff0baeb1ecc 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -112,6 +112,7 @@ enum i40e_dyn_idx_t {
 
 #define i40e_rx_desc i40e_32byte_rx_desc
 
+#define I40E_MAX_BUFFER_TXD     8
 #define I40E_MIN_TX_LEN         17
 #define I40E_MAX_DATA_PER_TXD   8192
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 29004382f462..708891571dae 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -126,6 +126,20 @@ void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
 }
 
 /**
+ * i40e_get_head - Retrieve head from head writeback
+ * @tx_ring:  tx ring to fetch head of
+ *
+ * Returns value of Tx ring head based on value stored
+ * in head write-back location
+ **/
+static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
+{
+        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
+
+        return le32_to_cpu(*(volatile __le32 *)head);
+}
+
+/**
  * i40e_get_tx_pending - how many tx descriptors not processed
  * @tx_ring: the ring of descriptors
  *
@@ -134,10 +148,16 @@ void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
  **/
 static u32 i40e_get_tx_pending(struct i40e_ring *ring)
 {
-        u32 ntu = ((ring->next_to_clean <= ring->next_to_use)
-                        ? ring->next_to_use
-                        : ring->next_to_use + ring->count);
-        return ntu - ring->next_to_clean;
+        u32 head, tail;
+
+        head = i40e_get_head(ring);
+        tail = readl(ring->tail);
+
+        if (head != tail)
+                return (head < tail) ?
+                        tail - head : (tail + ring->count - head);
+
+        return 0;
 }
 
 /**
@@ -146,6 +166,8 @@ static u32 i40e_get_tx_pending(struct i40e_ring *ring)
  **/
 static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
 {
+        u32 tx_done = tx_ring->stats.packets;
+        u32 tx_done_old = tx_ring->tx_stats.tx_done_old;
         u32 tx_pending = i40e_get_tx_pending(tx_ring);
         bool ret = false;
 
@@ -162,36 +184,20 @@ static bool i40e_check_tx_hang(struct i40e_ring *tx_ring)
          * run the check_tx_hang logic with a transmit completion
          * pending but without time to complete it yet.
          */
-        if ((tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) &&
-            (tx_pending >= I40E_MIN_DESC_PENDING)) {
+        if ((tx_done_old == tx_done) && tx_pending) {
                 /* make sure it is true for two checks in a row */
                 ret = test_and_set_bit(__I40E_HANG_CHECK_ARMED,
                                        &tx_ring->state);
-        } else if (!(tx_ring->tx_stats.tx_done_old == tx_ring->stats.packets) ||
-                   !(tx_pending < I40E_MIN_DESC_PENDING) ||
-                   !(tx_pending > 0)) {
+        } else if (tx_done_old == tx_done &&
+                   (tx_pending < I40E_MIN_DESC_PENDING) && (tx_pending > 0)) {
                 /* update completed stats and disarm the hang check */
-                tx_ring->tx_stats.tx_done_old = tx_ring->stats.packets;
+                tx_ring->tx_stats.tx_done_old = tx_done;
                 clear_bit(__I40E_HANG_CHECK_ARMED, &tx_ring->state);
         }
 
         return ret;
 }
 
-/**
- * i40e_get_head - Retrieve head from head writeback
- * @tx_ring:  tx ring to fetch head of
- *
- * Returns value of Tx ring head based on value stored
- * in head write-back location
- **/
-static inline u32 i40e_get_head(struct i40e_ring *tx_ring)
-{
-        void *head = (struct i40e_tx_desc *)tx_ring->desc + tx_ring->count;
-
-        return le32_to_cpu(*(volatile __le32 *)head);
-}
-
 #define WB_STRIDE 0x3
 
 /**
@@ -1206,17 +1212,16 @@ static int i40e_tso(struct i40e_ring *tx_ring, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        if (protocol == htons(ETH_P_IP)) {
-                iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        iph = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
+
+        if (iph->version == 4) {
                 tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                 iph->tot_len = 0;
                 iph->check = 0;
                 tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
                                                  0, IPPROTO_TCP, 0);
-        } else if (skb_is_gso_v6(skb)) {
-
-                ipv6h = skb->encapsulation ? inner_ipv6_hdr(skb)
-                                           : ipv6_hdr(skb);
+        } else if (ipv6h->version == 6) {
                 tcph = skb->encapsulation ? inner_tcp_hdr(skb) : tcp_hdr(skb);
                 ipv6h->payload_len = 0;
                 tcph->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
@@ -1274,13 +1279,9 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                          I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
                         }
                 } else if (tx_flags & I40E_TX_FLAGS_IPV6) {
-                        if (tx_flags & I40E_TX_FLAGS_TSO) {
-                                *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
+                        *cd_tunneling |= I40E_TX_CTX_EXT_IP_IPV6;
+                        if (tx_flags & I40E_TX_FLAGS_TSO)
                                 ip_hdr(skb)->check = 0;
-                        } else {
-                                *cd_tunneling |=
-                                         I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
-                        }
                 }
 
                 /* Now set the ctx descriptor fields */
@@ -1290,6 +1291,11 @@ static void i40e_tx_enable_csum(struct sk_buff *skb, u32 tx_flags,
                                    ((skb_inner_network_offset(skb) -
                                         skb_transport_offset(skb)) >> 1) <<
                                    I40E_TXD_CTX_QW0_NATLEN_SHIFT;
+                if (this_ip_hdr->version == 6) {
+                        tx_flags &= ~I40E_TX_FLAGS_IPV4;
+                        tx_flags |= I40E_TX_FLAGS_IPV6;
+                }
+
 
         } else {
                 network_hdr_len = skb_network_header_len(skb);
@@ -1380,6 +1386,67 @@ static void i40e_create_tx_ctx(struct i40e_ring *tx_ring,
         context_desc->type_cmd_tso_mss = cpu_to_le64(cd_type_cmd_tso_mss);
 }
 
+ /**
+ * i40e_chk_linearize - Check if there are more than 8 fragments per packet
+ * @skb:      send buffer
+ * @tx_flags: collected send information
+ * @hdr_len:  size of the packet header
+ *
+ * Note: Our HW can't scatter-gather more than 8 fragments to build
+ * a packet on the wire and so we need to figure out the cases where we
+ * need to linearize the skb.
+ **/
+static bool i40e_chk_linearize(struct sk_buff *skb, u32 tx_flags,
+                               const u8 hdr_len)
+{
+        struct skb_frag_struct *frag;
+        bool linearize = false;
+        unsigned int size = 0;
+        u16 num_frags;
+        u16 gso_segs;
+
+        num_frags = skb_shinfo(skb)->nr_frags;
+        gso_segs = skb_shinfo(skb)->gso_segs;
+
+        if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) {
+                u16 j = 1;
+
+                if (num_frags < (I40E_MAX_BUFFER_TXD))
+                        goto linearize_chk_done;
+                /* try the simple math, if we have too many frags per segment */
+                if (DIV_ROUND_UP((num_frags + gso_segs), gso_segs) >
+                    I40E_MAX_BUFFER_TXD) {
+                        linearize = true;
+                        goto linearize_chk_done;
+                }
+                frag = &skb_shinfo(skb)->frags[0];
+                size = hdr_len;
+                /* we might still have more fragments per segment */
+                do {
+                        size += skb_frag_size(frag);
+                        frag++; j++;
+                        if (j == I40E_MAX_BUFFER_TXD) {
+                                if (size < skb_shinfo(skb)->gso_size) {
+                                        linearize = true;
+                                        break;
+                                }
+                                j = 1;
+                                size -= skb_shinfo(skb)->gso_size;
+                                if (size)
+                                        j++;
+                                size += hdr_len;
+                        }
+                        num_frags--;
+                } while (num_frags);
+        } else {
+                if (num_frags >= I40E_MAX_BUFFER_TXD)
+                        linearize = true;
+        }
+
+linearize_chk_done:
+        return linearize;
+}
+
 /**
  * i40e_tx_map - Build the Tx descriptor
  * @tx_ring:  ring to send buffer on
@@ -1654,6 +1721,10 @@ static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
         else if (tso)
                 tx_flags |= I40E_TX_FLAGS_TSO;
 
+        if (i40e_chk_linearize(skb, tx_flags, hdr_len))
+                if (skb_linearize(skb))
+                        goto out_drop;
+
         skb_tx_timestamp(skb);
 
         /* always enable CRC insertion offload */
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
index 4e15903b2b6d..c950a038237c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
@@ -112,6 +112,7 @@ enum i40e_dyn_idx_t {
 
 #define i40e_rx_desc i40e_32byte_rx_desc
 
+#define I40E_MAX_BUFFER_TXD     8
 #define I40E_MIN_TX_LEN         17
 #define I40E_MAX_DATA_PER_TXD   8192
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 2d8ee66138e8..a61009f4b2df 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -81,12 +81,14 @@ static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
 {
         u32 loopback_ok = 0;
         int i;
-
+        bool gro_enabled;
 
         priv->loopback_ok = 0;
         priv->validate_loopback = 1;
+        gro_enabled = priv->dev->features & NETIF_F_GRO;
 
         mlx4_en_update_loopback_state(priv->dev, priv->dev->features);
+        priv->dev->features &= ~NETIF_F_GRO;
 
         /* xmit */
         if (mlx4_en_test_loopback_xmit(priv)) {
@@ -108,6 +110,10 @@ static int mlx4_en_test_loopback(struct mlx4_en_priv *priv)
 mlx4_en_test_loopback_exit:
 
         priv->validate_loopback = 0;
+
+        if (gro_enabled)
+                priv->dev->features |= NETIF_F_GRO;
+
         mlx4_en_update_loopback_state(priv->dev, priv->dev->features);
         return !loopback_ok;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2bb8553bd905..eda29dbbfcd2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -412,7 +412,6 @@ err_icm:
 
 EXPORT_SYMBOL_GPL(mlx4_qp_alloc);
 
-#define MLX4_UPDATE_QP_SUPPORTED_ATTRS MLX4_UPDATE_QP_SMAC
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                    enum mlx4_update_qp_attr attr,
                    struct mlx4_update_qp_params *params)
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 486e3d26cd4a..d97ca88c55b5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -713,7 +713,7 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
         struct mlx4_vport_oper_state *vp_oper;
         struct mlx4_priv *priv;
         u32 qp_type;
-        int port;
+        int port, err = 0;
 
         port = (qpc->pri_path.sched_queue & 0x40) ? 2 : 1;
         priv = mlx4_priv(dev);
@@ -738,7 +738,9 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
                         } else {
                                 struct mlx4_update_qp_params params = {.flags = 0};
 
-                                mlx4_update_qp(dev, qpn, MLX4_UPDATE_QP_VSD, &params);
+                                err = mlx4_update_qp(dev, qpn, MLX4_UPDATE_QP_VSD, &params);
+                                if (err)
+                                        goto out;
                         }
                 }
 
@@ -773,7 +775,8 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
                 qpc->pri_path.feup |= MLX4_FSM_FORCE_ETH_SRC_MAC;
                 qpc->pri_path.grh_mylmc = (0x80 & qpc->pri_path.grh_mylmc) + vp_oper->mac_idx;
         }
-        return 0;
+out:
+        return err;
 }
 
 static int mpt_mask(struct mlx4_dev *dev)
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 44e8d7d25547..57a6e6cd74fc 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1239,11 +1239,9 @@ static int pasemi_mac_open(struct net_device *dev)
         if (mac->phydev)
                 phy_start(mac->phydev);
 
-        init_timer(&mac->tx->clean_timer);
-        mac->tx->clean_timer.function = pasemi_mac_tx_timer;
-        mac->tx->clean_timer.data = (unsigned long)mac->tx;
-        mac->tx->clean_timer.expires = jiffies+HZ;
-        add_timer(&mac->tx->clean_timer);
+        setup_timer(&mac->tx->clean_timer, pasemi_mac_tx_timer,
+                    (unsigned long)mac->tx);
+        mod_timer(&mac->tx->clean_timer, jiffies + HZ);
 
         return 0;
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
index 6e426ae94692..0a5e204a0179 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
@@ -354,7 +354,7 @@ struct cmd_desc_type0 {
 
 } __attribute__ ((aligned(64)));
 
-/* Note: sizeof(rcv_desc) should always be a mutliple of 2 */
+/* Note: sizeof(rcv_desc) should always be a multiple of 2 */
 struct rcv_desc {
         __le16 reference_handle;
         __le16 reserved;
@@ -499,7 +499,7 @@ struct uni_data_desc{
 #define NETXEN_IMAGE_START      0x43000 /* compressed image */
 #define NETXEN_SECONDARY_START  0x200000        /* backup images */
 #define NETXEN_PXE_START        0x3E0000        /* PXE boot rom */
-#define NETXEN_USER_START       0x3E8000        /* Firmare info */
+#define NETXEN_USER_START       0x3E8000        /* Firmware info */
 #define NETXEN_FIXED_START      0x3F0000        /* backup of crbinit */
 #define NETXEN_USER_START_OLD   NETXEN_PXE_START /* very old flash */
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index fa4317611fd6..f221126a5c4e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -314,7 +314,7 @@ struct qlcnic_fdt {
 #define QLCNIC_BRDCFG_START     0x4000          /* board config */
 #define QLCNIC_BOOTLD_START     0x10000         /* bootld */
 #define QLCNIC_IMAGE_START      0x43000         /* compressed image */
-#define QLCNIC_USER_START       0x3E8000        /* Firmare info */
+#define QLCNIC_USER_START       0x3E8000        /* Firmware info */
 
 #define QLCNIC_FW_VERSION_OFFSET        (QLCNIC_USER_START+0x408)
 #define QLCNIC_FW_SIZE_OFFSET           (QLCNIC_USER_START+0x40c)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index ad0020af2193..c70ab40d8698 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -2561,7 +2561,7 @@ static int rtl_check_firmware(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
         int rc = -EINVAL;
 
         if (!rtl_fw_format_ok(tp, rtl_fw)) {
-                netif_err(tp, ifup, dev, "invalid firwmare\n");
+                netif_err(tp, ifup, dev, "invalid firmware\n");
                 goto out;
         }
 
@@ -5067,8 +5067,6 @@ static void rtl_hw_reset(struct rtl8169_private *tp)
         RTL_W8(ChipCmd, CmdReset);
 
         rtl_udelay_loop_wait_low(tp, &rtl_chipcmd_cond, 100, 100);
-
-        netdev_reset_queue(tp->dev);
 }
 
 static void rtl_request_uncached_firmware(struct rtl8169_private *tp)
@@ -7049,7 +7047,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         u32 status, len;
         u32 opts[2];
         int frags;
-        bool stop_queue;
 
         if (unlikely(!TX_FRAGS_READY_FOR(tp, skb_shinfo(skb)->nr_frags))) {
                 netif_err(tp, drv, dev, "BUG! Tx Ring full when queue awake!\n");
@@ -7090,8 +7087,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         txd->opts2 = cpu_to_le32(opts[1]);
 
-        netdev_sent_queue(dev, skb->len);
-
         skb_tx_timestamp(skb);
 
         /* Force memory writes to complete before releasing descriptor */
@@ -7106,16 +7101,11 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         tp->cur_tx += frags + 1;
 
-        stop_queue = !TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS);
+        RTL_W8(TxPoll, NPQ);
 
-        if (!skb->xmit_more || stop_queue ||
-            netif_xmit_stopped(netdev_get_tx_queue(dev, 0))) {
-                RTL_W8(TxPoll, NPQ);
-
-                mmiowb();
-        }
+        mmiowb();
 
-        if (stop_queue) {
+        if (!TX_FRAGS_READY_FOR(tp, MAX_SKB_FRAGS)) {
                 /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
                  * not miss a ring update when it notices a stopped queue.
                  */
@@ -7198,7 +7188,6 @@ static void rtl8169_pcierr_interrupt(struct net_device *dev)
 static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
 {
         unsigned int dirty_tx, tx_left;
-        unsigned int bytes_compl = 0, pkts_compl = 0;
 
         dirty_tx = tp->dirty_tx;
         smp_rmb();
@@ -7222,8 +7211,10 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
                 rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
                                      tp->TxDescArray + entry);
                 if (status & LastFrag) {
-                        pkts_compl++;
-                        bytes_compl += tx_skb->skb->len;
+                        u64_stats_update_begin(&tp->tx_stats.syncp);
+                        tp->tx_stats.packets++;
+                        tp->tx_stats.bytes += tx_skb->skb->len;
+                        u64_stats_update_end(&tp->tx_stats.syncp);
                         dev_kfree_skb_any(tx_skb->skb);
                         tx_skb->skb = NULL;
                 }
@@ -7232,13 +7223,6 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
         }
 
         if (tp->dirty_tx != dirty_tx) {
-                netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
-
-                u64_stats_update_begin(&tp->tx_stats.syncp);
-                tp->tx_stats.packets += pkts_compl;
-                tp->tx_stats.bytes += bytes_compl;
-                u64_stats_update_end(&tp->tx_stats.syncp);
-
                 tp->dirty_tx = dirty_tx;
                 /* Sync with rtl8169_start_xmit:
                  * - publish dirty_tx ring index (write barrier)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 4da8bd263997..736d5d1624a1 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -508,7 +508,6 @@ static struct sh_eth_cpu_data r8a779x_data = {
         .tpauser        = 1,
         .hw_swap        = 1,
         .rmiimode       = 1,
-        .shift_rd0      = 1,
 };
 
 static void sh_eth_set_rate_sh7724(struct net_device *ndev)
@@ -1392,6 +1391,9 @@ static void sh_eth_dev_exit(struct net_device *ndev)
         msleep(2); /* max frame time at 10 Mbps < 1250 us */
         sh_eth_get_stats(ndev);
         sh_eth_reset(ndev);
+
+        /* Set MAC address again */
+        update_mac_address(ndev);
 }
 
 /* free Tx skb function */
@@ -1407,6 +1409,8 @@ static int sh_eth_txfree(struct net_device *ndev)
                 txdesc = &mdp->tx_ring[entry];
                 if (txdesc->status & cpu_to_edmac(mdp, TD_TACT))
                         break;
+                /* TACT bit must be checked before all the following reads */
+                rmb();
                 /* Free the original skb. */
                 if (mdp->tx_skbuff[entry]) {
                         dma_unmap_single(&ndev->dev, txdesc->addr,
@@ -1444,6 +1448,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         limit = boguscnt;
         rxdesc = &mdp->rx_ring[entry];
         while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
+                /* RACT bit must be checked before all the following reads */
+                rmb();
                 desc_status = edmac_to_cpu(mdp, rxdesc->status);
                 pkt_len = rxdesc->frame_length;
 
@@ -1455,8 +1461,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 
                 /* In case of almost all GETHER/ETHERs, the Receive Frame State
                  * (RFS) bits in the Receive Descriptor 0 are from bit 9 to
-                 * bit 0. However, in case of the R8A7740, R8A779x, and
-                 * R7S72100 the RFS bits are from bit 25 to bit 16. So, the
+                 * bit 0. However, in case of the R8A7740 and R7S72100
+                 * the RFS bits are from bit 25 to bit 16. So, the
                  * driver needs right shifting by 16.
                  */
                 if (mdp->cd->shift_rd0)
@@ -1523,6 +1529,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         skb_checksum_none_assert(skb);
                         rxdesc->addr = dma_addr;
                 }
+                wmb(); /* RACT bit must be set after all the above writes */
                 if (entry >= mdp->num_rx_ring - 1)
                         rxdesc->status |=
                                 cpu_to_edmac(mdp, RD_RACT | RD_RFP | RD_RDEL);
@@ -1535,7 +1542,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         /* If we don't need to check status, don't. -KDU */
         if (!(sh_eth_read(ndev, EDRRR) & EDRRR_R)) {
                 /* fix the values for the next receiving if RDE is set */
-                if (intr_status & EESR_RDE) {
+                if (intr_status & EESR_RDE && mdp->reg_offset[RDFAR] != 0) {
                         u32 count = (sh_eth_read(ndev, RDFAR) -
                                      sh_eth_read(ndev, RDLAR)) >> 4;
 
@@ -2174,7 +2181,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         spin_unlock_irqrestore(&mdp->lock, flags);
 
-        if (skb_padto(skb, ETH_ZLEN))
+        if (skb_put_padto(skb, ETH_ZLEN))
                 return NETDEV_TX_OK;
 
         entry = mdp->cur_tx % mdp->num_tx_ring;
@@ -2192,6 +2199,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         txdesc->buffer_length = skb->len;
 
+        wmb(); /* TACT bit must be set after all the above writes */
         if (entry >= mdp->num_tx_ring - 1)
                 txdesc->status |= cpu_to_edmac(mdp, TD_TACT | TD_TDLE);
         else
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 34389b6aa67c..9fb6948e14c6 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -1257,9 +1257,9 @@ static void rocker_port_set_enable(struct rocker_port *rocker_port, bool enable)
         u64 val = rocker_read64(rocker_port->rocker, PORT_PHYS_ENABLE);
 
         if (enable)
-                val |= 1 << rocker_port->lport;
+                val |= 1ULL << rocker_port->lport;
         else
-                val &= ~(1 << rocker_port->lport);
+                val &= ~(1ULL << rocker_port->lport);
         rocker_write64(rocker_port->rocker, PORT_PHYS_ENABLE, val);
 }
 
@@ -4201,6 +4201,8 @@ static int rocker_probe_ports(struct rocker *rocker)
 
         alloc_size = sizeof(struct rocker_port *) * rocker->port_count;
         rocker->ports = kmalloc(alloc_size, GFP_KERNEL);
+        if (!rocker->ports)
+                return -ENOMEM;
         for (i = 0; i < rocker->port_count; i++) {
                 err = rocker_probe_port(rocker, i);
                 if (err)
diff --git a/drivers/net/ethernet/smsc/smc91c92_cs.c b/drivers/net/ethernet/smsc/smc91c92_cs.c
index 6b33127ab352..3449893aea8d 100644
--- a/drivers/net/ethernet/smsc/smc91c92_cs.c
+++ b/drivers/net/ethernet/smsc/smc91c92_cs.c
@@ -1070,11 +1070,8 @@ static int smc_open(struct net_device *dev)
     smc->packets_waiting = 0;
 
     smc_reset(dev);
-    init_timer(&smc->media);
-    smc->media.function = media_check;
-    smc->media.data = (u_long) dev;
-    smc->media.expires = jiffies + HZ;
-    add_timer(&smc->media);
+    setup_timer(&smc->media, media_check, (u_long)dev);
+    mod_timer(&smc->media, jiffies + HZ);
 
     return 0;
 } /* smc_open */
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 88a55f95fe09..5d093dc0f5f5 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -91,6 +91,11 @@ static const char version[] =
 
 #include "smc91x.h"
 
+#if defined(CONFIG_ASSABET_NEPONSET)
+#include <mach/assabet.h>
+#include <mach/neponset.h>
+#endif
+
 #ifndef SMC_NOWAIT
 # define SMC_NOWAIT             0
 #endif
@@ -2355,8 +2360,9 @@ static int smc_drv_probe(struct platform_device *pdev)
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
                 goto out_release_io;
-#if defined(CONFIG_SA1100_ASSABET)
-        neponset_ncr_set(NCR_ENET_OSC_EN);
+#if defined(CONFIG_ASSABET_NEPONSET)
+        if (machine_is_assabet() && machine_has_neponset())
+                neponset_ncr_set(NCR_ENET_OSC_EN);
 #endif
         platform_set_drvdata(pdev, ndev);
         ret = smc_enable_device(pdev);
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index be67baf5f677..3a18501d1068 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -39,14 +39,7 @@
  * Define your architecture specific bus configuration parameters here.
  */
 
-#if defined(CONFIG_ARCH_LUBBOCK) ||\
-    defined(CONFIG_MACH_MAINSTONE) ||\
-    defined(CONFIG_MACH_ZYLONITE) ||\
-    defined(CONFIG_MACH_LITTLETON) ||\
-    defined(CONFIG_MACH_ZYLONITE2) ||\
-    defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2) ||\
-    defined(CONFIG_ARCH_VERSATILE)
+#if defined(CONFIG_ARM)
 
 #include <asm/mach-types.h>
 
@@ -74,95 +67,8 @@
 /* We actually can't write halfwords properly if not word aligned */
 static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
-        if ((machine_is_mainstone() || machine_is_stargate2()) && reg & 2) {
-                unsigned int v = val << 16;
-                v |= readl(ioaddr + (reg & ~2)) & 0xffff;
-                writel(v, ioaddr + (reg & ~2));
-        } else {
-                writew(val, ioaddr + reg);
-        }
-}
-
-#elif defined(CONFIG_SA1100_PLEB)
-/* We can only do 16-bit reads and writes in the static memory space. */
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, (l))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#define SMC_IRQ_FLAGS           (-1)
-
-#elif defined(CONFIG_SA1100_ASSABET)
-
-#include <mach/neponset.h>
-
-/* We can only do 8-bit reads and writes in the static memory space. */
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       0
-#define SMC_CAN_USE_32BIT       0
-#define SMC_NOWAIT              1
-
-/* The first two address lines aren't connected... */
-#define SMC_IO_SHIFT            2
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, (l))
-#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270) ||  \
-        defined(CONFIG_MACH_NOMADIK_8815NHK)
-
-#define SMC_CAN_USE_8BIT        0
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#elif   defined(CONFIG_ARCH_INNOKOM) || \
-        defined(CONFIG_ARCH_PXA_IDP) || \
-        defined(CONFIG_ARCH_RAMSES) || \
-        defined(CONFIG_ARCH_PCM027)
-
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_IO_SHIFT            0
-#define SMC_NOWAIT              1
-#define SMC_USE_PXA_DMA         1
-
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
-
-/* We actually can't write halfwords properly if not word aligned */
-static inline void
-SMC_outw(u16 val, void __iomem *ioaddr, int reg)
-{
-        if (reg & 2) {
+        if ((machine_is_mainstone() || machine_is_stargate2() ||
+             machine_is_pxa_idp()) && reg & 2) {
                 unsigned int v = val << 16;
                 v |= readl(ioaddr + (reg & ~2)) & 0xffff;
                 writel(v, ioaddr + (reg & ~2));
@@ -237,20 +143,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_100_10
 #define RPC_LSB_DEFAULT         RPC_LED_TX_RX
 
-#elif defined(CONFIG_ARCH_MSM)
-
-#define SMC_CAN_USE_8BIT        0
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       0
-#define SMC_NOWAIT              1
-
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
-
-#define SMC_IRQ_FLAGS           IRQF_TRIGGER_HIGH
-
 #elif defined(CONFIG_COLDFIRE)
 
 #define SMC_CAN_USE_8BIT        0
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 55e89b3838f1..a0ea84fe6519 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -310,11 +310,11 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                 spin_lock_irqsave(&priv->lock, flags);
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
-                        init_timer(&priv->eee_ctrl_timer);
-                        priv->eee_ctrl_timer.function = stmmac_eee_ctrl_timer;
-                        priv->eee_ctrl_timer.data = (unsigned long)priv;
-                        priv->eee_ctrl_timer.expires = STMMAC_LPI_T(eee_timer);
-                        add_timer(&priv->eee_ctrl_timer);
+                        setup_timer(&priv->eee_ctrl_timer,
+                                    stmmac_eee_ctrl_timer,
+                                    (unsigned long)priv);
+                        mod_timer(&priv->eee_ctrl_timer,
+                                  STMMAC_LPI_T(eee_timer));
 
                         priv->hw->mac->set_eee_timer(priv->hw,
                                                      STMMAC_DEFAULT_LIT_LS,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index fb846ebba1d9..f9b42f11950f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -272,6 +272,37 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
         struct stmmac_priv *priv = NULL;
         struct plat_stmmacenet_data *plat_dat = NULL;
         const char *mac = NULL;
+        int irq, wol_irq, lpi_irq;
+
+        /* Get IRQ information early to have an ability to ask for deferred
+         * probe if needed before we went too far with resource allocation.
+         */
+        irq = platform_get_irq_byname(pdev, "macirq");
+        if (irq < 0) {
+                if (irq != -EPROBE_DEFER) {
+                        dev_err(dev,
+                                "MAC IRQ configuration information not found\n");
+                }
+                return irq;
+        }
+
+        /* On some platforms e.g. SPEAr the wake up irq differs from the mac irq
+         * The external wake up irq can be passed through the platform code
+         * named as "eth_wake_irq"
+         *
+         * In case the wake up interrupt is not passed from the platform
+         * so the driver will continue to use the mac irq (ndev->irq)
+         */
+        wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
+        if (wol_irq < 0) {
+                if (wol_irq == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                wol_irq = irq;
+        }
+
+        lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
+        if (lpi_irq == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         addr = devm_ioremap_resource(dev, res);
@@ -323,39 +354,15 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 return PTR_ERR(priv);
         }
 
+        /* Copy IRQ values to priv structure which is now avaialble */
+        priv->dev->irq = irq;
+        priv->wol_irq = wol_irq;
+        priv->lpi_irq = lpi_irq;
+
         /* Get MAC address if available (DT) */
         if (mac)
                 memcpy(priv->dev->dev_addr, mac, ETH_ALEN);
 
-        /* Get the MAC information */
-        priv->dev->irq = platform_get_irq_byname(pdev, "macirq");
-        if (priv->dev->irq < 0) {
-                if (priv->dev->irq != -EPROBE_DEFER) {
-                        netdev_err(priv->dev,
-                                   "MAC IRQ configuration information not found\n");
-                }
-                return priv->dev->irq;
-        }
-
-        /*
-         * On some platforms e.g. SPEAr the wake up irq differs from the mac irq
-         * The external wake up irq can be passed through the platform code
-         * named as "eth_wake_irq"
-         *
-         * In case the wake up interrupt is not passed from the platform
-         * so the driver will continue to use the mac irq (ndev->irq)
-         */
-        priv->wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
-        if (priv->wol_irq < 0) {
-                if (priv->wol_irq == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                priv->wol_irq = priv->dev->irq;
-        }
-
-        priv->lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
-        if (priv->lpi_irq == -EPROBE_DEFER)
-                return -EPROBE_DEFER;
-
         platform_set_drvdata(pdev, priv->dev);
 
         pr_debug("STMMAC platform driver registration completed");
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 4b51f903fb73..0c5842aeb807 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -6989,10 +6989,10 @@ static int niu_class_to_ethflow(u64 class, int *flow_type)
                 *flow_type = IP_USER_FLOW;
                 break;
         default:
-                return 0;
+                return -EINVAL;
         }
 
-        return 1;
+        return 0;
 }
 
 static int niu_ethflow_to_class(int flow_type, u64 *class)
@@ -7198,11 +7198,9 @@ static int niu_get_ethtool_tcam_entry(struct niu *np,
         class = (tp->key[0] & TCAM_V4KEY0_CLASS_CODE) >>
                 TCAM_V4KEY0_CLASS_CODE_SHIFT;
         ret = niu_class_to_ethflow(class, &fsp->flow_type);
-
         if (ret < 0) {
                 netdev_info(np->dev, "niu%d: niu_class_to_ethflow failed\n",
                             parent->index);
-                ret = -EINVAL;
                 goto out;
         }
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7d8dd0d2182e..a1bbaf6352ba 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1103,7 +1103,7 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
         cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast,
                            port_mask, ALE_VLAN, slave->port_vlan, 0);
         cpsw_ale_add_ucast(priv->ale, priv->mac_addr,
-                priv->host_port, ALE_VLAN, slave->port_vlan);
+                priv->host_port, ALE_VLAN | ALE_SECURE, slave->port_vlan);
 }
 
 static void soft_reset_slave(struct cpsw_slave *slave)
@@ -2466,6 +2466,7 @@ static int cpsw_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int cpsw_suspend(struct device *dev)
 {
         struct platform_device  *pdev = to_platform_device(dev);
@@ -2518,11 +2519,9 @@ static int cpsw_resume(struct device *dev)
         }
         return 0;
 }
+#endif
 
-static const struct dev_pm_ops cpsw_pm_ops = {
-        .suspend        = cpsw_suspend,
-        .resume         = cpsw_resume,
-};
+static SIMPLE_DEV_PM_OPS(cpsw_pm_ops, cpsw_suspend, cpsw_resume);
 
 static const struct of_device_id cpsw_of_mtable[] = {
         { .compatible = "ti,cpsw", },
diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
index 98655b44b97e..c00084d689f3 100644
--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
@@ -423,6 +423,7 @@ static int davinci_mdio_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int davinci_mdio_suspend(struct device *dev)
 {
         struct davinci_mdio_data *data = dev_get_drvdata(dev);
@@ -464,10 +465,10 @@ static int davinci_mdio_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static const struct dev_pm_ops davinci_mdio_pm_ops = {
-        .suspend_late   = davinci_mdio_suspend,
-        .resume_early   = davinci_mdio_resume,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(davinci_mdio_suspend, davinci_mdio_resume)
 };
 
 #if IS_ENABLED(CONFIG_OF)
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index f7e0f0f7c2e2..9e16a2819d48 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -938,7 +938,7 @@ static void eth_set_mcast_list(struct net_device *dev)
         int i;
         static const u8 allmulti[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
-        if (dev->flags & IFF_ALLMULTI) {
+        if ((dev->flags & IFF_ALLMULTI) && !(dev->flags & IFF_PROMISC)) {
                 for (i = 0; i < ETH_ALEN; i++) {
                         __raw_writel(allmulti[i], &port->regs->mcast_addr[i]);
                         __raw_writel(allmulti[i], &port->regs->mcast_mask[i]);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index e40fdfccc9c1..27ecc5c4fa26 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -654,11 +654,14 @@ static void macvtap_skb_to_vnet_hdr(struct macvtap_queue *q,
         } /* else everything is zero */
 }
 
+/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
+#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
+
 /* Get packet from user space buffer */
 static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                                 struct iov_iter *from, int noblock)
 {
-        int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
+        int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
         struct sk_buff *skb;
         struct macvlan_dev *vlan;
         unsigned long total_len = iov_iter_count(from);
@@ -722,7 +725,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                         linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
         }
 
-        skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
+        skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
                                 linear, noblock, &err);
         if (!skb)
                 goto err;
diff --git a/drivers/net/phy/amd-xgbe-phy.c b/drivers/net/phy/amd-xgbe-phy.c
index 9e3af54c9010..32efbd48f326 100644
--- a/drivers/net/phy/amd-xgbe-phy.c
+++ b/drivers/net/phy/amd-xgbe-phy.c
@@ -92,6 +92,8 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define XGBE_PHY_CDR_RATE_PROPERTY      "amd,serdes-cdr-rate"
 #define XGBE_PHY_PQ_SKEW_PROPERTY       "amd,serdes-pq-skew"
 #define XGBE_PHY_TX_AMP_PROPERTY        "amd,serdes-tx-amp"
+#define XGBE_PHY_DFE_CFG_PROPERTY       "amd,serdes-dfe-tap-config"
+#define XGBE_PHY_DFE_ENA_PROPERTY       "amd,serdes-dfe-tap-enable"
 
 #define XGBE_PHY_SPEEDS                 3
 #define XGBE_PHY_SPEED_1000             0
@@ -177,10 +179,12 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_10000_BLWC                0
 #define SPEED_10000_CDR                 0x7
 #define SPEED_10000_PLL                 0x1
-#define SPEED_10000_PQ                  0x1e
+#define SPEED_10000_PQ                  0x12
 #define SPEED_10000_RATE                0x0
 #define SPEED_10000_TXAMP               0xa
 #define SPEED_10000_WORD                0x7
+#define SPEED_10000_DFE_TAP_CONFIG      0x1
+#define SPEED_10000_DFE_TAP_ENABLE      0x7f
 
 #define SPEED_2500_BLWC                 1
 #define SPEED_2500_CDR                  0x2
@@ -189,6 +193,8 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_2500_RATE                 0x1
 #define SPEED_2500_TXAMP                0xf
 #define SPEED_2500_WORD                 0x1
+#define SPEED_2500_DFE_TAP_CONFIG       0x3
+#define SPEED_2500_DFE_TAP_ENABLE       0x0
 
 #define SPEED_1000_BLWC                 1
 #define SPEED_1000_CDR                  0x2
@@ -197,16 +203,25 @@ MODULE_DESCRIPTION("AMD 10GbE (amd-xgbe) PHY driver");
 #define SPEED_1000_RATE                 0x3
 #define SPEED_1000_TXAMP                0xf
 #define SPEED_1000_WORD                 0x1
+#define SPEED_1000_DFE_TAP_CONFIG       0x3
+#define SPEED_1000_DFE_TAP_ENABLE       0x0
 
 /* SerDes RxTx register offsets */
+#define RXTX_REG6                       0x0018
 #define RXTX_REG20                      0x0050
+#define RXTX_REG22                      0x0058
 #define RXTX_REG114                     0x01c8
+#define RXTX_REG129                     0x0204
 
 /* SerDes RxTx register entry bit positions and sizes */
+#define RXTX_REG6_RESETB_RXD_INDEX      8
+#define RXTX_REG6_RESETB_RXD_WIDTH      1
 #define RXTX_REG20_BLWC_ENA_INDEX       2
 #define RXTX_REG20_BLWC_ENA_WIDTH       1
 #define RXTX_REG114_PQ_REG_INDEX        9
 #define RXTX_REG114_PQ_REG_WIDTH        7
+#define RXTX_REG129_RXDFE_CONFIG_INDEX  14
+#define RXTX_REG129_RXDFE_CONFIG_WIDTH  2
 
 /* Bit setting and getting macros
  *  The get macro will extract the current bit field value from within
@@ -333,6 +348,18 @@ static const u32 amd_xgbe_phy_serdes_tx_amp[] = {
         SPEED_10000_TXAMP,
 };
 
+static const u32 amd_xgbe_phy_serdes_dfe_tap_cfg[] = {
+        SPEED_1000_DFE_TAP_CONFIG,
+        SPEED_2500_DFE_TAP_CONFIG,
+        SPEED_10000_DFE_TAP_CONFIG,
+};
+
+static const u32 amd_xgbe_phy_serdes_dfe_tap_ena[] = {
+        SPEED_1000_DFE_TAP_ENABLE,
+        SPEED_2500_DFE_TAP_ENABLE,
+        SPEED_10000_DFE_TAP_ENABLE,
+};
+
 enum amd_xgbe_phy_an {
         AMD_XGBE_AN_READY = 0,
         AMD_XGBE_AN_PAGE_RECEIVED,
@@ -393,6 +420,8 @@ struct amd_xgbe_phy_priv {
         u32 serdes_cdr_rate[XGBE_PHY_SPEEDS];
         u32 serdes_pq_skew[XGBE_PHY_SPEEDS];
         u32 serdes_tx_amp[XGBE_PHY_SPEEDS];
+        u32 serdes_dfe_tap_cfg[XGBE_PHY_SPEEDS];
+        u32 serdes_dfe_tap_ena[XGBE_PHY_SPEEDS];
 
         /* Auto-negotiation state machine support */
         struct mutex an_mutex;
@@ -481,11 +510,16 @@ static void amd_xgbe_phy_serdes_complete_ratechange(struct phy_device *phydev)
                 status = XSIR0_IOREAD(priv, SIR0_STATUS);
                 if (XSIR_GET_BITS(status, SIR0_STATUS, RX_READY) &&
                     XSIR_GET_BITS(status, SIR0_STATUS, TX_READY))
-                        return;
+                        goto rx_reset;
         }
 
         netdev_dbg(phydev->attached_dev, "SerDes rx/tx not ready (%#hx)\n",
                    status);
+
+rx_reset:
+        /* Perform Rx reset for the DFE changes */
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG6, RESETB_RXD, 0);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG6, RESETB_RXD, 1);
 }
 
 static int amd_xgbe_phy_xgmii_mode(struct phy_device *phydev)
@@ -534,6 +568,10 @@ static int amd_xgbe_phy_xgmii_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_10000]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_10000]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_10000]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_10000]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -586,6 +624,10 @@ static int amd_xgbe_phy_gmii_2500_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_2500]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_2500]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_2500]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_2500]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -638,6 +680,10 @@ static int amd_xgbe_phy_gmii_mode(struct phy_device *phydev)
                            priv->serdes_blwc[XGBE_PHY_SPEED_1000]);
         XRXTX_IOWRITE_BITS(priv, RXTX_REG114, PQ_REG,
                            priv->serdes_pq_skew[XGBE_PHY_SPEED_1000]);
+        XRXTX_IOWRITE_BITS(priv, RXTX_REG129, RXDFE_CONFIG,
+                           priv->serdes_dfe_tap_cfg[XGBE_PHY_SPEED_1000]);
+        XRXTX_IOWRITE(priv, RXTX_REG22,
+                      priv->serdes_dfe_tap_ena[XGBE_PHY_SPEED_1000]);
 
         amd_xgbe_phy_serdes_complete_ratechange(phydev);
 
@@ -1668,6 +1714,38 @@ static int amd_xgbe_phy_probe(struct phy_device *phydev)
                        sizeof(priv->serdes_tx_amp));
         }
 
+        if (device_property_present(phy_dev, XGBE_PHY_DFE_CFG_PROPERTY)) {
+                ret = device_property_read_u32_array(phy_dev,
+                                                     XGBE_PHY_DFE_CFG_PROPERTY,
+                                                     priv->serdes_dfe_tap_cfg,
+                                                     XGBE_PHY_SPEEDS);
+                if (ret) {
+                        dev_err(dev, "invalid %s property\n",
+                                XGBE_PHY_DFE_CFG_PROPERTY);
+                        goto err_sir1;
+                }
+        } else {
+                memcpy(priv->serdes_dfe_tap_cfg,
+                       amd_xgbe_phy_serdes_dfe_tap_cfg,
+                       sizeof(priv->serdes_dfe_tap_cfg));
+        }
+
+        if (device_property_present(phy_dev, XGBE_PHY_DFE_ENA_PROPERTY)) {
+                ret = device_property_read_u32_array(phy_dev,
+                                                     XGBE_PHY_DFE_ENA_PROPERTY,
+                                                     priv->serdes_dfe_tap_ena,
+                                                     XGBE_PHY_SPEEDS);
+                if (ret) {
+                        dev_err(dev, "invalid %s property\n",
+                                XGBE_PHY_DFE_ENA_PROPERTY);
+                        goto err_sir1;
+                }
+        } else {
+                memcpy(priv->serdes_dfe_tap_ena,
+                       amd_xgbe_phy_serdes_dfe_tap_ena,
+                       sizeof(priv->serdes_dfe_tap_ena));
+        }
+
         phydev->priv = priv;
 
         if (!priv->adev || acpi_disabled)
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index cdcac6aa4260..52cd8db2c57d 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -236,6 +236,25 @@ static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 }
 
 /**
+ * phy_check_valid - check if there is a valid PHY setting which matches
+ *                   speed, duplex, and feature mask
+ * @speed: speed to match
+ * @duplex: duplex to match
+ * @features: A mask of the valid settings
+ *
+ * Description: Returns true if there is a valid setting, false otherwise.
+ */
+static inline bool phy_check_valid(int speed, int duplex, u32 features)
+{
+        unsigned int idx;
+
+        idx = phy_find_valid(phy_find_setting(speed, duplex), features);
+
+        return settings[idx].speed == speed && settings[idx].duplex == duplex &&
+                (settings[idx].setting & features);
+}
+
+/**
  * phy_sanitize_settings - make sure the PHY is set to supported speed and duplex
  * @phydev: the target phy_device struct
  *
@@ -1045,7 +1064,6 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
                 int eee_lp, eee_cap, eee_adv;
                 u32 lp, cap, adv;
                 int status;
-                unsigned int idx;
 
                 /* Read phy status to properly get the right settings */
                 status = phy_read_status(phydev);
@@ -1077,8 +1095,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
 
                 adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
                 lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
-                idx = phy_find_setting(phydev->speed, phydev->duplex);
-                if (!(lp & adv & settings[idx].setting))
+                if (!phy_check_valid(phydev->speed, phydev->duplex, lp & adv))
                         goto eee_exit_err;
 
                 if (clk_stop_enable) {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 0e62274e884a..7d394846afc2 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -43,9 +43,7 @@
 
 static struct team_port *team_port_get_rcu(const struct net_device *dev)
 {
-        struct team_port *port = rcu_dereference(dev->rx_handler_data);
-
-        return team_port_exists(dev) ? port : NULL;
+        return rcu_dereference(dev->rx_handler_data);
 }
 
 static struct team_port *team_port_get_rtnl(const struct net_device *dev)
@@ -1732,11 +1730,11 @@ static int team_set_mac_address(struct net_device *dev, void *p)
         if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        rcu_read_lock();
-        list_for_each_entry_rcu(port, &team->port_list, list)
+        mutex_lock(&team->lock);
+        list_for_each_entry(port, &team->port_list, list)
                 if (team->ops.port_change_dev_addr)
                         team->ops.port_change_dev_addr(team, port);
-        rcu_read_unlock();
+        mutex_unlock(&team->lock);
         return 0;
 }
 
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 3bd9678315ad..7ba8d0885f12 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -161,6 +161,7 @@ config USB_NET_AX8817X
             * Linksys USB200M
             * Netgear FA120
             * Sitecom LN-029
+            * Sitecom LN-028
             * Intellinet USB 2.0 Ethernet
             * ST Lab USB 2.0 Ethernet
             * TrendNet TU2-ET100
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index bf49792062a2..1173a24feda3 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -979,6 +979,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x0df6, 0x0056),
         .driver_info =  (unsigned long) &ax88178_info,
 }, {
+        // Sitecom LN-028 "USB 2.0 10/100/1000 Ethernet adapter"
+        USB_DEVICE (0x0df6, 0x061c),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
         // corega FEther USB2-TX
         USB_DEVICE (0x07aa, 0x0017),
         .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 9cdfb3fe9c15..778e91531fac 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1594,7 +1594,7 @@ hso_wait_modem_status(struct hso_serial *serial, unsigned long arg)
                 }
                 cprev = cnow;
         }
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(&tiocmget->waitq, &wait);
 
         return ret;
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 3d18bb0eee85..1bfe0fcaccf5 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -134,6 +134,11 @@ static const struct usb_device_id	products [] = {
 }, {
         USB_DEVICE(0x050d, 0x258a),     /* Belkin F5U258/F5U279 (PL-25A1) */
         .driver_info =  (unsigned long) &prolific_info,
+}, {
+        USB_DEVICE(0x3923, 0x7825),     /* National Instruments USB
+                                         * Host-to-Host Cable
+                                         */
+        .driver_info =  (unsigned long) &prolific_info,
 },
 
         { },            // END
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 83c39e2858bf..88d121d43c08 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -806,21 +806,21 @@ static ssize_t cosa_read(struct file *file,
         spin_lock_irqsave(&cosa->lock, flags);
         add_wait_queue(&chan->rxwaitq, &wait);
         while (!chan->rx_status) {
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
                 spin_unlock_irqrestore(&cosa->lock, flags);
                 schedule();
                 spin_lock_irqsave(&cosa->lock, flags);
                 if (signal_pending(current) && chan->rx_status == 0) {
                         chan->rx_status = 1;
                         remove_wait_queue(&chan->rxwaitq, &wait);
-                        current->state = TASK_RUNNING;
+                        __set_current_state(TASK_RUNNING);
                         spin_unlock_irqrestore(&cosa->lock, flags);
                         mutex_unlock(&chan->rlock);
                         return -ERESTARTSYS;
                 }
         }
         remove_wait_queue(&chan->rxwaitq, &wait);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         kbuf = chan->rxdata;
         count = chan->rxsize;
         spin_unlock_irqrestore(&cosa->lock, flags);
@@ -890,14 +890,14 @@ static ssize_t cosa_write(struct file *file,
         spin_lock_irqsave(&cosa->lock, flags);
         add_wait_queue(&chan->txwaitq, &wait);
         while (!chan->tx_status) {
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
                 spin_unlock_irqrestore(&cosa->lock, flags);
                 schedule();
                 spin_lock_irqsave(&cosa->lock, flags);
                 if (signal_pending(current) && chan->tx_status == 0) {
                         chan->tx_status = 1;
                         remove_wait_queue(&chan->txwaitq, &wait);
-                        current->state = TASK_RUNNING;
+                        __set_current_state(TASK_RUNNING);
                         chan->tx_status = 1;
                         spin_unlock_irqrestore(&cosa->lock, flags);
                         up(&chan->wsem);
@@ -905,7 +905,7 @@ static ssize_t cosa_write(struct file *file,
                 }
         }
         remove_wait_queue(&chan->txwaitq, &wait);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
         up(&chan->wsem);
         spin_unlock_irqrestore(&cosa->lock, flags);
         kfree(kbuf);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4a4c6586a8d2..8908be6dbc48 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -946,7 +946,8 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
                 goto nla_put_failure;
 
         genlmsg_end(skb, msg_head);
-        genlmsg_unicast(&init_net, skb, dst_portid);
+        if (genlmsg_unicast(&init_net, skb, dst_portid))
+                goto err_free_txskb;
 
         /* Enqueue the packet */
         skb_queue_tail(&data->pending, my_skb);
@@ -955,6 +956,8 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         return;
 
 nla_put_failure:
+        nlmsg_free(skb);
+err_free_txskb:
         printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
         ieee80211_free_txskb(hw, my_skb);
         data->tx_failed++;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f38227afe099..3aa8648080c8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -340,12 +340,11 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
         unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
-        struct xenvif_stats *vif_stats;
 
         for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                 unsigned long accum = 0;
                 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
-                        vif_stats = &vif->queues[queue_index].stats;
+                        void *vif_stats = &vif->queues[queue_index].stats;
                         accum += *(unsigned long *)(vif_stats + xenvif_stats[i].offset);
                 }
                 data[i] = accum;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f7a31d2cb3f1..cab9f5257f57 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -655,9 +655,15 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
+                int notify;
+
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
+                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
+                if (notify)
+                        notify_remote_via_irq(queue->tx_irq);
+
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1343,7 +1349,7 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
 {
         unsigned int offset = skb_headlen(skb);
         skb_frag_t frags[MAX_SKB_FRAGS];
-        int i;
+        int i, f;
         struct ubuf_info *uarg;
         struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
 
@@ -1383,23 +1389,25 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
                 frags[i].page_offset = 0;
                 skb_frag_size_set(&frags[i], len);
         }
-        /* swap out with old one */
-        memcpy(skb_shinfo(skb)->frags,
-               frags,
-               i * sizeof(skb_frag_t));
-        skb_shinfo(skb)->nr_frags = i;
-        skb->truesize += i * PAGE_SIZE;
 
-        /* remove traces of mapped pages and frag_list */
+        /* Copied all the bits from the frag list -- free it. */
         skb_frag_list_init(skb);
+        xenvif_skb_zerocopy_prepare(queue, nskb);
+        kfree_skb(nskb);
+
+        /* Release all the original (foreign) frags. */
+        for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
+                skb_frag_unref(skb, f);
         uarg = skb_shinfo(skb)->destructor_arg;
         /* increase inflight counter to offset decrement in callback */
         atomic_inc(&queue->inflight_packets);
         uarg->callback(uarg, true);
         skb_shinfo(skb)->destructor_arg = NULL;
 
-        xenvif_skb_zerocopy_prepare(queue, nskb);
-        kfree_skb(nskb);
+        /* Fill the skb with the new (local) frags. */
+        memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
+        skb_shinfo(skb)->nr_frags = i;
+        skb->truesize += i * PAGE_SIZE;
 
         return 0;
 }
@@ -1649,17 +1657,28 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
+        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
+
         spin_lock_irqsave(&queue->response_lock, flags);
+
         make_tx_response(queue, &pending_tx_info->req, status);
-        index = pending_index(queue->pending_prod);
+
+        /* Release the pending index before pusing the Tx response so
+         * its available before a new Tx request is pushed by the
+         * frontend.
+         */
+        index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
-        /* TX shouldn't use the index before we give it back here */
-        mb();
-        queue->pending_prod++;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+
         spin_unlock_irqrestore(&queue->response_lock, flags);
+
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1669,7 +1688,6 @@ static void make_tx_response(struct xenvif_queue *queue,
 {
         RING_IDX i = queue->tx.rsp_prod_pvt;
         struct xen_netif_tx_response *resp;
-        int notify;
 
         resp = RING_GET_RESPONSE(&queue->tx, i);
         resp->id     = txp->id;
@@ -1679,9 +1697,6 @@ static void make_tx_response(struct xenvif_queue *queue,
                 RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
 
         queue->tx.rsp_prod_pvt = ++i;
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
index 1ec694a52379..464bf492ee2a 100644
--- a/drivers/pci/host/pci-versatile.c
+++ b/drivers/pci/host/pci-versatile.c
@@ -80,7 +80,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
         if (err)
                 return err;
 
-        resource_list_for_each_entry(win, res, list) {
+        resource_list_for_each_entry(win, res) {
                 struct resource *parent, *res = win->res;
 
                 switch (resource_type(res)) {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index b899947d839d..1245dca79009 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3444,13 +3444,6 @@ static umode_t regulator_attr_is_visible(struct kobject *kobj,
         if (attr == &dev_attr_requested_microamps.attr)
                 return rdev->desc->type == REGULATOR_CURRENT ? mode : 0;
 
-        /* all the other attributes exist to support constraints;
-         * don't show them if there are no constraints, or if the
-         * relevant supporting methods are missing.
-         */
-        if (!rdev->constraints)
-                return 0;
-
         /* constraints need specific supporting methods */
         if (attr == &dev_attr_min_microvolts.attr ||
             attr == &dev_attr_max_microvolts.attr)
diff --git a/drivers/regulator/da9210-regulator.c b/drivers/regulator/da9210-regulator.c
index bc6100103f7f..f0489cb9018b 100644
--- a/drivers/regulator/da9210-regulator.c
+++ b/drivers/regulator/da9210-regulator.c
@@ -152,6 +152,15 @@ static int da9210_i2c_probe(struct i2c_client *i2c,
         config.regmap = chip->regmap;
         config.of_node = dev->of_node;
 
+        /* Mask all interrupt sources to deassert interrupt line */
+        error = regmap_write(chip->regmap, DA9210_REG_MASK_A, ~0);
+        if (!error)
+                error = regmap_write(chip->regmap, DA9210_REG_MASK_B, ~0);
+        if (error) {
+                dev_err(&i2c->dev, "Failed to write to mask reg: %d\n", error);
+                return error;
+        }
+
         rdev = devm_regulator_register(&i2c->dev, &da9210_reg, &config);
         if (IS_ERR(rdev)) {
                 dev_err(&i2c->dev, "Failed to register DA9210 regulator\n");
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index 1f93b752a81c..3fd44353cc80 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -235,6 +235,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(0),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG2",
@@ -249,6 +250,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(1),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG3",
@@ -263,6 +265,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_BUCK4_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(2),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG4",
@@ -277,6 +280,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(3),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG5",
@@ -291,6 +295,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(4),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG6",
@@ -305,6 +310,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(5),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG7",
@@ -319,6 +325,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(6),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "LDO_REG8",
@@ -333,6 +340,7 @@ static const struct regulator_desc rk808_reg[] = {
                 .vsel_mask = RK808_LDO_VSEL_MASK,
                 .enable_reg = RK808_LDO_EN_REG,
                 .enable_mask = BIT(7),
+                .enable_time = 400,
                 .owner = THIS_MODULE,
         }, {
                 .name = "SWITCH_REG1",
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 70a5d94cc766..b4f7744f6751 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -31,6 +31,7 @@
 #include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/suspend.h>
 #include <linux/uaccess.h>
 
 #include "rtc-at91rm9200.h"
@@ -54,6 +55,10 @@ static void __iomem *at91_rtc_regs;
 static int irq;
 static DEFINE_SPINLOCK(at91_rtc_lock);
 static u32 at91_rtc_shadow_imr;
+static bool suspended;
+static DEFINE_SPINLOCK(suspended_lock);
+static unsigned long cached_events;
+static u32 at91_rtc_imr;
 
 static void at91_rtc_write_ier(u32 mask)
 {
@@ -290,7 +295,9 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
         struct rtc_device *rtc = platform_get_drvdata(pdev);
         unsigned int rtsr;
         unsigned long events = 0;
+        int ret = IRQ_NONE;
 
+        spin_lock(&suspended_lock);
         rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read_imr();
         if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                 if (rtsr & AT91_RTC_ALARM)
@@ -304,14 +311,22 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
 
                 at91_rtc_write(AT91_RTC_SCCR, rtsr);    /* clear status reg */
 
-                rtc_update_irq(rtc, 1, events);
+                if (!suspended) {
+                        rtc_update_irq(rtc, 1, events);
 
-                dev_dbg(&pdev->dev, "%s(): num=%ld, events=0x%02lx\n", __func__,
-                        events >> 8, events & 0x000000FF);
+                        dev_dbg(&pdev->dev, "%s(): num=%ld, events=0x%02lx\n",
+                                __func__, events >> 8, events & 0x000000FF);
+                } else {
+                        cached_events |= events;
+                        at91_rtc_write_idr(at91_rtc_imr);
+                        pm_system_wakeup();
+                }
 
-                return IRQ_HANDLED;
+                ret = IRQ_HANDLED;
         }
-        return IRQ_NONE;                /* not handled */
+        spin_lock(&suspended_lock);
+
+        return ret;
 }
 
 static const struct at91_rtc_config at91rm9200_config = {
@@ -401,8 +416,8 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
                                         AT91_RTC_CALEV);
 
         ret = devm_request_irq(&pdev->dev, irq, at91_rtc_interrupt,
-                                IRQF_SHARED,
-                                "at91_rtc", pdev);
+                               IRQF_SHARED | IRQF_COND_SUSPEND,
+                               "at91_rtc", pdev);
         if (ret) {
                 dev_err(&pdev->dev, "IRQ %d already in use.\n", irq);
                 return ret;
@@ -454,8 +469,6 @@ static void at91_rtc_shutdown(struct platform_device *pdev)
 
 /* AT91RM9200 RTC Power management control */
 
-static u32 at91_rtc_imr;
-
 static int at91_rtc_suspend(struct device *dev)
 {
         /* this IRQ is shared with DBGU and other hardware which isn't
@@ -464,21 +477,42 @@ static int at91_rtc_suspend(struct device *dev)
         at91_rtc_imr = at91_rtc_read_imr()
                         & (AT91_RTC_ALARM|AT91_RTC_SECEV);
         if (at91_rtc_imr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
+                        unsigned long flags;
+
                         enable_irq_wake(irq);
-                else
+
+                        spin_lock_irqsave(&suspended_lock, flags);
+                        suspended = true;
+                        spin_unlock_irqrestore(&suspended_lock, flags);
+                } else {
                         at91_rtc_write_idr(at91_rtc_imr);
+                }
         }
         return 0;
 }
 
 static int at91_rtc_resume(struct device *dev)
 {
+        struct rtc_device *rtc = dev_get_drvdata(dev);
+
         if (at91_rtc_imr) {
-                if (device_may_wakeup(dev))
+                if (device_may_wakeup(dev)) {
+                        unsigned long flags;
+
+                        spin_lock_irqsave(&suspended_lock, flags);
+
+                        if (cached_events) {
+                                rtc_update_irq(rtc, 1, cached_events);
+                                cached_events = 0;
+                        }
+
+                        suspended = false;
+                        spin_unlock_irqrestore(&suspended_lock, flags);
+
                         disable_irq_wake(irq);
-                else
-                        at91_rtc_write_ier(at91_rtc_imr);
+                }
+                at91_rtc_write_ier(at91_rtc_imr);
         }
         return 0;
 }
diff --git a/drivers/rtc/rtc-at91sam9.c b/drivers/rtc/rtc-at91sam9.c
index 2183fd2750ab..5ccaee32df72 100644
--- a/drivers/rtc/rtc-at91sam9.c
+++ b/drivers/rtc/rtc-at91sam9.c
@@ -23,6 +23,7 @@
 #include <linux/io.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
+#include <linux/suspend.h>
 #include <linux/clk.h>
 
 /*
@@ -77,6 +78,9 @@ struct sam9_rtc {
         unsigned int            gpbr_offset;
         int                     irq;
         struct clk              *sclk;
+        bool                    suspended;
+        unsigned long           events;
+        spinlock_t              lock;
 };
 
 #define rtt_readl(rtc, field) \
@@ -271,14 +275,9 @@ static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
         return 0;
 }
 
-/*
- * IRQ handler for the RTC
- */
-static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
+static irqreturn_t at91_rtc_cache_events(struct sam9_rtc *rtc)
 {
-        struct sam9_rtc *rtc = _rtc;
         u32 sr, mr;
-        unsigned long events = 0;
 
         /* Shared interrupt may be for another device.  Note: reading
          * SR clears it, so we must only read it in this irq handler!
@@ -290,18 +289,54 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
 
         /* alarm status */
         if (sr & AT91_RTT_ALMS)
-                events |= (RTC_AF | RTC_IRQF);
+                rtc->events |= (RTC_AF | RTC_IRQF);
 
         /* timer update/increment */
         if (sr & AT91_RTT_RTTINC)
-                events |= (RTC_UF | RTC_IRQF);
+                rtc->events |= (RTC_UF | RTC_IRQF);
+
+        return IRQ_HANDLED;
+}
+
+static void at91_rtc_flush_events(struct sam9_rtc *rtc)
+{
+        if (!rtc->events)
+                return;
 
-        rtc_update_irq(rtc->rtcdev, 1, events);
+        rtc_update_irq(rtc->rtcdev, 1, rtc->events);
+        rtc->events = 0;
 
         pr_debug("%s: num=%ld, events=0x%02lx\n", __func__,
-                events >> 8, events & 0x000000FF);
+                rtc->events >> 8, rtc->events & 0x000000FF);
+}
 
-        return IRQ_HANDLED;
+/*
+ * IRQ handler for the RTC
+ */
+static irqreturn_t at91_rtc_interrupt(int irq, void *_rtc)
+{
+        struct sam9_rtc *rtc = _rtc;
+        int ret;
+
+        spin_lock(&rtc->lock);
+
+        ret = at91_rtc_cache_events(rtc);
+
+        /* We're called in suspended state */
+        if (rtc->suspended) {
+                /* Mask irqs coming from this peripheral */
+                rtt_writel(rtc, MR,
+                           rtt_readl(rtc, MR) &
+                           ~(AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN));
+                /* Trigger a system wakeup */
+                pm_system_wakeup();
+        } else {
+                at91_rtc_flush_events(rtc);
+        }
+
+        spin_unlock(&rtc->lock);
+
+        return ret;
 }
 
 static const struct rtc_class_ops at91_rtc_ops = {
@@ -421,7 +456,8 @@ static int at91_rtc_probe(struct platform_device *pdev)
 
         /* register irq handler after we know what name we'll use */
         ret = devm_request_irq(&pdev->dev, rtc->irq, at91_rtc_interrupt,
-                                IRQF_SHARED, dev_name(&rtc->rtcdev->dev), rtc);
+                               IRQF_SHARED | IRQF_COND_SUSPEND,
+                               dev_name(&rtc->rtcdev->dev), rtc);
         if (ret) {
                 dev_dbg(&pdev->dev, "can't share IRQ %d?\n", rtc->irq);
                 return ret;
@@ -482,7 +518,12 @@ static int at91_rtc_suspend(struct device *dev)
         rtc->imr = mr & (AT91_RTT_ALMIEN | AT91_RTT_RTTINCIEN);
         if (rtc->imr) {
                 if (device_may_wakeup(dev) && (mr & AT91_RTT_ALMIEN)) {
+                        unsigned long flags;
+
                         enable_irq_wake(rtc->irq);
+                        spin_lock_irqsave(&rtc->lock, flags);
+                        rtc->suspended = true;
+                        spin_unlock_irqrestore(&rtc->lock, flags);
                         /* don't let RTTINC cause wakeups */
                         if (mr & AT91_RTT_RTTINCIEN)
                                 rtt_writel(rtc, MR, mr & ~AT91_RTT_RTTINCIEN);
@@ -499,10 +540,18 @@ static int at91_rtc_resume(struct device *dev)
         u32             mr;
 
         if (rtc->imr) {
+                unsigned long flags;
+
                 if (device_may_wakeup(dev))
                         disable_irq_wake(rtc->irq);
                 mr = rtt_readl(rtc, MR);
                 rtt_writel(rtc, MR, mr | rtc->imr);
+
+                spin_lock_irqsave(&rtc->lock, flags);
+                rtc->suspended = false;
+                at91_rtc_cache_events(rtc);
+                at91_rtc_flush_events(rtc);
+                spin_unlock_irqrestore(&rtc->lock, flags);
         }
 
         return 0;
diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c
index 8c3bfcb115b7..803869c7d7c2 100644
--- a/drivers/rtc/rtc-ds1685.c
+++ b/drivers/rtc/rtc-ds1685.c
@@ -399,21 +399,21 @@ ds1685_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
          * of this RTC chip.  We check for it anyways in case support is
          * added in the future.
          */
-        if (unlikely((seconds >= 0xc0) && (seconds <= 0xff)))
+        if (unlikely(seconds >= 0xc0))
                 alrm->time.tm_sec = -1;
         else
                 alrm->time.tm_sec = ds1685_rtc_bcd2bin(rtc, seconds,
                                                        RTC_SECS_BCD_MASK,
                                                        RTC_SECS_BIN_MASK);
 
-        if (unlikely((minutes >= 0xc0) && (minutes <= 0xff)))
+        if (unlikely(minutes >= 0xc0))
                 alrm->time.tm_min = -1;
         else
                 alrm->time.tm_min = ds1685_rtc_bcd2bin(rtc, minutes,
                                                        RTC_MINS_BCD_MASK,
                                                        RTC_MINS_BIN_MASK);
 
-        if (unlikely((hours >= 0xc0) && (hours <= 0xff)))
+        if (unlikely(hours >= 0xc0))
                 alrm->time.tm_hour = -1;
         else
                 alrm->time.tm_hour = ds1685_rtc_bcd2bin(rtc, hours,
@@ -472,13 +472,13 @@ ds1685_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
          * field, and we only support four fields.  We put the support
          * here anyways for the future.
          */
-        if (unlikely((seconds >= 0xc0) && (seconds <= 0xff)))
+        if (unlikely(seconds >= 0xc0))
                 seconds = 0xff;
 
-        if (unlikely((minutes >= 0xc0) && (minutes <= 0xff)))
+        if (unlikely(minutes >= 0xc0))
                 minutes = 0xff;
 
-        if (unlikely((hours >= 0xc0) && (hours <= 0xff)))
+        if (unlikely(hours >= 0xc0))
                 hours = 0xff;
 
         alrm->time.tm_mon       = -1;
@@ -528,7 +528,6 @@ ds1685_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 /* ----------------------------------------------------------------------- */
 /* /dev/rtcX Interface functions */
 
-#ifdef CONFIG_RTC_INTF_DEV
 /**
  * ds1685_rtc_alarm_irq_enable - replaces ioctl() RTC_AIE on/off.
  * @dev: pointer to device structure.
@@ -557,7 +556,6 @@ ds1685_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 
         return 0;
 }
-#endif
 /* ----------------------------------------------------------------------- */
 
 
@@ -1612,7 +1610,7 @@ ds1685_rtc_sysfs_time_regs_show(struct device *dev,
                 ds1685_rtc_sysfs_time_regs_lookup(attr->attr.name, false);
 
         /* Make sure we actually matched something. */
-        if (!bcd_reg_info && !bin_reg_info)
+        if (!bcd_reg_info || !bin_reg_info)
                 return -EINVAL;
 
         /* bcd_reg_info->reg == bin_reg_info->reg. */
@@ -1650,7 +1648,7 @@ ds1685_rtc_sysfs_time_regs_store(struct device *dev,
                 return -EINVAL;
 
         /* Make sure we actually matched something. */
-        if (!bcd_reg_info && !bin_reg_info)
+        if (!bcd_reg_info || !bin_reg_info)
                 return -EINVAL;
 
         /* Check for a valid range. */
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 96128cb009f3..da212813f2d5 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
          * parse input
          */
         num_of_segments = 0;
-        for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
+        for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
                 for (j = i; (buf[j] != ':') &&
                         (buf[j] != '\0') &&
                         (buf[j] != '\n') &&
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
index 09db45296eed..7497ddde2dd6 100644
--- a/drivers/s390/block/scm_blk_cluster.c
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -92,7 +92,7 @@ bool scm_reserve_cluster(struct scm_request *scmrq)
                         add = 0;
                         continue;
                 }
-                for (pos = 0; pos <= iter->aob->request.msb_count; pos++) {
+                for (pos = 0; pos < iter->aob->request.msb_count; pos++) {
                         if (clusters_intersect(req, iter->request[pos]) &&
                             (rq_data_dir(req) == WRITE ||
                              rq_data_dir(iter->request[pos]) == WRITE)) {
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index f3ee439d6f0e..cd4c293f0dd0 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -81,7 +81,9 @@ static int __init sh_pm_runtime_init(void)
                 if (!of_machine_is_compatible("renesas,emev2") &&
                     !of_machine_is_compatible("renesas,r7s72100") &&
                     !of_machine_is_compatible("renesas,r8a73a4") &&
+#ifndef CONFIG_PM_GENERIC_DOMAINS_OF
                     !of_machine_is_compatible("renesas,r8a7740") &&
+#endif
                     !of_machine_is_compatible("renesas,r8a7778") &&
                     !of_machine_is_compatible("renesas,r8a7779") &&
                     !of_machine_is_compatible("renesas,r8a7790") &&
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 9af7841f2e8c..06de34001c66 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -764,17 +764,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
                         (unsigned long long)xfer->rx_dma);
         }
 
-        /* REVISIT: We're waiting for ENDRX before we start the next
+        /* REVISIT: We're waiting for RXBUFF before we start the next
          * transfer because we need to handle some difficult timing
-         * issues otherwise. If we wait for ENDTX in one transfer and
-         * then starts waiting for ENDRX in the next, it's difficult
-         * to tell the difference between the ENDRX interrupt we're
-         * actually waiting for and the ENDRX interrupt of the
+         * issues otherwise. If we wait for TXBUFE in one transfer and
+         * then starts waiting for RXBUFF in the next, it's difficult
+         * to tell the difference between the RXBUFF interrupt we're
+         * actually waiting for and the RXBUFF interrupt of the
          * previous transfer.
          *
          * It should be doable, though. Just not now...
          */
-        spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
+        spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
         spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
 }
 
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index a0197fd4e95c..3ce39d10fafb 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -139,6 +139,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
                                 1,
                                 DMA_MEM_TO_DEV,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        if (!txdesc)
+                return NULL;
+
         txdesc->callback = dw_spi_dma_tx_done;
         txdesc->callback_param = dws;
 
@@ -184,6 +187,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
                                 1,
                                 DMA_DEV_TO_MEM,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        if (!rxdesc)
+                return NULL;
+
         rxdesc->callback = dw_spi_dma_rx_done;
         rxdesc->callback_param = dws;
 
diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index 5ba331047cbe..6d331e0db331 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -36,13 +36,13 @@ struct spi_pci_desc {
 
 static struct spi_pci_desc spi_pci_mid_desc_1 = {
         .setup = dw_spi_mid_init,
-        .num_cs = 32,
+        .num_cs = 5,
         .bus_num = 0,
 };
 
 static struct spi_pci_desc spi_pci_mid_desc_2 = {
         .setup = dw_spi_mid_init,
-        .num_cs = 4,
+        .num_cs = 2,
         .bus_num = 1,
 };
 
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 5a97a62b298a..4847afba89f4 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -621,14 +621,14 @@ static void spi_hw_init(struct device *dev, struct dw_spi *dws)
         if (!dws->fifo_len) {
                 u32 fifo;
 
-                for (fifo = 2; fifo <= 256; fifo++) {
+                for (fifo = 1; fifo < 256; fifo++) {
                         dw_writew(dws, DW_SPI_TXFLTR, fifo);
                         if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
                                 break;
                 }
                 dw_writew(dws, DW_SPI_TXFLTR, 0);
 
-                dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
+                dws->fifo_len = (fifo == 1) ? 0 : fifo;
                 dev_dbg(dev, "Detected FIFO size: %u bytes\n", dws->fifo_len);
         }
 }
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index c01567d53581..e649bc7d4c08 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -459,6 +459,13 @@ static int img_spfi_transfer_one(struct spi_master *master,
         unsigned long flags;
         int ret;
 
+        if (xfer->len > SPFI_TRANSACTION_TSIZE_MASK) {
+                dev_err(spfi->dev,
+                        "Transfer length (%d) is greater than the max supported (%d)",
+                        xfer->len, SPFI_TRANSACTION_TSIZE_MASK);
+                return -EINVAL;
+        }
+
         /*
          * Stop all DMA and reset the controller if the previous transaction
          * timed-out and never completed it's DMA.
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 89ca162801da..ee513a85296b 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022)
         pl022->cur_msg = NULL;
         pl022->cur_transfer = NULL;
         pl022->cur_chip = NULL;
-        spi_finalize_current_message(pl022->master);
 
         /* disable the SPI/SSP operation */
         writew((readw(SSP_CR1(pl022->virtbase)) &
                 (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
 
+        spi_finalize_current_message(pl022->master);
 }
 
 /**
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 884a716e50cb..5c0616870358 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -101,6 +101,7 @@ struct ti_qspi {
 #define QSPI_FLEN(n)                    ((n - 1) << 0)
 
 /* STATUS REGISTER */
+#define BUSY                            0x01
 #define WC                              0x02
 
 /* INTERRUPT REGISTER */
@@ -199,6 +200,21 @@ static void ti_qspi_restore_ctx(struct ti_qspi *qspi)
         ti_qspi_write(qspi, ctx_reg->clkctrl, QSPI_SPI_CLOCK_CNTRL_REG);
 }
 
+static inline u32 qspi_is_busy(struct ti_qspi *qspi)
+{
+        u32 stat;
+        unsigned long timeout = jiffies + QSPI_COMPLETION_TIMEOUT;
+
+        stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
+        while ((stat & BUSY) && time_after(timeout, jiffies)) {
+                cpu_relax();
+                stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
+        }
+
+        WARN(stat & BUSY, "qspi busy\n");
+        return stat & BUSY;
+}
+
 static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 {
         int wlen, count;
@@ -211,6 +227,9 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
         wlen = t->bits_per_word >> 3;   /* in bytes */
 
         while (count) {
+                if (qspi_is_busy(qspi))
+                        return -EBUSY;
+
                 switch (wlen) {
                 case 1:
                         dev_dbg(qspi->dev, "tx cmd %08x dc %08x data %02x\n",
@@ -266,6 +285,9 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 
         while (count) {
                 dev_dbg(qspi->dev, "rx cmd %08x dc %08x\n", cmd, qspi->dc);
+                if (qspi_is_busy(qspi))
+                        return -EBUSY;
+
                 ti_qspi_write(qspi, cmd, QSPI_SPI_CMD_REG);
                 if (!wait_for_completion_timeout(&qspi->transfer_complete,
                                                  QSPI_COMPLETION_TIMEOUT)) {
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 9800c01e6fb9..3f72451d2de0 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -426,7 +426,6 @@ static int pci171x_ai_insn_read(struct comedi_device *dev,
                                 unsigned int *data)
 {
         struct pci1710_private *devpriv = dev->private;
-        unsigned int chan = CR_CHAN(insn->chanspec);
         int ret = 0;
         int i;
 
@@ -447,7 +446,7 @@ static int pci171x_ai_insn_read(struct comedi_device *dev,
                 if (ret)
                         break;
 
-                ret = pci171x_ai_read_sample(dev, s, chan, &val);
+                ret = pci171x_ai_read_sample(dev, s, 0, &val);
                 if (ret)
                         break;
 
diff --git a/drivers/staging/comedi/drivers/comedi_isadma.c b/drivers/staging/comedi/drivers/comedi_isadma.c
index dbdea71d6b95..e856f01ca077 100644
--- a/drivers/staging/comedi/drivers/comedi_isadma.c
+++ b/drivers/staging/comedi/drivers/comedi_isadma.c
@@ -91,9 +91,10 @@ unsigned int comedi_isadma_disable_on_sample(unsigned int dma_chan,
                         stalled++;
                         if (stalled > 10)
                                 break;
+                } else {
+                        residue = new_residue;
+                        stalled = 0;
                 }
-                residue = new_residue;
-                stalled = 0;
         }
         return residue;
 }
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index e37118321a27..a0906685e27f 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -103,11 +103,6 @@ enum vmk80xx_model {
         VMK8061_MODEL
 };
 
-struct firmware_version {
-        unsigned char ic3_vers[32];     /* USB-Controller */
-        unsigned char ic6_vers[32];     /* CPU */
-};
-
 static const struct comedi_lrange vmk8061_range = {
         2, {
                 UNI_RANGE(5),
@@ -156,68 +151,12 @@ static const struct vmk80xx_board vmk80xx_boardinfo[] = {
 struct vmk80xx_private {
         struct usb_endpoint_descriptor *ep_rx;
         struct usb_endpoint_descriptor *ep_tx;
-        struct firmware_version fw;
         struct semaphore limit_sem;
         unsigned char *usb_rx_buf;
         unsigned char *usb_tx_buf;
         enum vmk80xx_model model;
 };
 
-static int vmk80xx_check_data_link(struct comedi_device *dev)
-{
-        struct vmk80xx_private *devpriv = dev->private;
-        struct usb_device *usb = comedi_to_usb_dev(dev);
-        unsigned int tx_pipe;
-        unsigned int rx_pipe;
-        unsigned char tx[1];
-        unsigned char rx[2];
-
-        tx_pipe = usb_sndbulkpipe(usb, 0x01);
-        rx_pipe = usb_rcvbulkpipe(usb, 0x81);
-
-        tx[0] = VMK8061_CMD_RD_PWR_STAT;
-
-        /*
-         * Check that IC6 (PIC16F871) is powered and
-         * running and the data link between IC3 and
-         * IC6 is working properly
-         */
-        usb_bulk_msg(usb, tx_pipe, tx, 1, NULL, devpriv->ep_tx->bInterval);
-        usb_bulk_msg(usb, rx_pipe, rx, 2, NULL, HZ * 10);
-
-        return (int)rx[1];
-}
-
-static void vmk80xx_read_eeprom(struct comedi_device *dev, int flag)
-{
-        struct vmk80xx_private *devpriv = dev->private;
-        struct usb_device *usb = comedi_to_usb_dev(dev);
-        unsigned int tx_pipe;
-        unsigned int rx_pipe;
-        unsigned char tx[1];
-        unsigned char rx[64];
-        int cnt;
-
-        tx_pipe = usb_sndbulkpipe(usb, 0x01);
-        rx_pipe = usb_rcvbulkpipe(usb, 0x81);
-
-        tx[0] = VMK8061_CMD_RD_VERSION;
-
-        /*
-         * Read the firmware version info of IC3 and
-         * IC6 from the internal EEPROM of the IC
-         */
-        usb_bulk_msg(usb, tx_pipe, tx, 1, NULL, devpriv->ep_tx->bInterval);
-        usb_bulk_msg(usb, rx_pipe, rx, 64, &cnt, HZ * 10);
-
-        rx[cnt] = '\0';
-
-        if (flag & IC3_VERSION)
-                strncpy(devpriv->fw.ic3_vers, rx + 1, 24);
-        else                    /* IC6_VERSION */
-                strncpy(devpriv->fw.ic6_vers, rx + 25, 24);
-}
-
 static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
 {
         struct vmk80xx_private *devpriv = dev->private;
@@ -878,16 +817,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
 
         usb_set_intfdata(intf, devpriv);
 
-        if (devpriv->model == VMK8061_MODEL) {
-                vmk80xx_read_eeprom(dev, IC3_VERSION);
-                dev_info(&intf->dev, "%s\n", devpriv->fw.ic3_vers);
-
-                if (vmk80xx_check_data_link(dev)) {
-                        vmk80xx_read_eeprom(dev, IC6_VERSION);
-                        dev_info(&intf->dev, "%s\n", devpriv->fw.ic6_vers);
-                }
-        }
-
         if (devpriv->model == VMK8055_MODEL)
                 vmk80xx_reset_device(dev);
 
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index d9d6fad7cb00..816174388f13 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -214,11 +214,17 @@ struct mxs_lradc {
         unsigned long           is_divided;
 
         /*
-         * Touchscreen LRADC channels receives a private slot in the CTRL4
-         * register, the slot #7. Therefore only 7 slots instead of 8 in the
-         * CTRL4 register can be mapped to LRADC channels when using the
-         * touchscreen.
-         *
+         * When the touchscreen is enabled, we give it two private virtual
+         * channels: #6 and #7. This means that only 6 virtual channels (instead
+         * of 8) will be available for buffered capture.
+         */
+#define TOUCHSCREEN_VCHANNEL1           7
+#define TOUCHSCREEN_VCHANNEL2           6
+#define BUFFER_VCHANS_LIMITED           0x3f
+#define BUFFER_VCHANS_ALL               0xff
+        u8                      buffer_vchans;
+
+        /*
          * Furthermore, certain LRADC channels are shared between touchscreen
          * and/or touch-buttons and generic LRADC block. Therefore when using
          * either of these, these channels are not available for the regular
@@ -342,6 +348,9 @@ struct mxs_lradc {
 #define LRADC_CTRL4                             0x140
 #define LRADC_CTRL4_LRADCSELECT_MASK(n)         (0xf << ((n) * 4))
 #define LRADC_CTRL4_LRADCSELECT_OFFSET(n)       ((n) * 4)
+#define LRADC_CTRL4_LRADCSELECT(n, x) \
+                                (((x) << LRADC_CTRL4_LRADCSELECT_OFFSET(n)) & \
+                                LRADC_CTRL4_LRADCSELECT_MASK(n))
 
 #define LRADC_RESOLUTION                        12
 #define LRADC_SINGLE_SAMPLE_MASK                ((1 << LRADC_RESOLUTION) - 1)
@@ -416,6 +425,14 @@ static bool mxs_lradc_check_touch_event(struct mxs_lradc *lradc)
                                         LRADC_STATUS_TOUCH_DETECT_RAW);
 }
 
+static void mxs_lradc_map_channel(struct mxs_lradc *lradc, unsigned vch,
+                                  unsigned ch)
+{
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(vch),
+                                LRADC_CTRL4);
+        mxs_lradc_reg_set(lradc, LRADC_CTRL4_LRADCSELECT(vch, ch), LRADC_CTRL4);
+}
+
 static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
 {
         /*
@@ -450,12 +467,8 @@ static void mxs_lradc_setup_ts_channel(struct mxs_lradc *lradc, unsigned ch)
                 LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
                         LRADC_DELAY(3));
 
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-                        LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-                        LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch), LRADC_CTRL1);
 
-        /* wake us again, when the complete conversion is done */
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch), LRADC_CTRL1);
         /*
          * after changing the touchscreen plates setting
          * the signals need some initial time to settle. Start the
@@ -509,12 +522,8 @@ static void mxs_lradc_setup_ts_pressure(struct mxs_lradc *lradc, unsigned ch1,
                 LRADC_DELAY_DELAY(lradc->over_sample_delay - 1),
                                         LRADC_DELAY(3));
 
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(2) |
-                        LRADC_CTRL1_LRADC_IRQ(3) | LRADC_CTRL1_LRADC_IRQ(4) |
-                        LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(ch2), LRADC_CTRL1);
 
-        /* wake us again, when the conversions are done */
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(ch2), LRADC_CTRL1);
         /*
          * after changing the touchscreen plates setting
          * the signals need some initial time to settle. Start the
@@ -580,36 +589,6 @@ static unsigned mxs_lradc_read_ts_pressure(struct mxs_lradc *lradc,
 #define TS_CH_XM 4
 #define TS_CH_YM 5
 
-static int mxs_lradc_read_ts_channel(struct mxs_lradc *lradc)
-{
-        u32 reg;
-        int val;
-
-        reg = readl(lradc->base + LRADC_CTRL1);
-
-        /* only channels 3 to 5 are of interest here */
-        if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YP)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YP) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_YP), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_YP);
-        } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_XM)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_XM) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_XM), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_XM);
-        } else if (reg & LRADC_CTRL1_LRADC_IRQ(TS_CH_YM)) {
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(TS_CH_YM) |
-                        LRADC_CTRL1_LRADC_IRQ(TS_CH_YM), LRADC_CTRL1);
-                val = mxs_lradc_read_raw_channel(lradc, TS_CH_YM);
-        } else {
-                return -EIO;
-        }
-
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
-
-        return val;
-}
-
 /*
  * YP(open)--+-------------+
  *           |             |--+
@@ -653,7 +632,8 @@ static void mxs_lradc_prepare_x_pos(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_x_plate(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_X;
-        mxs_lradc_setup_ts_channel(lradc, TS_CH_YP);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YP);
+        mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@@ -674,7 +654,8 @@ static void mxs_lradc_prepare_y_pos(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_y_plate(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_Y;
-        mxs_lradc_setup_ts_channel(lradc, TS_CH_XM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_XM);
+        mxs_lradc_setup_ts_channel(lradc, TOUCHSCREEN_VCHANNEL1);
 }
 
 /*
@@ -695,7 +676,10 @@ static void mxs_lradc_prepare_pressure(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, mxs_lradc_drive_pressure(lradc), LRADC_CTRL0);
 
         lradc->cur_plate = LRADC_SAMPLE_PRESSURE;
-        mxs_lradc_setup_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL1, TS_CH_YM);
+        mxs_lradc_map_channel(lradc, TOUCHSCREEN_VCHANNEL2, TS_CH_XP);
+        mxs_lradc_setup_ts_pressure(lradc, TOUCHSCREEN_VCHANNEL2,
+                                                TOUCHSCREEN_VCHANNEL1);
 }
 
 static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
@@ -708,6 +692,19 @@ static void mxs_lradc_enable_touch_detection(struct mxs_lradc *lradc)
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
+static void mxs_lradc_start_touch_event(struct mxs_lradc *lradc)
+{
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
+                                LRADC_CTRL1);
+        mxs_lradc_reg_set(lradc,
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
+        /*
+         * start with the Y-pos, because it uses nearly the same plate
+         * settings like the touch detection
+         */
+        mxs_lradc_prepare_y_pos(lradc);
+}
+
 static void mxs_lradc_report_ts_event(struct mxs_lradc *lradc)
 {
         input_report_abs(lradc->ts_input, ABS_X, lradc->ts_x_pos);
@@ -725,10 +722,12 @@ static void mxs_lradc_complete_touch_event(struct mxs_lradc *lradc)
          * start a dummy conversion to burn time to settle the signals
          * note: we are not interested in the conversion's value
          */
-        mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(5));
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ(5), LRADC_CTRL1);
-        mxs_lradc_reg_set(lradc, LRADC_CTRL1_LRADC_IRQ_EN(5), LRADC_CTRL1);
-        mxs_lradc_reg_wrt(lradc, LRADC_DELAY_TRIGGER(1 << 5) |
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_CH(TOUCHSCREEN_VCHANNEL1));
+        mxs_lradc_reg_clear(lradc,
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
+        mxs_lradc_reg_wrt(lradc,
+                LRADC_DELAY_TRIGGER(1 << TOUCHSCREEN_VCHANNEL1) |
                 LRADC_DELAY_KICK | LRADC_DELAY_DELAY(10), /* waste 5 ms */
                         LRADC_DELAY(2));
 }
@@ -760,59 +759,45 @@ static void mxs_lradc_finish_touch_event(struct mxs_lradc *lradc, bool valid)
 
         /* if it is released, wait for the next touch via IRQ */
         lradc->cur_plate = LRADC_TOUCH;
-        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ, LRADC_CTRL1);
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(2));
+        mxs_lradc_reg_wrt(lradc, 0, LRADC_DELAY(3));
+        mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ |
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1), LRADC_CTRL1);
         mxs_lradc_reg_set(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN, LRADC_CTRL1);
 }
 
 /* touchscreen's state machine */
 static void mxs_lradc_handle_touch(struct mxs_lradc *lradc)
 {
-        int val;
-
         switch (lradc->cur_plate) {
         case LRADC_TOUCH:
-                /*
-                 * start with the Y-pos, because it uses nearly the same plate
-                 * settings like the touch detection
-                 */
-                if (mxs_lradc_check_touch_event(lradc)) {
-                        mxs_lradc_reg_clear(lradc,
-                                        LRADC_CTRL1_TOUCH_DETECT_IRQ_EN,
-                                        LRADC_CTRL1);
-                        mxs_lradc_prepare_y_pos(lradc);
-                }
+                if (mxs_lradc_check_touch_event(lradc))
+                        mxs_lradc_start_touch_event(lradc);
                 mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ,
                                         LRADC_CTRL1);
                 return;
 
         case LRADC_SAMPLE_Y:
-                val = mxs_lradc_read_ts_channel(lradc);
-                if (val < 0) {
-                        mxs_lradc_enable_touch_detection(lradc); /* re-start */
-                        return;
-                }
-                lradc->ts_y_pos = val;
+                lradc->ts_y_pos = mxs_lradc_read_raw_channel(lradc,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_prepare_x_pos(lradc);
                 return;
 
         case LRADC_SAMPLE_X:
-                val = mxs_lradc_read_ts_channel(lradc);
-                if (val < 0) {
-                        mxs_lradc_enable_touch_detection(lradc); /* re-start */
-                        return;
-                }
-                lradc->ts_x_pos = val;
+                lradc->ts_x_pos = mxs_lradc_read_raw_channel(lradc,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_prepare_pressure(lradc);
                 return;
 
         case LRADC_SAMPLE_PRESSURE:
-                lradc->ts_pressure =
-                        mxs_lradc_read_ts_pressure(lradc, TS_CH_XP, TS_CH_YM);
+                lradc->ts_pressure = mxs_lradc_read_ts_pressure(lradc,
+                                                        TOUCHSCREEN_VCHANNEL2,
+                                                        TOUCHSCREEN_VCHANNEL1);
                 mxs_lradc_complete_touch_event(lradc);
                 return;
 
         case LRADC_SAMPLE_VALID:
-                val = mxs_lradc_read_ts_channel(lradc); /* ignore the value */
                 mxs_lradc_finish_touch_event(lradc, 1);
                 break;
         }
@@ -844,9 +829,9 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val)
          * used if doing raw sampling.
          */
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
+                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_LRADC_IRQ_EN(0),
                         LRADC_CTRL1);
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+        mxs_lradc_reg_clear(lradc, 0x1, LRADC_CTRL0);
 
         /* Enable / disable the divider per requirement */
         if (test_bit(chan, &lradc->is_divided))
@@ -1090,9 +1075,8 @@ static void mxs_lradc_disable_ts(struct mxs_lradc *lradc)
 {
         /* stop all interrupts from firing */
         mxs_lradc_reg_clear(lradc, LRADC_CTRL1_TOUCH_DETECT_IRQ_EN |
-                LRADC_CTRL1_LRADC_IRQ_EN(2) | LRADC_CTRL1_LRADC_IRQ_EN(3) |
-                LRADC_CTRL1_LRADC_IRQ_EN(4) | LRADC_CTRL1_LRADC_IRQ_EN(5),
-                LRADC_CTRL1);
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ_EN(TOUCHSCREEN_VCHANNEL2), LRADC_CTRL1);
 
         /* Power-down touchscreen touch-detect circuitry. */
         mxs_lradc_reg_clear(lradc, mxs_lradc_plate_mask(lradc), LRADC_CTRL0);
@@ -1158,26 +1142,31 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data)
         struct iio_dev *iio = data;
         struct mxs_lradc *lradc = iio_priv(iio);
         unsigned long reg = readl(lradc->base + LRADC_CTRL1);
+        uint32_t clr_irq = mxs_lradc_irq_mask(lradc);
         const uint32_t ts_irq_mask =
                 LRADC_CTRL1_TOUCH_DETECT_IRQ |
-                LRADC_CTRL1_LRADC_IRQ(2) |
-                LRADC_CTRL1_LRADC_IRQ(3) |
-                LRADC_CTRL1_LRADC_IRQ(4) |
-                LRADC_CTRL1_LRADC_IRQ(5);
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2);
 
         if (!(reg & mxs_lradc_irq_mask(lradc)))
                 return IRQ_NONE;
 
-        if (lradc->use_touchscreen && (reg & ts_irq_mask))
+        if (lradc->use_touchscreen && (reg & ts_irq_mask)) {
                 mxs_lradc_handle_touch(lradc);
 
-        if (iio_buffer_enabled(iio))
-                iio_trigger_poll(iio->trig);
-        else if (reg & LRADC_CTRL1_LRADC_IRQ(0))
+                /* Make sure we don't clear the next conversion's interrupt. */
+                clr_irq &= ~(LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL1) |
+                                LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
+        }
+
+        if (iio_buffer_enabled(iio)) {
+                if (reg & lradc->buffer_vchans)
+                        iio_trigger_poll(iio->trig);
+        } else if (reg & LRADC_CTRL1_LRADC_IRQ(0)) {
                 complete(&lradc->completion);
+        }
 
-        mxs_lradc_reg_clear(lradc, reg & mxs_lradc_irq_mask(lradc),
-                        LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, reg & clr_irq, LRADC_CTRL1);
 
         return IRQ_HANDLED;
 }
@@ -1289,9 +1278,10 @@ static int mxs_lradc_buffer_preenable(struct iio_dev *iio)
         }
 
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-                                                        LRADC_CTRL1);
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+                mxs_lradc_reg_clear(lradc,
+                        lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+                        LRADC_CTRL1);
+        mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
 
         for_each_set_bit(chan, iio->active_scan_mask, LRADC_MAX_TOTAL_CHANS) {
                 ctrl4_set |= chan << LRADC_CTRL4_LRADCSELECT_OFFSET(ofs);
@@ -1324,10 +1314,11 @@ static int mxs_lradc_buffer_postdisable(struct iio_dev *iio)
         mxs_lradc_reg_clear(lradc, LRADC_DELAY_TRIGGER_LRADCS_MASK |
                                         LRADC_DELAY_KICK, LRADC_DELAY(0));
 
-        mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+        mxs_lradc_reg_clear(lradc, lradc->buffer_vchans, LRADC_CTRL0);
         if (lradc->soc == IMX28_LRADC)
-                mxs_lradc_reg_clear(lradc, LRADC_CTRL1_MX28_LRADC_IRQ_EN_MASK,
-                                        LRADC_CTRL1);
+                mxs_lradc_reg_clear(lradc,
+                        lradc->buffer_vchans << LRADC_CTRL1_LRADC_IRQ_EN_OFFSET,
+                        LRADC_CTRL1);
 
         kfree(lradc->buffer);
         mutex_unlock(&lradc->lock);
@@ -1353,7 +1344,7 @@ static bool mxs_lradc_validate_scan_mask(struct iio_dev *iio,
         if (lradc->use_touchbutton)
                 rsvd_chans++;
         if (lradc->use_touchscreen)
-                rsvd_chans++;
+                rsvd_chans += 2;
 
         /* Test for attempts to map channels with special mode of operation. */
         if (bitmap_intersects(mask, &rsvd_mask, LRADC_MAX_TOTAL_CHANS))
@@ -1413,6 +1404,13 @@ static const struct iio_chan_spec mxs_lradc_chan_spec[] = {
                 .channel = 8,
                 .scan_type = {.sign = 'u', .realbits = 18, .storagebits = 32,},
         },
+        /* Hidden channel to keep indexes */
+        {
+                .type = IIO_TEMP,
+                .indexed = 1,
+                .scan_index = -1,
+                .channel = 9,
+        },
         MXS_ADC_CHAN(10, IIO_VOLTAGE),  /* VDDIO */
         MXS_ADC_CHAN(11, IIO_VOLTAGE),  /* VTH */
         MXS_ADC_CHAN(12, IIO_VOLTAGE),  /* VDDA */
@@ -1583,6 +1581,11 @@ static int mxs_lradc_probe(struct platform_device *pdev)
 
         touch_ret = mxs_lradc_probe_touchscreen(lradc, node);
 
+        if (touch_ret == 0)
+                lradc->buffer_vchans = BUFFER_VCHANS_LIMITED;
+        else
+                lradc->buffer_vchans = BUFFER_VCHANS_ALL;
+
         /* Grab all IRQ sources */
         for (i = 0; i < of_cfg->irq_count; i++) {
                 lradc->irq[i] = platform_get_irq(pdev, i);
diff --git a/drivers/staging/iio/resolver/ad2s1200.c b/drivers/staging/iio/resolver/ad2s1200.c
index 017d2f8379b7..c17893b4918c 100644
--- a/drivers/staging/iio/resolver/ad2s1200.c
+++ b/drivers/staging/iio/resolver/ad2s1200.c
@@ -18,6 +18,7 @@
 #include <linux/delay.h>
 #include <linux/gpio.h>
 #include <linux/module.h>
+#include <linux/bitops.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/sysfs.h>
@@ -68,7 +69,7 @@ static int ad2s1200_read_raw(struct iio_dev *indio_dev,
                 break;
         case IIO_ANGL_VEL:
                 vel = (((s16)(st->rx[0])) << 4) | ((st->rx[1] & 0xF0) >> 4);
-                vel = (vel << 4) >> 4;
+                vel = sign_extend32(vel, 11);
                 *val = vel;
                 break;
         default:
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
index 25d244cbbe8f..031018e7a65b 100644
--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -262,13 +262,12 @@ static int int3400_thermal_probe(struct platform_device *pdev)
         result = acpi_parse_art(priv->adev->handle, &priv->art_count,
                                 &priv->arts, true);
         if (result)
-                goto free_priv;
-
+                dev_dbg(&pdev->dev, "_ART table parsing error\n");
 
         result = acpi_parse_trt(priv->adev->handle, &priv->trt_count,
                                 &priv->trts, true);
         if (result)
-                goto free_art;
+                dev_dbg(&pdev->dev, "_TRT table parsing error\n");
 
         platform_set_drvdata(pdev, priv);
 
@@ -281,7 +280,7 @@ static int int3400_thermal_probe(struct platform_device *pdev)
                                                 &int3400_thermal_params, 0, 0);
         if (IS_ERR(priv->thermal)) {
                 result = PTR_ERR(priv->thermal);
-                goto free_trt;
+                goto free_art_trt;
         }
 
         priv->rel_misc_dev_res = acpi_thermal_rel_misc_device_add(
@@ -295,9 +294,8 @@ static int int3400_thermal_probe(struct platform_device *pdev)
 
 free_zone:
         thermal_zone_device_unregister(priv->thermal);
-free_trt:
+free_art_trt:
         kfree(priv->trts);
-free_art:
         kfree(priv->arts);
 free_priv:
         kfree(priv);
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
index f88b08877025..1e25133d35e2 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
@@ -208,7 +208,7 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
                                 trip_cnt, GFP_KERNEL);
                 if (!int34x_thermal_zone->aux_trips) {
                         ret = -ENOMEM;
-                        goto free_mem;
+                        goto err_trip_alloc;
                 }
                 trip_mask = BIT(trip_cnt) - 1;
                 int34x_thermal_zone->aux_trip_nr = trip_cnt;
@@ -248,14 +248,15 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
                                                 0, 0);
         if (IS_ERR(int34x_thermal_zone->zone)) {
                 ret = PTR_ERR(int34x_thermal_zone->zone);
-                goto free_lpat;
+                goto err_thermal_zone;
         }
 
         return int34x_thermal_zone;
 
-free_lpat:
+err_thermal_zone:
         acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
-free_mem:
+        kfree(int34x_thermal_zone->aux_trips);
+err_trip_alloc:
         kfree(int34x_thermal_zone);
         return ERR_PTR(ret);
 }
@@ -266,6 +267,7 @@ void int340x_thermal_zone_remove(struct int34x_thermal_zone
 {
         thermal_zone_device_unregister(int34x_thermal_zone->zone);
         acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
+        kfree(int34x_thermal_zone->aux_trips);
         kfree(int34x_thermal_zone);
 }
 EXPORT_SYMBOL_GPL(int340x_thermal_zone_remove);
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 6ceebd659dd4..12623bc02f46 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -688,6 +688,7 @@ static const struct x86_cpu_id intel_powerclamp_ids[] = {
         { X86_VENDOR_INTEL, 6, 0x45},
         { X86_VENDOR_INTEL, 6, 0x46},
         { X86_VENDOR_INTEL, 6, 0x4c},
+        { X86_VENDOR_INTEL, 6, 0x4d},
         { X86_VENDOR_INTEL, 6, 0x56},
         {}
 };
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 2580a4872f90..fe4e767018c4 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -387,21 +387,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 
         irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (irq) {
-                int ret;
-
                 /*
                  * platform has IRQ support.
                  * Then, driver uses common registers
-                 */
-
-                ret = devm_request_irq(dev, irq->start, rcar_thermal_irq, 0,
-                                       dev_name(dev), common);
-                if (ret) {
-                        dev_err(dev, "irq request failed\n ");
-                        return ret;
-                }
-
-                /*
                  * rcar_has_irq_support() will be enabled
                  */
                 res = platform_get_resource(pdev, IORESOURCE_MEM, mres++);
@@ -456,8 +444,16 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         }
 
         /* enable temperature comparation */
-        if (irq)
+        if (irq) {
+                ret = devm_request_irq(dev, irq->start, rcar_thermal_irq, 0,
+                                       dev_name(dev), common);
+                if (ret) {
+                        dev_err(dev, "irq request failed\n ");
+                        goto error_unregister;
+                }
+
                 rcar_thermal_common_write(common, ENR, enr_bits);
+        }
 
         platform_set_drvdata(pdev, common);
 
@@ -467,9 +463,9 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 
 error_unregister:
         rcar_thermal_for_each_priv(priv, common) {
-                thermal_zone_device_unregister(priv->zone);
                 if (rcar_has_irq_support(priv))
                         rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
         }
 
         pm_runtime_put(dev);
@@ -485,9 +481,9 @@ static int rcar_thermal_remove(struct platform_device *pdev)
         struct rcar_thermal_priv *priv;
 
         rcar_thermal_for_each_priv(priv, common) {
-                thermal_zone_device_unregister(priv->zone);
                 if (rcar_has_irq_support(priv))
                         rcar_thermal_irq_disable(priv);
+                thermal_zone_device_unregister(priv->zone);
         }
 
         pm_runtime_put(dev);
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 933cd80a6bc5..1d30b0975651 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -682,6 +682,7 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on)
 
         if (on) {
                 con |= (1 << EXYNOS_TMU_CORE_EN_SHIFT);
+                con |= (1 << EXYNOS7_PD_DET_EN_SHIFT);
                 interrupt_en =
                         (of_thermal_is_trip_valid(tz, 7)
                         << EXYNOS7_TMU_INTEN_RISE7_SHIFT) |
@@ -704,9 +705,9 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on)
                         interrupt_en << EXYNOS_TMU_INTEN_FALL0_SHIFT;
         } else {
                 con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
+                con &= ~(1 << EXYNOS7_PD_DET_EN_SHIFT);
                 interrupt_en = 0; /* Disable all interrupts */
         }
-        con |= 1 << EXYNOS7_PD_DET_EN_SHIFT;
 
         writel(interrupt_en, data->base + EXYNOS7_TMU_REG_INTEN);
         writel(con, data->base + EXYNOS_TMU_REG_CONTROL);
@@ -918,34 +919,16 @@ static irqreturn_t exynos_tmu_irq(int irq, void *id)
 }
 
 static const struct of_device_id exynos_tmu_match[] = {
-        {
-                .compatible = "samsung,exynos3250-tmu",
-        },
-        {
-                .compatible = "samsung,exynos4210-tmu",
-        },
-        {
-                .compatible = "samsung,exynos4412-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5250-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5260-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5420-tmu",
-        },
-        {
-                .compatible = "samsung,exynos5420-tmu-ext-triminfo",
-        },
-        {
-                .compatible = "samsung,exynos5440-tmu",
-        },
-        {
-                .compatible = "samsung,exynos7-tmu",
-        },
-        {},
+        { .compatible = "samsung,exynos3250-tmu", },
+        { .compatible = "samsung,exynos4210-tmu", },
+        { .compatible = "samsung,exynos4412-tmu", },
+        { .compatible = "samsung,exynos5250-tmu", },
+        { .compatible = "samsung,exynos5260-tmu", },
+        { .compatible = "samsung,exynos5420-tmu", },
+        { .compatible = "samsung,exynos5420-tmu-ext-triminfo", },
+        { .compatible = "samsung,exynos5440-tmu", },
+        { .compatible = "samsung,exynos7-tmu", },
+        { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, exynos_tmu_match);
 
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 48491d1a81d6..174d3bcf8bd7 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -899,6 +899,22 @@ thermal_cooling_device_trip_point_show(struct device *dev,
                 return sprintf(buf, "%d\n", instance->trip);
 }
 
+static struct attribute *cooling_device_attrs[] = {
+        &dev_attr_cdev_type.attr,
+        &dev_attr_max_state.attr,
+        &dev_attr_cur_state.attr,
+        NULL,
+};
+
+static const struct attribute_group cooling_device_attr_group = {
+        .attrs = cooling_device_attrs,
+};
+
+static const struct attribute_group *cooling_device_attr_groups[] = {
+        &cooling_device_attr_group,
+        NULL,
+};
+
 /* Device management */
 
 /**
@@ -1130,6 +1146,7 @@ __thermal_cooling_device_register(struct device_node *np,
         cdev->ops = ops;
         cdev->updated = false;
         cdev->device.class = &thermal_class;
+        cdev->device.groups = cooling_device_attr_groups;
         cdev->devdata = devdata;
         dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
         result = device_register(&cdev->device);
@@ -1139,21 +1156,6 @@ __thermal_cooling_device_register(struct device_node *np,
                 return ERR_PTR(result);
         }
 
-        /* sys I/F */
-        if (type) {
-                result = device_create_file(&cdev->device, &dev_attr_cdev_type);
-                if (result)
-                        goto unregister;
-        }
-
-        result = device_create_file(&cdev->device, &dev_attr_max_state);
-        if (result)
-                goto unregister;
-
-        result = device_create_file(&cdev->device, &dev_attr_cur_state);
-        if (result)
-                goto unregister;
-
         /* Add 'this' new cdev to the global cdev list */
         mutex_lock(&thermal_list_lock);
         list_add(&cdev->node, &thermal_cdev_list);
@@ -1163,11 +1165,6 @@ __thermal_cooling_device_register(struct device_node *np,
         bind_cdev(cdev);
 
         return cdev;
-
-unregister:
-        release_idr(&thermal_cdev_idr, &thermal_idr_lock, cdev->id);
-        device_unregister(&cdev->device);
-        return ERR_PTR(result);
 }
 
 /**
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index 634b6ce0e63a..62a5d449c388 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1402,7 +1402,7 @@ int ti_bandgap_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ti_bandgap_save_ctxt(struct ti_bandgap *bgp)
 {
         int i;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 3fb054a10f6a..a38c1756442a 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -429,7 +429,7 @@ int ti_thermal_unregister_cpu_cooling(struct ti_bandgap *bgp, int id)
 
         data = ti_bandgap_get_sensor_data(bgp, id);
 
-        if (data && data->cool_dev)
+        if (data)
                 cpufreq_cooling_unregister(data->cool_dev);
 
         return 0;
diff --git a/drivers/tty/bfin_jtag_comm.c b/drivers/tty/bfin_jtag_comm.c
index d7b198c400c7..ce24182f8514 100644
--- a/drivers/tty/bfin_jtag_comm.c
+++ b/drivers/tty/bfin_jtag_comm.c
@@ -210,18 +210,6 @@ bfin_jc_chars_in_buffer(struct tty_struct *tty)
         return circ_cnt(&bfin_jc_write_buf);
 }
 
-static void
-bfin_jc_wait_until_sent(struct tty_struct *tty, int timeout)
-{
-        unsigned long expire = jiffies + timeout;
-        while (!circ_empty(&bfin_jc_write_buf)) {
-                if (signal_pending(current))
-                        break;
-                if (time_after(jiffies, expire))
-                        break;
-        }
-}
-
 static const struct tty_operations bfin_jc_ops = {
         .open            = bfin_jc_open,
         .close           = bfin_jc_close,
@@ -230,7 +218,6 @@ static const struct tty_operations bfin_jc_ops = {
         .flush_chars     = bfin_jc_flush_chars,
         .write_room      = bfin_jc_write_room,
         .chars_in_buffer = bfin_jc_chars_in_buffer,
-        .wait_until_sent = bfin_jc_wait_until_sent,
 };
 
 static int __init bfin_jc_init(void)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index e3b9570a1eff..deae122c9c4b 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -2138,8 +2138,8 @@ int serial8250_do_startup(struct uart_port *port)
         /*
          * Clear the interrupt registers.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_LSR);
+        serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
 
@@ -2300,8 +2300,8 @@ dont_test_tx_en:
          * saved flags to avoid getting false values from polling
          * routines or the previous session.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_LSR);
+        serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
         up->lsr_saved_flags = 0;
@@ -2394,8 +2394,7 @@ void serial8250_do_shutdown(struct uart_port *port)
          * Read data port to reset things, and then unlink from
          * the IRQ chain.
          */
-        if (serial_port_in(port, UART_LSR) & UART_LSR_DR)
-                serial_port_in(port, UART_RX);
+        serial_port_in(port, UART_RX);
         serial8250_rpm_put(up);
 
         del_timer_sync(&up->timer);
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index e60116235836..2ab229ddee38 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -59,6 +59,8 @@ struct dw8250_data {
         u8                      usr_reg;
         int                     last_mcr;
         int                     line;
+        int                     msr_mask_on;
+        int                     msr_mask_off;
         struct clk              *clk;
         struct clk              *pclk;
         struct reset_control    *rst;
@@ -81,6 +83,12 @@ static inline int dw8250_modify_msr(struct uart_port *p, int offset, int value)
                 value &= ~UART_MSR_DCTS;
         }
 
+        /* Override any modem control signals if needed */
+        if (offset == UART_MSR) {
+                value |= d->msr_mask_on;
+                value &= ~d->msr_mask_off;
+        }
+
         return value;
 }
 
@@ -334,6 +342,30 @@ static int dw8250_probe_of(struct uart_port *p,
         if (id >= 0)
                 p->line = id;
 
+        if (of_property_read_bool(np, "dcd-override")) {
+                /* Always report DCD as active */
+                data->msr_mask_on |= UART_MSR_DCD;
+                data->msr_mask_off |= UART_MSR_DDCD;
+        }
+
+        if (of_property_read_bool(np, "dsr-override")) {
+                /* Always report DSR as active */
+                data->msr_mask_on |= UART_MSR_DSR;
+                data->msr_mask_off |= UART_MSR_DDSR;
+        }
+
+        if (of_property_read_bool(np, "cts-override")) {
+                /* Always report DSR as active */
+                data->msr_mask_on |= UART_MSR_DSR;
+                data->msr_mask_off |= UART_MSR_DDSR;
+        }
+
+        if (of_property_read_bool(np, "ri-override")) {
+                /* Always report Ring indicator as inactive */
+                data->msr_mask_off |= UART_MSR_RI;
+                data->msr_mask_off |= UART_MSR_TERI;
+        }
+
         /* clock got configured through clk api, all done */
         if (p->uartclk)
                 return 0;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index daf2c82984e9..892eb32cdef4 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -69,7 +69,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
                "Please send the output of lspci -vv, this\n"
                "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
                "manufacturer and name of serial board or\n"
-               "modem board to rmk+serial@arm.linux.org.uk.\n",
+               "modem board to <linux-serial@vger.kernel.org>.\n",
                pci_name(dev), str, dev->vendor, dev->device,
                dev->subsystem_vendor, dev->subsystem_device);
 }
@@ -1989,13 +1989,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
         },
         {
                 .vendor         = PCI_VENDOR_ID_INTEL,
-                .device         = PCI_DEVICE_ID_INTEL_QRK_UART,
-                .subvendor      = PCI_ANY_ID,
-                .subdevice      = PCI_ANY_ID,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_INTEL,
                 .device         = PCI_DEVICE_ID_INTEL_BSW_UART1,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
@@ -2201,13 +2194,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
          */
         {
                 .vendor         = PCI_VENDOR_ID_PLX,
-                .device         = PCI_DEVICE_ID_PLX_9030,
-                .subvendor      = PCI_SUBVENDOR_ID_PERLE,
-                .subdevice      = PCI_ANY_ID,
-                .setup          = pci_default_setup,
-        },
-        {
-                .vendor         = PCI_VENDOR_ID_PLX,
                 .device         = PCI_DEVICE_ID_PLX_9050,
                 .subvendor      = PCI_SUBVENDOR_ID_EXSYS,
                 .subdevice      = PCI_SUBDEVICE_ID_EXSYS_4055,
@@ -5415,10 +5401,6 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
-        {       PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH352_2S,
-                PCI_ANY_ID, PCI_ANY_ID,
-                0, 0, pbn_b0_bt_2_115200 },
-
         {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_wch384_4 },
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 846552bff67d..4e959c43f680 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -47,6 +47,7 @@
 #include <linux/gpio/consumer.h>
 #include <linux/err.h>
 #include <linux/irq.h>
+#include <linux/suspend.h>
 
 #include <asm/io.h>
 #include <asm/ioctls.h>
@@ -173,6 +174,12 @@ struct atmel_uart_port {
         bool                    ms_irq_enabled;
         bool                    is_usart;       /* usart or uart */
         struct timer_list       uart_timer;     /* uart timer */
+
+        bool                    suspended;
+        unsigned int            pending;
+        unsigned int            pending_status;
+        spinlock_t              lock_suspended;
+
         int (*prepare_rx)(struct uart_port *port);
         int (*prepare_tx)(struct uart_port *port);
         void (*schedule_rx)(struct uart_port *port);
@@ -1179,12 +1186,15 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id)
 {
         struct uart_port *port = dev_id;
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
-        unsigned int status, pending, pass_counter = 0;
+        unsigned int status, pending, mask, pass_counter = 0;
         bool gpio_handled = false;
 
+        spin_lock(&atmel_port->lock_suspended);
+
         do {
                 status = atmel_get_lines_status(port);
-                pending = status & UART_GET_IMR(port);
+                mask = UART_GET_IMR(port);
+                pending = status & mask;
                 if (!gpio_handled) {
                         /*
                          * Dealing with GPIO interrupt
@@ -1206,11 +1216,21 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id)
                 if (!pending)
                         break;
 
+                if (atmel_port->suspended) {
+                        atmel_port->pending |= pending;
+                        atmel_port->pending_status = status;
+                        UART_PUT_IDR(port, mask);
+                        pm_system_wakeup();
+                        break;
+                }
+
                 atmel_handle_receive(port, pending);
                 atmel_handle_status(port, pending, status);
                 atmel_handle_transmit(port, pending);
         } while (pass_counter++ < ATMEL_ISR_PASS_LIMIT);
 
+        spin_unlock(&atmel_port->lock_suspended);
+
         return pass_counter ? IRQ_HANDLED : IRQ_NONE;
 }
 
@@ -1742,7 +1762,8 @@ static int atmel_startup(struct uart_port *port)
         /*
          * Allocate the IRQ
          */
-        retval = request_irq(port->irq, atmel_interrupt, IRQF_SHARED,
+        retval = request_irq(port->irq, atmel_interrupt,
+                        IRQF_SHARED | IRQF_COND_SUSPEND,
                         tty ? tty->name : "atmel_serial", port);
         if (retval) {
                 dev_err(port->dev, "atmel_startup - Can't get irq\n");
@@ -2513,8 +2534,14 @@ static int atmel_serial_suspend(struct platform_device *pdev,
 
         /* we can not wake up if we're running on slow clock */
         atmel_port->may_wakeup = device_may_wakeup(&pdev->dev);
-        if (atmel_serial_clk_will_stop())
+        if (atmel_serial_clk_will_stop()) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&atmel_port->lock_suspended, flags);
+                atmel_port->suspended = true;
+                spin_unlock_irqrestore(&atmel_port->lock_suspended, flags);
                 device_set_wakeup_enable(&pdev->dev, 0);
+        }
 
         uart_suspend_port(&atmel_uart, port);
 
@@ -2525,6 +2552,18 @@ static int atmel_serial_resume(struct platform_device *pdev)
 {
         struct uart_port *port = platform_get_drvdata(pdev);
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+        unsigned long flags;
+
+        spin_lock_irqsave(&atmel_port->lock_suspended, flags);
+        if (atmel_port->pending) {
+                atmel_handle_receive(port, atmel_port->pending);
+                atmel_handle_status(port, atmel_port->pending,
+                                    atmel_port->pending_status);
+                atmel_handle_transmit(port, atmel_port->pending);
+                atmel_port->pending = 0;
+        }
+        atmel_port->suspended = false;
+        spin_unlock_irqrestore(&atmel_port->lock_suspended, flags);
 
         uart_resume_port(&atmel_uart, port);
         device_set_wakeup_enable(&pdev->dev, atmel_port->may_wakeup);
@@ -2593,6 +2632,8 @@ static int atmel_serial_probe(struct platform_device *pdev)
         port->backup_imr = 0;
         port->uart.line = ret;
 
+        spin_lock_init(&port->lock_suspended);
+
         ret = atmel_init_gpios(port, &pdev->dev);
         if (ret < 0)
                 dev_err(&pdev->dev, "%s",
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 7ff61e24a195..33fb94f78967 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -133,10 +133,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
         if (of_find_property(np, "no-loopback-test", NULL))
                 port->flags |= UPF_SKIP_TEST;
 
-        ret = of_alias_get_id(np, "serial");
-        if (ret >= 0)
-                port->line = ret;
-
         port->dev = &ofdev->dev;
 
         switch (type) {
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index 594b63331ef4..bca975f5093b 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -293,8 +293,10 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id)
 
         ims = serial_in(port, SPRD_IMSR);
 
-        if (!ims)
+        if (!ims) {
+                spin_unlock(&port->lock);
                 return IRQ_NONE;
+        }
 
         serial_out(port, SPRD_ICLR, ~0);
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 51f066aa375e..2bb4dfc02873 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(start_tty);
 /* We limit tty time update visibility to every 8 seconds or so. */
 static void tty_update_time(struct timespec *time)
 {
-        unsigned long sec = get_seconds() & ~7;
-        if ((long)(sec - time->tv_sec) > 0)
+        unsigned long sec = get_seconds();
+        if (abs(sec - time->tv_sec) & ~7)
                 time->tv_sec = sec;
 }
 
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index a5cf253b2544..632fc8152061 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -217,11 +217,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
 #endif
         if (!timeout)
                 timeout = MAX_SCHEDULE_TIMEOUT;
-        if (wait_event_interruptible_timeout(tty->write_wait,
-                        !tty_chars_in_buffer(tty), timeout) >= 0) {
-                if (tty->ops->wait_until_sent)
-                        tty->ops->wait_until_sent(tty, timeout);
-        }
+
+        timeout = wait_event_interruptible_timeout(tty->write_wait,
+                        !tty_chars_in_buffer(tty), timeout);
+        if (timeout <= 0)
+                return;
+
+        if (timeout == MAX_SCHEDULE_TIMEOUT)
+                timeout = 0;
+
+        if (tty->ops->wait_until_sent)
+                tty->ops->wait_until_sent(tty, timeout);
 }
 EXPORT_SYMBOL(tty_wait_until_sent);
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e78720b59d67..683617714e7c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1650,6 +1650,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 
 static const struct usb_device_id acm_ids[] = {
         /* quirky and broken devices */
+        { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
+        .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
         .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
         { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 66abdbcfbfa5..11635537c052 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -501,6 +501,7 @@ static void async_completed(struct urb *urb)
         as->status = urb->status;
         signr = as->signr;
         if (signr) {
+                memset(&sinfo, 0, sizeof(sinfo));
                 sinfo.si_signo = as->signr;
                 sinfo.si_errno = as->status;
                 sinfo.si_code = SI_ASYNCIO;
@@ -2382,6 +2383,7 @@ static void usbdev_remove(struct usb_device *udev)
                 wake_up_all(&ps->wait);
                 list_del_init(&ps->list);
                 if (ps->discsignr) {
+                        memset(&sinfo, 0, sizeof(sinfo));
                         sinfo.si_signo = ps->discsignr;
                         sinfo.si_errno = EPIPE;
                         sinfo.si_code = SI_ASYNCIO;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 172d64e585b6..52e0c4e5e48e 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -205,6 +205,18 @@ static void dwc3_omap_write_irq0_set(struct dwc3_omap *omap, u32 value)
                                                 omap->irq0_offset, value);
 }
 
+static void dwc3_omap_write_irqmisc_clr(struct dwc3_omap *omap, u32 value)
+{
+        dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_MISC +
+                                                omap->irqmisc_offset, value);
+}
+
+static void dwc3_omap_write_irq0_clr(struct dwc3_omap *omap, u32 value)
+{
+        dwc3_omap_writel(omap->base, USBOTGSS_IRQENABLE_CLR_0 -
+                                                omap->irq0_offset, value);
+}
+
 static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
         enum omap_dwc3_vbus_id_status status)
 {
@@ -345,9 +357,23 @@ static void dwc3_omap_enable_irqs(struct dwc3_omap *omap)
 
 static void dwc3_omap_disable_irqs(struct dwc3_omap *omap)
 {
+        u32                     reg;
+
         /* disable all IRQs */
-        dwc3_omap_write_irqmisc_set(omap, 0x00);
-        dwc3_omap_write_irq0_set(omap, 0x00);
+        reg = USBOTGSS_IRQO_COREIRQ_ST;
+        dwc3_omap_write_irq0_clr(omap, reg);
+
+        reg = (USBOTGSS_IRQMISC_OEVT |
+                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
+                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
+                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
+                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
+                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
+                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
+
+        dwc3_omap_write_irqmisc_clr(omap, reg);
 }
 
 static u64 dwc3_omap_dma_mask = DMA_BIT_MASK(32);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 75648145dc1b..c42765b3a060 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1161,7 +1161,6 @@ static ssize_t interf_grp_compatible_id_store(struct usb_os_desc *desc,
         if (desc->opts_mutex)
                 mutex_lock(desc->opts_mutex);
         memcpy(desc->ext_compat_id, page, l);
-        desc->ext_compat_id[l] = '\0';
 
         if (desc->opts_mutex)
                 mutex_unlock(desc->opts_mutex);
@@ -1192,7 +1191,6 @@ static ssize_t interf_grp_sub_compatible_id_store(struct usb_os_desc *desc,
         if (desc->opts_mutex)
                 mutex_lock(desc->opts_mutex);
         memcpy(desc->ext_compat_id + 8, page, l);
-        desc->ext_compat_id[l + 8] = '\0';
 
         if (desc->opts_mutex)
                 mutex_unlock(desc->opts_mutex);
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 426d69a9c018..a2612fb79eff 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -569,7 +569,7 @@ fail:
         return status;
 }
 
-const struct file_operations f_hidg_fops = {
+static const struct file_operations f_hidg_fops = {
         .owner          = THIS_MODULE,
         .open           = f_hidg_open,
         .release        = f_hidg_release,
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index c89e96cfa3e4..c0c3ef272714 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -417,7 +417,10 @@ static int pn_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                         return -EINVAL;
 
                 spin_lock(&port->lock);
-                __pn_reset(f);
+
+                if (fp->in_ep->driver_data)
+                        __pn_reset(f);
+
                 if (alt == 1) {
                         int i;
 
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index e07c50ced64d..e3dae47baef3 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -344,7 +344,7 @@ static struct usb_endpoint_descriptor ss_int_source_desc = {
         .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
 };
 
-struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
+static struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
         .bLength =              USB_DT_SS_EP_COMP_SIZE,
         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 
@@ -362,7 +362,7 @@ static struct usb_endpoint_descriptor ss_int_sink_desc = {
         .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
 };
 
-struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
+static struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
         .bLength =              USB_DT_SS_EP_COMP_SIZE,
         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 33e16658e5cf..6d3eb8b00a48 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -54,7 +54,7 @@
 #define UNFLW_CTRL      8
 #define OVFLW_CTRL      10
 
-const char *uac2_name = "snd_uac2";
+static const char *uac2_name = "snd_uac2";
 
 struct uac2_req {
         struct uac2_rtd_params *pp; /* parent param */
@@ -634,7 +634,7 @@ static struct usb_interface_descriptor std_ac_if_desc = {
 };
 
 /* Clock source for IN traffic */
-struct uac_clock_source_descriptor in_clk_src_desc = {
+static struct uac_clock_source_descriptor in_clk_src_desc = {
         .bLength = sizeof in_clk_src_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -646,7 +646,7 @@ struct uac_clock_source_descriptor in_clk_src_desc = {
 };
 
 /* Clock source for OUT traffic */
-struct uac_clock_source_descriptor out_clk_src_desc = {
+static struct uac_clock_source_descriptor out_clk_src_desc = {
         .bLength = sizeof out_clk_src_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -658,7 +658,7 @@ struct uac_clock_source_descriptor out_clk_src_desc = {
 };
 
 /* Input Terminal for USB_OUT */
-struct uac2_input_terminal_descriptor usb_out_it_desc = {
+static struct uac2_input_terminal_descriptor usb_out_it_desc = {
         .bLength = sizeof usb_out_it_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -672,7 +672,7 @@ struct uac2_input_terminal_descriptor usb_out_it_desc = {
 };
 
 /* Input Terminal for I/O-In */
-struct uac2_input_terminal_descriptor io_in_it_desc = {
+static struct uac2_input_terminal_descriptor io_in_it_desc = {
         .bLength = sizeof io_in_it_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -686,7 +686,7 @@ struct uac2_input_terminal_descriptor io_in_it_desc = {
 };
 
 /* Ouput Terminal for USB_IN */
-struct uac2_output_terminal_descriptor usb_in_ot_desc = {
+static struct uac2_output_terminal_descriptor usb_in_ot_desc = {
         .bLength = sizeof usb_in_ot_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -700,7 +700,7 @@ struct uac2_output_terminal_descriptor usb_in_ot_desc = {
 };
 
 /* Ouput Terminal for I/O-Out */
-struct uac2_output_terminal_descriptor io_out_ot_desc = {
+static struct uac2_output_terminal_descriptor io_out_ot_desc = {
         .bLength = sizeof io_out_ot_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -713,7 +713,7 @@ struct uac2_output_terminal_descriptor io_out_ot_desc = {
         .bmControls = (CONTROL_RDWR << COPY_CTRL),
 };
 
-struct uac2_ac_header_descriptor ac_hdr_desc = {
+static struct uac2_ac_header_descriptor ac_hdr_desc = {
         .bLength = sizeof ac_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -751,7 +751,7 @@ static struct usb_interface_descriptor std_as_out_if1_desc = {
 };
 
 /* Audio Stream OUT Intface Desc */
-struct uac2_as_header_descriptor as_out_hdr_desc = {
+static struct uac2_as_header_descriptor as_out_hdr_desc = {
         .bLength = sizeof as_out_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -764,7 +764,7 @@ struct uac2_as_header_descriptor as_out_hdr_desc = {
 };
 
 /* Audio USB_OUT Format */
-struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
+static struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
         .bLength = sizeof as_out_fmt1_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
         .bDescriptorSubtype = UAC_FORMAT_TYPE,
@@ -772,7 +772,7 @@ struct uac2_format_type_i_descriptor as_out_fmt1_desc = {
 };
 
 /* STD AS ISO OUT Endpoint */
-struct usb_endpoint_descriptor fs_epout_desc = {
+static struct usb_endpoint_descriptor fs_epout_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -782,7 +782,7 @@ struct usb_endpoint_descriptor fs_epout_desc = {
         .bInterval = 1,
 };
 
-struct usb_endpoint_descriptor hs_epout_desc = {
+static struct usb_endpoint_descriptor hs_epout_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -828,7 +828,7 @@ static struct usb_interface_descriptor std_as_in_if1_desc = {
 };
 
 /* Audio Stream IN Intface Desc */
-struct uac2_as_header_descriptor as_in_hdr_desc = {
+static struct uac2_as_header_descriptor as_in_hdr_desc = {
         .bLength = sizeof as_in_hdr_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
 
@@ -841,7 +841,7 @@ struct uac2_as_header_descriptor as_in_hdr_desc = {
 };
 
 /* Audio USB_IN Format */
-struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
+static struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
         .bLength = sizeof as_in_fmt1_desc,
         .bDescriptorType = USB_DT_CS_INTERFACE,
         .bDescriptorSubtype = UAC_FORMAT_TYPE,
@@ -849,7 +849,7 @@ struct uac2_format_type_i_descriptor as_in_fmt1_desc = {
 };
 
 /* STD AS ISO IN Endpoint */
-struct usb_endpoint_descriptor fs_epin_desc = {
+static struct usb_endpoint_descriptor fs_epin_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -859,7 +859,7 @@ struct usb_endpoint_descriptor fs_epin_desc = {
         .bInterval = 1,
 };
 
-struct usb_endpoint_descriptor hs_epin_desc = {
+static struct usb_endpoint_descriptor hs_epin_desc = {
         .bLength = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
@@ -1563,7 +1563,7 @@ static void afunc_unbind(struct usb_configuration *c, struct usb_function *f)
                 agdev->out_ep->driver_data = NULL;
 }
 
-struct usb_function *afunc_alloc(struct usb_function_instance *fi)
+static struct usb_function *afunc_alloc(struct usb_function_instance *fi)
 {
         struct audio_dev *agdev;
         struct f_uac2_opts *opts;
diff --git a/drivers/usb/gadget/function/uvc_v4l2.c b/drivers/usb/gadget/function/uvc_v4l2.c
index 5aad7fededa5..8b818fd027b3 100644
--- a/drivers/usb/gadget/function/uvc_v4l2.c
+++ b/drivers/usb/gadget/function/uvc_v4l2.c
@@ -27,6 +27,7 @@
 #include "uvc.h"
 #include "uvc_queue.h"
 #include "uvc_video.h"
+#include "uvc_v4l2.h"
 
 /* --------------------------------------------------------------------------
  * Requests handling
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 9cb86bc1a9a5..50a5e637ca35 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -21,6 +21,7 @@
 
 #include "uvc.h"
 #include "uvc_queue.h"
+#include "uvc_video.h"
 
 /* --------------------------------------------------------------------------
  * Video codecs
diff --git a/drivers/usb/gadget/legacy/g_ffs.c b/drivers/usb/gadget/legacy/g_ffs.c
index 06acfa55864a..b01b88e1b716 100644
--- a/drivers/usb/gadget/legacy/g_ffs.c
+++ b/drivers/usb/gadget/legacy/g_ffs.c
@@ -133,7 +133,9 @@ struct gfs_configuration {
         struct usb_configuration c;
         int (*eth)(struct usb_configuration *c);
         int num;
-} gfs_configurations[] = {
+};
+
+static struct gfs_configuration gfs_configurations[] = {
 #ifdef CONFIG_USB_FUNCTIONFS_RNDIS
         {
                 .eth            = bind_rndis_config,
@@ -278,7 +280,7 @@ static void *functionfs_acquire_dev(struct ffs_dev *dev)
         if (!try_module_get(THIS_MODULE))
                 return ERR_PTR(-ENOENT);
         
-        return 0;
+        return NULL;
 }
 
 static void functionfs_release_dev(struct ffs_dev *dev)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7f76c8a12f89..fd53c9ebd662 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -37,6 +37,9 @@
 
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
+#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI             0x22b5
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI         0xa12f
+#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI        0x9d2f
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -133,6 +136,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
         }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+                (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
+                xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+        }
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                         pdev->device == PCI_DEVICE_ID_EJ168) {
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
@@ -159,6 +168,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                 "QUIRK: Resetting on resume");
 }
 
+/*
+ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
+ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
+ */
+static void xhci_pme_quirk(struct xhci_hcd *xhci)
+{
+        u32 val;
+        void __iomem *reg;
+
+        reg = (void __iomem *) xhci->cap_regs + 0x80a4;
+        val = readl(reg);
+        writel(val | BIT(28), reg);
+        readl(reg);
+}
+
 /* called during probe() after chip reset completes */
 static int xhci_pci_setup(struct usb_hcd *hcd)
 {
@@ -283,6 +307,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 pdev->no_d3cold = true;
 
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_quirk(xhci);
+
         return xhci_suspend(xhci, do_wakeup);
 }
 
@@ -313,6 +340,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
         if (pdev->vendor == PCI_VENDOR_ID_INTEL)
                 usb_enable_intel_xhci_ports(pdev);
 
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_quirk(xhci);
+
         retval = xhci_resume(xhci, hibernated);
         return retval;
 }
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 08d402b15482..0e11d61408ff 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -83,16 +83,6 @@ static int xhci_plat_probe(struct platform_device *pdev)
         if (irq < 0)
                 return -ENODEV;
 
-
-        if (of_device_is_compatible(pdev->dev.of_node,
-                                    "marvell,armada-375-xhci") ||
-            of_device_is_compatible(pdev->dev.of_node,
-                                    "marvell,armada-380-xhci")) {
-                ret = xhci_mvebu_mbus_init_quirk(pdev);
-                if (ret)
-                        return ret;
-        }
-
         /* Initialize dma_mask and coherent_dma_mask to 32-bits */
         ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
         if (ret)
@@ -127,6 +117,15 @@ static int xhci_plat_probe(struct platform_device *pdev)
                         goto put_hcd;
         }
 
+        if (of_device_is_compatible(pdev->dev.of_node,
+                                    "marvell,armada-375-xhci") ||
+            of_device_is_compatible(pdev->dev.of_node,
+                                    "marvell,armada-380-xhci")) {
+                ret = xhci_mvebu_mbus_init_quirk(pdev);
+                if (ret)
+                        goto disable_clk;
+        }
+
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
                 goto disable_clk;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 88da8d629820..5fb66db89e05 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1729,7 +1729,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
         if (!command)
                 return;
 
-        ep->ep_state |= EP_HALTED;
+        ep->ep_state |= EP_HALTED | EP_RECENTLY_HALTED;
         ep->stopped_stream = stream_id;
 
         xhci_queue_reset_ep(xhci, command, slot_id, ep_index);
@@ -1946,7 +1946,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
         if (event_trb != ep_ring->dequeue) {
                 /* The event was for the status stage */
                 if (event_trb == td->last_trb) {
-                        if (td->urb->actual_length != 0) {
+                        if (td->urb_length_set) {
                                 /* Don't overwrite a previously set error code
                                  */
                                 if ((*status == -EINPROGRESS || *status == 0) &&
@@ -1960,7 +1960,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                         td->urb->transfer_buffer_length;
                         }
                 } else {
-                /* Maybe the event was for the data stage? */
+                        /*
+                         * Maybe the event was for the data stage? If so, update
+                         * already the actual_length of the URB and flag it as
+                         * set, so that it is not overwritten in the event for
+                         * the last TRB.
+                         */
+                        td->urb_length_set = true;
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
                                 EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index ec8ac1674854..b06d1a53652d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1338,6 +1338,12 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 goto exit;
         }
 
+        /* Reject urb if endpoint is in soft reset, queue must stay empty */
+        if (xhci->devs[slot_id]->eps[ep_index].ep_state & EP_CONFIG_PENDING) {
+                xhci_warn(xhci, "Can't enqueue URB while ep is in soft reset\n");
+                ret = -EINVAL;
+        }
+
         if (usb_endpoint_xfer_isoc(&urb->ep->desc))
                 size = urb->number_of_packets;
         else
@@ -2948,23 +2954,36 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
         }
 }
 
-/* Called when clearing halted device. The core should have sent the control
+/* Called after clearing a halted device. USB core should have sent the control
  * message to clear the device halt condition. The host side of the halt should
- * already be cleared with a reset endpoint command issued when the STALL tx
- * event was received.
- *
- * Context: in_interrupt
+ * already be cleared with a reset endpoint command issued immediately when the
+ * STALL tx event was received.
  */
 
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
+        struct usb_device *udev;
+        struct xhci_virt_device *virt_dev;
+        struct xhci_virt_ep *virt_ep;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_command *command;
+        unsigned int ep_index, ep_state;
+        unsigned long flags;
+        u32 ep_flag;
 
         xhci = hcd_to_xhci(hcd);
+        udev = (struct usb_device *) ep->hcpriv;
+        if (!ep->hcpriv)
+                return;
+        virt_dev = xhci->devs[udev->slot_id];
+        ep_index = xhci_get_endpoint_index(&ep->desc);
+        virt_ep = &virt_dev->eps[ep_index];
+        ep_state = virt_ep->ep_state;
 
         /*
-         * We might need to implement the config ep cmd in xhci 4.8.1 note:
+         * Implement the config ep command in xhci 4.6.8 additional note:
          * The Reset Endpoint Command may only be issued to endpoints in the
          * Halted state. If software wishes reset the Data Toggle or Sequence
          * Number of an endpoint that isn't in the Halted state, then software
@@ -2972,9 +2991,72 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
          * for the target endpoint. that is in the Stopped state.
          */
 
-        /* For now just print debug to follow the situation */
-        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
-                 ep->desc.bEndpointAddress);
+        if (ep_state & SET_DEQ_PENDING || ep_state & EP_RECENTLY_HALTED) {
+                virt_ep->ep_state &= ~EP_RECENTLY_HALTED;
+                xhci_dbg(xhci, "ep recently halted, no toggle reset needed\n");
+                return;
+        }
+
+        /* Only interrupt and bulk ep's use Data toggle, USB2 spec 5.5.4-> */
+        if (usb_endpoint_xfer_control(&ep->desc) ||
+            usb_endpoint_xfer_isoc(&ep->desc))
+                return;
+
+        ep_flag = xhci_get_endpoint_flag(&ep->desc);
+
+        if (ep_flag == SLOT_FLAG || ep_flag == EP0_FLAG)
+                return;
+
+        command = xhci_alloc_command(xhci, true, true, GFP_NOWAIT);
+        if (!command) {
+                xhci_err(xhci, "Could not allocate xHCI command structure.\n");
+                return;
+        }
+
+        spin_lock_irqsave(&xhci->lock, flags);
+
+        /* block ringing ep doorbell */
+        virt_ep->ep_state |= EP_CONFIG_PENDING;
+
+        /*
+         * Make sure endpoint ring is empty before resetting the toggle/seq.
+         * Driver is required to synchronously cancel all transfer request.
+         *
+         * xhci 4.6.6 says we can issue a configure endpoint command on a
+         * running endpoint ring as long as it's idle (queue empty)
+         */
+
+        if (!list_empty(&virt_ep->ring->td_list)) {
+                dev_err(&udev->dev, "EP not empty, refuse reset\n");
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                goto cleanup;
+        }
+
+        xhci_dbg(xhci, "Reset toggle/seq for slot %d, ep_index: %d\n",
+                 udev->slot_id, ep_index);
+
+        ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
+        if (!ctrl_ctx) {
+                xhci_err(xhci, "Could not get input context, bad type. virt_dev: %p, in_ctx %p\n",
+                         virt_dev, virt_dev->in_ctx);
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                goto cleanup;
+        }
+        xhci_setup_input_ctx_for_config_ep(xhci, command->in_ctx,
+                                           virt_dev->out_ctx, ctrl_ctx,
+                                           ep_flag, ep_flag);
+        xhci_endpoint_copy(xhci, command->in_ctx, virt_dev->out_ctx, ep_index);
+
+        xhci_queue_configure_endpoint(xhci, command, command->in_ctx->dma,
+                                     udev->slot_id, false);
+        xhci_ring_cmd_db(xhci);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+
+        wait_for_completion(command->completion);
+
+cleanup:
+        virt_ep->ep_state &= ~EP_CONFIG_PENDING;
+        xhci_free_command(xhci, command);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 974514762a14..265ab1771d24 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1,3 +1,4 @@
+
 /*
  * xHCI host controller driver
  *
@@ -88,9 +89,10 @@ struct xhci_cap_regs {
 #define HCS_IST(p)              (((p) >> 0) & 0xf)
 /* bits 4:7, max number of Event Ring segments */
 #define HCS_ERST_MAX(p)         (((p) >> 4) & 0xf)
+/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
 /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
-#define HCS_MAX_SCRATCHPAD(p)   (((p) >> 27) & 0x1f)
+/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
+#define HCS_MAX_SCRATCHPAD(p)   ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
 
 /* HCSPARAMS3 - hcs_params3 - bitmasks */
 /* bits 0:7, Max U1 to U0 latency for the roothub ports */
@@ -863,6 +865,8 @@ struct xhci_virt_ep {
 #define EP_HAS_STREAMS          (1 << 4)
 /* Transitioning the endpoint to not using streams, don't enqueue URBs */
 #define EP_GETTING_NO_STREAMS   (1 << 5)
+#define EP_RECENTLY_HALTED      (1 << 6)
+#define EP_CONFIG_PENDING       (1 << 7)
         /* ----  Related to URB cancellation ---- */
         struct list_head        cancelled_td_list;
         struct xhci_td          *stopped_td;
@@ -1288,6 +1292,8 @@ struct xhci_td {
         struct xhci_segment     *start_seg;
         union xhci_trb          *first_trb;
         union xhci_trb          *last_trb;
+        /* actual_length of the URB has already been set */
+        bool                    urb_length_set;
 };
 
 /* xHCI command default timeout value */
@@ -1560,6 +1566,7 @@ struct xhci_hcd {
 #define XHCI_SPURIOUS_WAKEUP    (1 << 18)
 /* For controllers with a broken beyond repair streams implementation */
 #define XHCI_BROKEN_STREAMS     (1 << 19)
+#define XHCI_PME_STUCK_QUIRK    (1 << 20)
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
         /* There are two roothubs to keep track of bus suspend info for */
diff --git a/drivers/usb/isp1760/isp1760-hcd.c b/drivers/usb/isp1760/isp1760-hcd.c
index eba9b82e2d70..3cb98b1d5d29 100644
--- a/drivers/usb/isp1760/isp1760-hcd.c
+++ b/drivers/usb/isp1760/isp1760-hcd.c
@@ -1274,7 +1274,7 @@ static void errata2_function(unsigned long data)
         for (slot = 0; slot < 32; slot++)
                 if (priv->atl_slots[slot].qh && time_after(jiffies,
                                         priv->atl_slots[slot].timestamp +
-                                        SLOT_TIMEOUT * HZ / 1000)) {
+                                        msecs_to_jiffies(SLOT_TIMEOUT))) {
                         ptd_read(hcd->regs, ATL_PTD_OFFSET, slot, &ptd);
                         if (!FROM_DW0_VALID(ptd.dw0) &&
                                         !FROM_DW3_ACTIVE(ptd.dw3))
@@ -1286,7 +1286,7 @@ static void errata2_function(unsigned long data)
 
         spin_unlock_irqrestore(&priv->lock, spinflags);
 
-        errata2_timer.expires = jiffies + SLOT_CHECK_PERIOD * HZ / 1000;
+        errata2_timer.expires = jiffies + msecs_to_jiffies(SLOT_CHECK_PERIOD);
         add_timer(&errata2_timer);
 }
 
@@ -1336,7 +1336,7 @@ static int isp1760_run(struct usb_hcd *hcd)
                 return retval;
 
         setup_timer(&errata2_timer, errata2_function, (unsigned long)hcd);
-        errata2_timer.expires = jiffies + SLOT_CHECK_PERIOD * HZ / 1000;
+        errata2_timer.expires = jiffies + msecs_to_jiffies(SLOT_CHECK_PERIOD);
         add_timer(&errata2_timer);
 
         chipid = reg_read32(hcd->regs, HC_CHIP_ID_REG);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index e6f4cbfeed97..067920f2d570 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1969,10 +1969,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                 goto fail0;
         }
 
-        pm_runtime_use_autosuspend(musb->controller);
-        pm_runtime_set_autosuspend_delay(musb->controller, 200);
-        pm_runtime_enable(musb->controller);
-
         spin_lock_init(&musb->lock);
         musb->board_set_power = plat->set_power;
         musb->min_power = plat->min_power;
@@ -1991,6 +1987,12 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_readl = musb_default_readl;
         musb_writel = musb_default_writel;
 
+        /* We need musb_read/write functions initialized for PM */
+        pm_runtime_use_autosuspend(musb->controller);
+        pm_runtime_set_autosuspend_delay(musb->controller, 200);
+        pm_runtime_irq_safe(musb->controller);
+        pm_runtime_enable(musb->controller);
+
         /* The musb_platform_init() call:
          *   - adjusts musb->mregs
          *   - sets the musb->isr
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 53bd0e71d19f..a900c9877195 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -457,12 +457,27 @@ static int dsps_musb_init(struct musb *musb)
         if (IS_ERR(musb->xceiv))
                 return PTR_ERR(musb->xceiv);
 
+        musb->phy = devm_phy_get(dev->parent, "usb2-phy");
+
         /* Returns zero if e.g. not clocked */
         rev = dsps_readl(reg_base, wrp->revision);
         if (!rev)
                 return -ENODEV;
 
         usb_phy_init(musb->xceiv);
+        if (IS_ERR(musb->phy))  {
+                musb->phy = NULL;
+        } else {
+                ret = phy_init(musb->phy);
+                if (ret < 0)
+                        return ret;
+                ret = phy_power_on(musb->phy);
+                if (ret) {
+                        phy_exit(musb->phy);
+                        return ret;
+                }
+        }
+
         setup_timer(&glue->timer, otg_timer, (unsigned long) musb);
 
         /* Reset the musb */
@@ -502,6 +517,8 @@ static int dsps_musb_exit(struct musb *musb)
 
         del_timer_sync(&glue->timer);
         usb_phy_shutdown(musb->xceiv);
+        phy_power_off(musb->phy);
+        phy_exit(musb->phy);
         debugfs_remove_recursive(glue->dbgfs_root);
 
         return 0;
@@ -610,7 +627,7 @@ static int dsps_musb_reset(struct musb *musb)
         struct device *dev = musb->controller;
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
-        int session_restart = 0;
+        int session_restart = 0, error;
 
         if (glue->sw_babble_enabled)
                 session_restart = sw_babble_control(musb);
@@ -624,8 +641,14 @@ static int dsps_musb_reset(struct musb *musb)
                 dsps_writel(musb->ctrl_base, wrp->control, (1 << wrp->reset));
                 usleep_range(100, 200);
                 usb_phy_shutdown(musb->xceiv);
+                error = phy_power_off(musb->phy);
+                if (error)
+                        dev_err(dev, "phy shutdown failed: %i\n", error);
                 usleep_range(100, 200);
                 usb_phy_init(musb->xceiv);
+                error = phy_power_on(musb->phy);
+                if (error)
+                        dev_err(dev, "phy powerup failed: %i\n", error);
                 session_restart = 1;
         }
 
@@ -687,7 +710,7 @@ static int dsps_create_musb_pdev(struct dsps_glue *glue,
         struct musb_hdrc_config *config;
         struct platform_device *musb;
         struct device_node *dn = parent->dev.of_node;
-        int ret;
+        int ret, val;
 
         memset(resources, 0, sizeof(resources));
         res = platform_get_resource_byname(parent, IORESOURCE_MEM, "mc");
@@ -739,7 +762,10 @@ static int dsps_create_musb_pdev(struct dsps_glue *glue,
         pdata.mode = get_musb_port_mode(dev);
         /* DT keeps this entry in mA, musb expects it as per USB spec */
         pdata.power = get_int_prop(dn, "mentor,power") / 2;
-        config->multipoint = of_property_read_bool(dn, "mentor,multipoint");
+
+        ret = of_property_read_u32(dn, "mentor,multipoint", &val);
+        if (!ret && val)
+                config->multipoint = true;
 
         ret = platform_device_add_data(musb, &pdata, sizeof(pdata));
         if (ret) {
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 883a9adfdfff..c3d5fc9dfb5b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2613,7 +2613,7 @@ static const struct hc_driver musb_hc_driver = {
         .description            = "musb-hcd",
         .product_desc           = "MUSB HDRC host driver",
         .hcd_priv_size          = sizeof(struct musb *),
-        .flags                  = HCD_USB2 | HCD_MEMORY,
+        .flags                  = HCD_USB2 | HCD_MEMORY | HCD_BH,
 
         /* not using irq handler or reset hooks from usbcore, since
          * those must be shared with peripheral code for OTG configs
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 763649eb4987..cc752d8c7773 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -516,7 +516,7 @@ static int omap2430_probe(struct platform_device *pdev)
         struct omap2430_glue            *glue;
         struct device_node              *np = pdev->dev.of_node;
         struct musb_hdrc_config         *config;
-        int                             ret = -ENOMEM;
+        int                             ret = -ENOMEM, val;
 
         glue = devm_kzalloc(&pdev->dev, sizeof(*glue), GFP_KERNEL);
         if (!glue)
@@ -559,7 +559,10 @@ static int omap2430_probe(struct platform_device *pdev)
                 of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps);
                 of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
                 of_property_read_u32(np, "power", (u32 *)&pdata->power);
-                config->multipoint = of_property_read_bool(np, "multipoint");
+
+                ret = of_property_read_u32(np, "multipoint", &val);
+                if (!ret && val)
+                        config->multipoint = true;
 
                 pdata->board_data       = data;
                 pdata->config           = config;
diff --git a/drivers/usb/renesas_usbhs/Kconfig b/drivers/usb/renesas_usbhs/Kconfig
index de83b9d0cd5c..ebc99ee076ce 100644
--- a/drivers/usb/renesas_usbhs/Kconfig
+++ b/drivers/usb/renesas_usbhs/Kconfig
@@ -6,6 +6,7 @@ config USB_RENESAS_USBHS
         tristate 'Renesas USBHS controller'
         depends on USB_GADGET
         depends on ARCH_SHMOBILE || SUPERH || COMPILE_TEST
+        depends on EXTCON || !EXTCON # if EXTCON=m, USBHS cannot be built-in
         default n
         help
           Renesas USBHS is a discrete USB host and peripheral controller chip
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index 9374bd2aba20..8936a83c96cd 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -38,56 +38,51 @@ static int usb_serial_device_match(struct device *dev,
         return 0;
 }
 
-static ssize_t port_number_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct usb_serial_port *port = to_usb_serial_port(dev);
-
-        return sprintf(buf, "%d\n", port->port_number);
-}
-static DEVICE_ATTR_RO(port_number);
-
 static int usb_serial_device_probe(struct device *dev)
 {
         struct usb_serial_driver *driver;
         struct usb_serial_port *port;
+        struct device *tty_dev;
         int retval = 0;
         int minor;
 
         port = to_usb_serial_port(dev);
-        if (!port) {
-                retval = -ENODEV;
-                goto exit;
-        }
+        if (!port)
+                return -ENODEV;
 
         /* make sure suspend/resume doesn't race against port_probe */
         retval = usb_autopm_get_interface(port->serial->interface);
         if (retval)
-                goto exit;
+                return retval;
 
         driver = port->serial->type;
         if (driver->port_probe) {
                 retval = driver->port_probe(port);
                 if (retval)
-                        goto exit_with_autopm;
+                        goto err_autopm_put;
         }
 
-        retval = device_create_file(dev, &dev_attr_port_number);
-        if (retval) {
-                if (driver->port_remove)
-                        retval = driver->port_remove(port);
-                goto exit_with_autopm;
+        minor = port->minor;
+        tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
+        if (IS_ERR(tty_dev)) {
+                retval = PTR_ERR(tty_dev);
+                goto err_port_remove;
         }
 
-        minor = port->minor;
-        tty_register_device(usb_serial_tty_driver, minor, dev);
+        usb_autopm_put_interface(port->serial->interface);
+
         dev_info(&port->serial->dev->dev,
                  "%s converter now attached to ttyUSB%d\n",
                  driver->description, minor);
 
-exit_with_autopm:
+        return 0;
+
+err_port_remove:
+        if (driver->port_remove)
+                driver->port_remove(port);
+err_autopm_put:
         usb_autopm_put_interface(port->serial->interface);
-exit:
+
         return retval;
 }
 
@@ -114,8 +109,6 @@ static int usb_serial_device_remove(struct device *dev)
         minor = port->minor;
         tty_unregister_device(usb_serial_tty_driver, minor);
 
-        device_remove_file(&port->dev, &dev_attr_port_number);
-
         driver = port->serial->type;
         if (driver->port_remove)
                 retval = driver->port_remove(port);
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 2d72aa3564a3..ede4f5fcfadd 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -84,6 +84,10 @@ struct ch341_private {
         u8 line_status; /* active status of modem control inputs */
 };
 
+static void ch341_set_termios(struct tty_struct *tty,
+                              struct usb_serial_port *port,
+                              struct ktermios *old_termios);
+
 static int ch341_control_out(struct usb_device *dev, u8 request,
                              u16 value, u16 index)
 {
@@ -309,19 +313,12 @@ static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
         struct ch341_private *priv = usb_get_serial_port_data(port);
         int r;
 
-        priv->baud_rate = DEFAULT_BAUD_RATE;
-
         r = ch341_configure(serial->dev, priv);
         if (r)
                 goto out;
 
-        r = ch341_set_handshake(serial->dev, priv->line_control);
-        if (r)
-                goto out;
-
-        r = ch341_set_baudrate(serial->dev, priv);
-        if (r)
-                goto out;
+        if (tty)
+                ch341_set_termios(tty, port, NULL);
 
         dev_dbg(&port->dev, "%s - submitting interrupt urb\n", __func__);
         r = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 29fa1c3d0089..3806e7014199 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -14,6 +14,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/console.h>
@@ -144,6 +145,7 @@ static int usb_console_setup(struct console *co, char *options)
                         init_ldsem(&tty->ldisc_sem);
                         INIT_LIST_HEAD(&tty->tty_files);
                         kref_get(&tty->driver->kref);
+                        __module_get(tty->driver->owner);
                         tty->ops = &usb_console_fake_tty_ops;
                         if (tty_init_termios(tty)) {
                                 retval = -ENOMEM;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f40c856ff758..84ce2d74894c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -147,6 +147,8 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
         { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
         { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
+        { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
+        { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
         { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
         { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
         { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ebb351b9e9a..3086dec0ef53 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -799,6 +799,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
+        { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
@@ -978,6 +980,23 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
         /* GE Healthcare devices */
         { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+        /* Active Research (Actisense) devices */
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
+        { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
+        { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index e52409c9be99..56b1b55c4751 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,9 @@
 
 #define FTDI_LUMEL_PD12_PID     0x6002
 
+/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
+#define CYBER_CORTEX_AV_PID     0x8698
+
 /*
  * Marvell OpenRD Base, Client
  * http://www.open-rd.org
@@ -1438,3 +1441,23 @@
  */
 #define GE_HEALTHCARE_VID               0x1901
 #define GE_HEALTHCARE_NEMO_TRACKER_PID  0x0015
+
+/*
+ * Active Research (Actisense) devices
+ */
+#define ACTISENSE_NDC_PID               0xD9A8 /* NDC USB Serial Adapter */
+#define ACTISENSE_USG_PID               0xD9A9 /* USG USB Serial Adapter */
+#define ACTISENSE_NGT_PID               0xD9AA /* NGT NMEA2000 Interface */
+#define ACTISENSE_NGW_PID               0xD9AB /* NGW NMEA2000 Gateway */
+#define ACTISENSE_D9AC_PID              0xD9AC /* Actisense Reserved */
+#define ACTISENSE_D9AD_PID              0xD9AD /* Actisense Reserved */
+#define ACTISENSE_D9AE_PID              0xD9AE /* Actisense Reserved */
+#define ACTISENSE_D9AF_PID              0xD9AF /* Actisense Reserved */
+#define CHETCO_SEAGAUGE_PID             0xA548 /* SeaGauge USB Adapter */
+#define CHETCO_SEASWITCH_PID            0xA549 /* SeaSwitch USB Adapter */
+#define CHETCO_SEASMART_NMEA2000_PID    0xA54A /* SeaSmart NMEA2000 Gateway */
+#define CHETCO_SEASMART_ETHERNET_PID    0xA54B /* SeaSmart Ethernet Gateway */
+#define CHETCO_SEASMART_WIFI_PID        0xA5AC /* SeaSmart Wifi Gateway */
+#define CHETCO_SEASMART_DISPLAY_PID     0xA5AD /* SeaSmart NMEA2000 Display */
+#define CHETCO_SEASMART_LITE_PID        0xA5AE /* SeaSmart Lite USB Adapter */
+#define CHETCO_SEASMART_ANALOG_PID      0xA5AF /* SeaSmart Analog Adapter */
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index ccf1df7c4b80..54e170dd3dad 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -258,7 +258,8 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
          * character or at least one jiffy.
          */
         period = max_t(unsigned long, (10 * HZ / bps), 1);
-        period = min_t(unsigned long, period, timeout);
+        if (timeout)
+                period = min_t(unsigned long, period, timeout);
 
         dev_dbg(&port->dev, "%s - timeout = %u ms, period = %u ms\n",
                                         __func__, jiffies_to_msecs(timeout),
@@ -268,7 +269,7 @@ void usb_serial_generic_wait_until_sent(struct tty_struct *tty, long timeout)
                 schedule_timeout_interruptible(period);
                 if (signal_pending(current))
                         break;
-                if (time_after(jiffies, expire))
+                if (timeout && time_after(jiffies, expire))
                         break;
         }
 }
diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c
index ab1d690274ae..460a40669967 100644
--- a/drivers/usb/serial/mxuport.c
+++ b/drivers/usb/serial/mxuport.c
@@ -1284,7 +1284,8 @@ static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
         }
 
         /* Initial port termios */
-        mxuport_set_termios(tty, port, NULL);
+        if (tty)
+                mxuport_set_termios(tty, port, NULL);
 
         /*
          * TODO: use RQ_VENDOR_GET_MSR, once we know what it
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 0f872e6b2c87..829604d11f3f 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -132,6 +132,7 @@ MODULE_DEVICE_TABLE(usb, id_table);
 #define UART_OVERRUN_ERROR              0x40
 #define UART_CTS                        0x80
 
+static void pl2303_set_break(struct usb_serial_port *port, bool enable);
 
 enum pl2303_type {
         TYPE_01,        /* Type 0 and 1 (difference unknown) */
@@ -615,6 +616,7 @@ static void pl2303_close(struct usb_serial_port *port)
 {
         usb_serial_generic_close(port);
         usb_kill_urb(port->interrupt_in_urb);
+        pl2303_set_break(port, false);
 }
 
 static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
@@ -741,17 +743,16 @@ static int pl2303_ioctl(struct tty_struct *tty,
         return -ENOIOCTLCMD;
 }
 
-static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
+static void pl2303_set_break(struct usb_serial_port *port, bool enable)
 {
-        struct usb_serial_port *port = tty->driver_data;
         struct usb_serial *serial = port->serial;
         u16 state;
         int result;
 
-        if (break_state == 0)
-                state = BREAK_OFF;
-        else
+        if (enable)
                 state = BREAK_ON;
+        else
+                state = BREAK_OFF;
 
         dev_dbg(&port->dev, "%s - turning break %s\n", __func__,
                         state == BREAK_OFF ? "off" : "on");
@@ -763,6 +764,13 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
                 dev_err(&port->dev, "error sending break = %d\n", result);
 }
 
+static void pl2303_break_ctl(struct tty_struct *tty, int state)
+{
+        struct usb_serial_port *port = tty->driver_data;
+
+        pl2303_set_break(port, state);
+}
+
 static void pl2303_update_line_status(struct usb_serial_port *port,
                                       unsigned char *data,
                                       unsigned int actual_length)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 475723c006f9..529066bbc7e8 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -687,6 +687,21 @@ static void serial_port_dtr_rts(struct tty_port *port, int on)
                 drv->dtr_rts(p, on);
 }
 
+static ssize_t port_number_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct usb_serial_port *port = to_usb_serial_port(dev);
+
+        return sprintf(buf, "%u\n", port->port_number);
+}
+static DEVICE_ATTR_RO(port_number);
+
+static struct attribute *usb_serial_port_attrs[] = {
+        &dev_attr_port_number.attr,
+        NULL
+};
+ATTRIBUTE_GROUPS(usb_serial_port);
+
 static const struct tty_port_operations serial_port_ops = {
         .carrier_raised         = serial_port_carrier_raised,
         .dtr_rts                = serial_port_dtr_rts,
@@ -902,6 +917,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port->dev.driver = NULL;
                 port->dev.bus = &usb_serial_bus_type;
                 port->dev.release = &usb_serial_port_release;
+                port->dev.groups = usb_serial_port_groups;
                 device_initialize(&port->dev);
         }
 
@@ -940,8 +956,9 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port = serial->port[i];
                 if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
                         goto probe_error;
-                buffer_size = max_t(int, serial->type->bulk_out_size,
-                                                usb_endpoint_maxp(endpoint));
+                buffer_size = serial->type->bulk_out_size;
+                if (!buffer_size)
+                        buffer_size = usb_endpoint_maxp(endpoint);
                 port->bulk_out_size = buffer_size;
                 port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
 
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index dbc00e56c7f5..82570425fdfe 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+                "JMicron",
+                "JMS539",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_REPORT_OPCODES),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index d468d02179f4..5600c33fcadb 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -889,6 +889,12 @@ static void usb_stor_scan_dwork(struct work_struct *work)
             !(us->fflags & US_FL_SCM_MULT_TARG)) {
                 mutex_lock(&us->dev_mutex);
                 us->max_lun = usb_stor_Bulk_max_lun(us);
+                /*
+                 * Allow proper scanning of devices that present more than 8 LUNs
+                 * While not affecting other devices that may need the previous behavior
+                 */
+                if (us->max_lun >= 8)
+                        us_to_host(us)->max_lun = us->max_lun+1;
                 mutex_unlock(&us->dev_mutex);
         }
         scsi_scan_host(us_to_host(us));
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index afa06d28725d..2bbfc25e582c 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -591,11 +591,6 @@ static void handle_rx(struct vhost_net *net)
                          * TODO: support TSO.
                          */
                         iov_iter_advance(&msg.msg_iter, vhost_hlen);
-                } else {
-                        /* It'll come from socket; we'll need to patch
-                         * ->num_buffers over if VIRTIO_NET_F_MRG_RXBUF
-                         */
-                        iov_iter_advance(&fixup, sizeof(hdr));
                 }
                 err = sock->ops->recvmsg(NULL, sock, &msg,
                                          sock_len, MSG_DONTWAIT | MSG_TRUNC);
@@ -609,17 +604,25 @@ static void handle_rx(struct vhost_net *net)
                         continue;
                 }
                 /* Supply virtio_net_hdr if VHOST_NET_F_VIRTIO_NET_HDR */
-                if (unlikely(vhost_hlen) &&
-                    copy_to_iter(&hdr, sizeof(hdr), &fixup) != sizeof(hdr)) {
-                        vq_err(vq, "Unable to write vnet_hdr at addr %p\n",
-                               vq->iov->iov_base);
-                        break;
+                if (unlikely(vhost_hlen)) {
+                        if (copy_to_iter(&hdr, sizeof(hdr),
+                                         &fixup) != sizeof(hdr)) {
+                                vq_err(vq, "Unable to write vnet_hdr "
+                                       "at addr %p\n", vq->iov->iov_base);
+                                break;
+                        }
+                } else {
+                        /* Header came from socket; we'll need to patch
+                         * ->num_buffers over if VIRTIO_NET_F_MRG_RXBUF
+                         */
+                        iov_iter_advance(&fixup, sizeof(hdr));
                 }
                 /* TODO: Should check and handle checksum. */
 
                 num_buffers = cpu_to_vhost16(vq, headcount);
                 if (likely(mergeable) &&
-                    copy_to_iter(&num_buffers, 2, &fixup) != 2) {
+                    copy_to_iter(&num_buffers, sizeof num_buffers,
+                                 &fixup) != sizeof num_buffers) {
                         vq_err(vq, "Failed num_buffers write");
                         vhost_discard_vq_desc(vq, headcount);
                         break;
diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
index 32c0b6b28097..9362424c2340 100644
--- a/drivers/video/fbdev/amba-clcd.c
+++ b/drivers/video/fbdev/amba-clcd.c
@@ -599,6 +599,9 @@ static int clcdfb_of_get_mode(struct device *dev, struct device_node *endpoint,
 
         len = clcdfb_snprintf_mode(NULL, 0, mode);
         name = devm_kzalloc(dev, len + 1, GFP_KERNEL);
+        if (!name)
+                return -ENOMEM;
+
         clcdfb_snprintf_mode(name, len + 1, mode);
         mode->name = name;
 
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 95338593ebf4..868facdec638 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -624,9 +624,6 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
         int num = 0, i, first = 1;
         int ver, rev;
 
-        ver = edid[EDID_STRUCT_VERSION];
-        rev = edid[EDID_STRUCT_REVISION];
-
         mode = kzalloc(50 * sizeof(struct fb_videomode), GFP_KERNEL);
         if (mode == NULL)
                 return NULL;
@@ -637,6 +634,9 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
                 return NULL;
         }
 
+        ver = edid[EDID_STRUCT_VERSION];
+        rev = edid[EDID_STRUCT_REVISION];
+
         *dbsize = 0;
 
         DPRINTK("   Detailed Timings\n");
diff --git a/drivers/video/fbdev/omap2/dss/display-sysfs.c b/drivers/video/fbdev/omap2/dss/display-sysfs.c
index 5a2095a98ed8..12186557a9d4 100644
--- a/drivers/video/fbdev/omap2/dss/display-sysfs.c
+++ b/drivers/video/fbdev/omap2/dss/display-sysfs.c
@@ -28,44 +28,22 @@
 #include <video/omapdss.h>
 #include "dss.h"
 
-static struct omap_dss_device *to_dss_device_sysfs(struct device *dev)
+static ssize_t display_name_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = NULL;
-
-        for_each_dss_dev(dssdev) {
-                if (dssdev->dev == dev) {
-                        omap_dss_put_device(dssdev);
-                        return dssdev;
-                }
-        }
-
-        return NULL;
-}
-
-static ssize_t display_name_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
-
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         dssdev->name ?
                         dssdev->name : "");
 }
 
-static ssize_t display_enabled_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_enabled_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
-
         return snprintf(buf, PAGE_SIZE, "%d\n",
                         omapdss_device_is_enabled(dssdev));
 }
 
-static ssize_t display_enabled_store(struct device *dev,
-                struct device_attribute *attr,
+static ssize_t display_enabled_store(struct omap_dss_device *dssdev,
                 const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int r;
         bool enable;
 
@@ -90,19 +68,16 @@ static ssize_t display_enabled_store(struct device *dev,
         return size;
 }
 
-static ssize_t display_tear_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_tear_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         return snprintf(buf, PAGE_SIZE, "%d\n",
                         dssdev->driver->get_te ?
                         dssdev->driver->get_te(dssdev) : 0);
 }
 
-static ssize_t display_tear_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t size)
+static ssize_t display_tear_store(struct omap_dss_device *dssdev,
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int r;
         bool te;
 
@@ -120,10 +95,8 @@ static ssize_t display_tear_store(struct device *dev,
         return size;
 }
 
-static ssize_t display_timings_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_timings_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         struct omap_video_timings t;
 
         if (!dssdev->driver->get_timings)
@@ -137,10 +110,9 @@ static ssize_t display_timings_show(struct device *dev,
                         t.y_res, t.vfp, t.vbp, t.vsw);
 }
 
-static ssize_t display_timings_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t size)
+static ssize_t display_timings_store(struct omap_dss_device *dssdev,
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         struct omap_video_timings t = dssdev->panel.timings;
         int r, found;
 
@@ -176,10 +148,8 @@ static ssize_t display_timings_store(struct device *dev,
         return size;
 }
 
-static ssize_t display_rotate_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_rotate_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int rotate;
         if (!dssdev->driver->get_rotate)
                 return -ENOENT;
@@ -187,10 +157,9 @@ static ssize_t display_rotate_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%u\n", rotate);
 }
 
-static ssize_t display_rotate_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t size)
+static ssize_t display_rotate_store(struct omap_dss_device *dssdev,
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int rot, r;
 
         if (!dssdev->driver->set_rotate || !dssdev->driver->get_rotate)
@@ -207,10 +176,8 @@ static ssize_t display_rotate_store(struct device *dev,
         return size;
 }
 
-static ssize_t display_mirror_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_mirror_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int mirror;
         if (!dssdev->driver->get_mirror)
                 return -ENOENT;
@@ -218,10 +185,9 @@ static ssize_t display_mirror_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%u\n", mirror);
 }
 
-static ssize_t display_mirror_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t size)
+static ssize_t display_mirror_store(struct omap_dss_device *dssdev,
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         int r;
         bool mirror;
 
@@ -239,10 +205,8 @@ static ssize_t display_mirror_store(struct device *dev,
         return size;
 }
 
-static ssize_t display_wss_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
+static ssize_t display_wss_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         unsigned int wss;
 
         if (!dssdev->driver->get_wss)
@@ -253,10 +217,9 @@ static ssize_t display_wss_show(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "0x%05x\n", wss);
 }
 
-static ssize_t display_wss_store(struct device *dev,
-                struct device_attribute *attr, const char *buf, size_t size)
+static ssize_t display_wss_store(struct omap_dss_device *dssdev,
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
         u32 wss;
         int r;
 
@@ -277,50 +240,94 @@ static ssize_t display_wss_store(struct device *dev,
         return size;
 }
 
-static DEVICE_ATTR(display_name, S_IRUGO, display_name_show, NULL);
-static DEVICE_ATTR(enabled, S_IRUGO|S_IWUSR,
+struct display_attribute {
+        struct attribute attr;
+        ssize_t (*show)(struct omap_dss_device *, char *);
+        ssize_t (*store)(struct omap_dss_device *, const char *, size_t);
+};
+
+#define DISPLAY_ATTR(_name, _mode, _show, _store) \
+        struct display_attribute display_attr_##_name = \
+        __ATTR(_name, _mode, _show, _store)
+
+static DISPLAY_ATTR(name, S_IRUGO, display_name_show, NULL);
+static DISPLAY_ATTR(display_name, S_IRUGO, display_name_show, NULL);
+static DISPLAY_ATTR(enabled, S_IRUGO|S_IWUSR,
                 display_enabled_show, display_enabled_store);
-static DEVICE_ATTR(tear_elim, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(tear_elim, S_IRUGO|S_IWUSR,
                 display_tear_show, display_tear_store);
-static DEVICE_ATTR(timings, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(timings, S_IRUGO|S_IWUSR,
                 display_timings_show, display_timings_store);
-static DEVICE_ATTR(rotate, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(rotate, S_IRUGO|S_IWUSR,
                 display_rotate_show, display_rotate_store);
-static DEVICE_ATTR(mirror, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(mirror, S_IRUGO|S_IWUSR,
                 display_mirror_show, display_mirror_store);
-static DEVICE_ATTR(wss, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(wss, S_IRUGO|S_IWUSR,
                 display_wss_show, display_wss_store);
 
-static const struct attribute *display_sysfs_attrs[] = {
-        &dev_attr_display_name.attr,
-        &dev_attr_enabled.attr,
-        &dev_attr_tear_elim.attr,
-        &dev_attr_timings.attr,
-        &dev_attr_rotate.attr,
-        &dev_attr_mirror.attr,
-        &dev_attr_wss.attr,
+static struct attribute *display_sysfs_attrs[] = {
+        &display_attr_name.attr,
+        &display_attr_display_name.attr,
+        &display_attr_enabled.attr,
+        &display_attr_tear_elim.attr,
+        &display_attr_timings.attr,
+        &display_attr_rotate.attr,
+        &display_attr_mirror.attr,
+        &display_attr_wss.attr,
         NULL
 };
 
+static ssize_t display_attr_show(struct kobject *kobj, struct attribute *attr,
+                char *buf)
+{
+        struct omap_dss_device *dssdev;
+        struct display_attribute *display_attr;
+
+        dssdev = container_of(kobj, struct omap_dss_device, kobj);
+        display_attr = container_of(attr, struct display_attribute, attr);
+
+        if (!display_attr->show)
+                return -ENOENT;
+
+        return display_attr->show(dssdev, buf);
+}
+
+static ssize_t display_attr_store(struct kobject *kobj, struct attribute *attr,
+                const char *buf, size_t size)
+{
+        struct omap_dss_device *dssdev;
+        struct display_attribute *display_attr;
+
+        dssdev = container_of(kobj, struct omap_dss_device, kobj);
+        display_attr = container_of(attr, struct display_attribute, attr);
+
+        if (!display_attr->store)
+                return -ENOENT;
+
+        return display_attr->store(dssdev, buf, size);
+}
+
+static const struct sysfs_ops display_sysfs_ops = {
+        .show = display_attr_show,
+        .store = display_attr_store,
+};
+
+static struct kobj_type display_ktype = {
+        .sysfs_ops = &display_sysfs_ops,
+        .default_attrs = display_sysfs_attrs,
+};
+
 int display_init_sysfs(struct platform_device *pdev)
 {
         struct omap_dss_device *dssdev = NULL;
         int r;
 
         for_each_dss_dev(dssdev) {
-                struct kobject *kobj = &dssdev->dev->kobj;
-
-                r = sysfs_create_files(kobj, display_sysfs_attrs);
+                r = kobject_init_and_add(&dssdev->kobj, &display_ktype,
+                        &pdev->dev.kobj, dssdev->alias);
                 if (r) {
                         DSSERR("failed to create sysfs files\n");
-                        goto err;
-                }
-
-                r = sysfs_create_link(&pdev->dev.kobj, kobj, dssdev->alias);
-                if (r) {
-                        sysfs_remove_files(kobj, display_sysfs_attrs);
-
-                        DSSERR("failed to create sysfs display link\n");
+                        omap_dss_put_device(dssdev);
                         goto err;
                 }
         }
@@ -338,8 +345,12 @@ void display_uninit_sysfs(struct platform_device *pdev)
         struct omap_dss_device *dssdev = NULL;
 
         for_each_dss_dev(dssdev) {
-                sysfs_remove_link(&pdev->dev.kobj, dssdev->alias);
-                sysfs_remove_files(&dssdev->dev->kobj,
-                                display_sysfs_attrs);
+                if (kobject_name(&dssdev->kobj) == NULL)
+                        continue;
+
+                kobject_del(&dssdev->kobj);
+                kobject_put(&dssdev->kobj);
+
+                memset(&dssdev->kobj, 0, sizeof(dssdev->kobj));
         }
 }
diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c
index 6df940528fd2..1443b3c391de 100644
--- a/drivers/watchdog/at91sam9_wdt.c
+++ b/drivers/watchdog/at91sam9_wdt.c
@@ -208,7 +208,8 @@ static int at91_wdt_init(struct platform_device *pdev, struct at91wdt *wdt)
 
         if ((tmp & AT91_WDT_WDFIEN) && wdt->irq) {
                 err = request_irq(wdt->irq, wdt_interrupt,
-                                  IRQF_SHARED | IRQF_IRQPOLL,
+                                  IRQF_SHARED | IRQF_IRQPOLL |
+                                  IRQF_NO_SUSPEND,
                                   pdev->name, wdt);
                 if (err)
                         return err;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 2140398a2a8c..2ccd3592d41f 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -2,7 +2,7 @@ ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o balloon.o manage.o
+obj-y   += grant-table.o features.o balloon.o manage.o preempt.o
 obj-y   += events/
 obj-y   += xenbus/
 
diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
new file mode 100644
index 000000000000..a1800c150839
--- /dev/null
+++ b/drivers/xen/preempt.c
@@ -0,0 +1,44 @@
+/*
+ * Preemptible hypercalls
+ *
+ * Copyright (C) 2014 Citrix Systems R&D ltd.
+ *
+ * This source code is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ */
+
+#include <linux/sched.h>
+#include <xen/xen-ops.h>
+
+#ifndef CONFIG_PREEMPT
+
+/*
+ * Some hypercalls issued by the toolstack can take many 10s of
+ * seconds. Allow tasks running hypercalls via the privcmd driver to
+ * be voluntarily preempted even if full kernel preemption is
+ * disabled.
+ *
+ * Such preemptible hypercalls are bracketed by
+ * xen_preemptible_hcall_begin() and xen_preemptible_hcall_end()
+ * calls.
+ */
+
+DEFINE_PER_CPU(bool, xen_in_preemptible_hcall);
+EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
+
+asmlinkage __visible void xen_maybe_preempt_hcall(void)
+{
+        if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
+                     && should_resched())) {
+                /*
+                 * Clear flag as we may be rescheduled on a different
+                 * cpu.
+                 */
+                __this_cpu_write(xen_in_preemptible_hcall, false);
+                _cond_resched();
+                __this_cpu_write(xen_in_preemptible_hcall, true);
+        }
+}
+#endif /* CONFIG_PREEMPT */
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 569a13b9e856..59ac71c4a043 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -56,10 +56,12 @@ static long privcmd_ioctl_hypercall(void __user *udata)
         if (copy_from_user(&hypercall, udata, sizeof(hypercall)))
                 return -EFAULT;
 
+        xen_preemptible_hcall_begin();
         ret = privcmd_call(hypercall.op,
                            hypercall.arg[0], hypercall.arg[1],
                            hypercall.arg[2], hypercall.arg[3],
                            hypercall.arg[4]);
+        xen_preemptible_hcall_end();
 
         return ret;
 }
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 61653a03a8f5..9faca6a60bb0 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -709,12 +709,11 @@ static int prepare_pending_reqs(struct vscsibk_info *info,
 static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 {
         struct vscsiif_back_ring *ring = &info->ring;
-        struct vscsiif_request *ring_req;
+        struct vscsiif_request ring_req;
         struct vscsibk_pend *pending_req;
         RING_IDX rc, rp;
         int err, more_to_do;
         uint32_t result;
-        uint8_t act;
 
         rc = ring->req_cons;
         rp = ring->sring->req_prod;
@@ -735,11 +734,10 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                 if (!pending_req)
                         return 1;
 
-                ring_req = RING_GET_REQUEST(ring, rc);
+                ring_req = *RING_GET_REQUEST(ring, rc);
                 ring->req_cons = ++rc;
 
-                act = ring_req->act;
-                err = prepare_pending_reqs(info, ring_req, pending_req);
+                err = prepare_pending_reqs(info, &ring_req, pending_req);
                 if (err) {
                         switch (err) {
                         case -ENODEV:
@@ -755,9 +753,9 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         return 1;
                 }
 
-                switch (act) {
+                switch (ring_req.act) {
                 case VSCSIIF_ACT_SCSI_CDB:
-                        if (scsiback_gnttab_data_map(ring_req, pending_req)) {
+                        if (scsiback_gnttab_data_map(&ring_req, pending_req)) {
                                 scsiback_fast_flush_area(pending_req);
                                 scsiback_do_resp_with_sense(NULL,
                                         DRIVER_ERROR << 24, 0, pending_req);
@@ -768,7 +766,7 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
                         break;
                 case VSCSIIF_ACT_SCSI_ABORT:
                         scsiback_device_action(pending_req, TMR_ABORT_TASK,
-                                ring_req->ref_rqid);
+                                ring_req.ref_rqid);
                         break;
                 case VSCSIIF_ACT_SCSI_RESET:
                         scsiback_device_action(pending_req, TMR_LUN_RESET, 0);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 993642199326..6d67f32e648d 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1645,14 +1645,14 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
 
         parent_nritems = btrfs_header_nritems(parent);
         blocksize = root->nodesize;
-        end_slot = parent_nritems;
+        end_slot = parent_nritems - 1;
 
-        if (parent_nritems == 1)
+        if (parent_nritems <= 1)
                 return 0;
 
         btrfs_set_lock_blocking(parent);
 
-        for (i = start_slot; i < end_slot; i++) {
+        for (i = start_slot; i <= end_slot; i++) {
                 int close = 1;
 
                 btrfs_node_key(parent, &disk_key, i);
@@ -1669,7 +1669,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
                         other = btrfs_node_blockptr(parent, i - 1);
                         close = close_blocks(blocknr, other, blocksize);
                 }
-                if (!close && i < end_slot - 2) {
+                if (!close && i < end_slot) {
                         other = btrfs_node_blockptr(parent, i + 1);
                         close = close_blocks(blocknr, other, blocksize);
                 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 571f402d3fc4..6f080451fcb1 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3208,6 +3208,8 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group,
                 return 0;
         }
 
+        if (trans->aborted)
+                return 0;
 again:
         inode = lookup_free_space_inode(root, block_group, path);
         if (IS_ERR(inode) && PTR_ERR(inode) != -ENOENT) {
@@ -3243,6 +3245,20 @@ again:
          */
         BTRFS_I(inode)->generation = 0;
         ret = btrfs_update_inode(trans, root, inode);
+        if (ret) {
+                /*
+                 * So theoretically we could recover from this, simply set the
+                 * super cache generation to 0 so we know to invalidate the
+                 * cache, but then we'd have to keep track of the block groups
+                 * that fail this way so we know we _have_ to reset this cache
+                 * before the next commit or risk reading stale cache.  So to
+                 * limit our exposure to horrible edge cases lets just abort the
+                 * transaction, this only happens in really bad situations
+                 * anyway.
+                 */
+                btrfs_abort_transaction(trans, root, ret);
+                goto out_put;
+        }
         WARN_ON(ret);
 
         if (i_size_read(inode) > 0) {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index b78bbbac900d..30982bbd31c3 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1811,22 +1811,10 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
         mutex_unlock(&inode->i_mutex);
 
         /*
-         * we want to make sure fsync finds this change
-         * but we haven't joined a transaction running right now.
-         *
-         * Later on, someone is sure to update the inode and get the
-         * real transid recorded.
-         *
-         * We set last_trans now to the fs_info generation + 1,
-         * this will either be one more than the running transaction
-         * or the generation used for the next transaction if there isn't
-         * one running right now.
-         *
          * We also have to set last_sub_trans to the current log transid,
          * otherwise subsequent syncs to a file that's been synced in this
          * transaction will appear to have already occured.
          */
-        BTRFS_I(inode)->last_trans = root->fs_info->generation + 1;
         BTRFS_I(inode)->last_sub_trans = root->log_transid;
         if (num_written > 0) {
                 err = generic_write_sync(file, pos, num_written);
@@ -1959,25 +1947,37 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         atomic_inc(&root->log_batch);
 
         /*
-         * check the transaction that last modified this inode
-         * and see if its already been committed
-         */
-        if (!BTRFS_I(inode)->last_trans) {
-                mutex_unlock(&inode->i_mutex);
-                goto out;
-        }
-
-        /*
-         * if the last transaction that changed this file was before
-         * the current transaction, we can bail out now without any
-         * syncing
+         * If the last transaction that changed this file was before the current
+         * transaction and we have the full sync flag set in our inode, we can
+         * bail out now without any syncing.
+         *
+         * Note that we can't bail out if the full sync flag isn't set. This is
+         * because when the full sync flag is set we start all ordered extents
+         * and wait for them to fully complete - when they complete they update
+         * the inode's last_trans field through:
+         *
+         *     btrfs_finish_ordered_io() ->
+         *         btrfs_update_inode_fallback() ->
+         *             btrfs_update_inode() ->
+         *                 btrfs_set_inode_last_trans()
+         *
+         * So we are sure that last_trans is up to date and can do this check to
+         * bail out safely. For the fast path, when the full sync flag is not
+         * set in our inode, we can not do it because we start only our ordered
+         * extents and don't wait for them to complete (that is when
+         * btrfs_finish_ordered_io runs), so here at this point their last_trans
+         * value might be less than or equals to fs_info->last_trans_committed,
+         * and setting a speculative last_trans for an inode when a buffered
+         * write is made (such as fs_info->generation + 1 for example) would not
+         * be reliable since after setting the value and before fsync is called
+         * any number of transactions can start and commit (transaction kthread
+         * commits the current transaction periodically), and a transaction
+         * commit does not start nor waits for ordered extents to complete.
          */
         smp_mb();
         if (btrfs_inode_in_log(inode, root->fs_info->generation) ||
-            BTRFS_I(inode)->last_trans <=
-            root->fs_info->last_trans_committed) {
-                BTRFS_I(inode)->last_trans = 0;
-
+            (full_sync && BTRFS_I(inode)->last_trans <=
+             root->fs_info->last_trans_committed)) {
                 /*
                  * We'v had everything committed since the last time we were
                  * modified so clear this flag in case it was set for whatever
@@ -2275,6 +2275,8 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
         bool same_page;
         bool no_holes = btrfs_fs_incompat(root->fs_info, NO_HOLES);
         u64 ino_size;
+        bool truncated_page = false;
+        bool updated_inode = false;
 
         ret = btrfs_wait_ordered_range(inode, offset, len);
         if (ret)
@@ -2306,13 +2308,18 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
          * entire page.
          */
         if (same_page && len < PAGE_CACHE_SIZE) {
-                if (offset < ino_size)
+                if (offset < ino_size) {
+                        truncated_page = true;
                         ret = btrfs_truncate_page(inode, offset, len, 0);
+                } else {
+                        ret = 0;
+                }
                 goto out_only_mutex;
         }
 
         /* zero back part of the first page */
         if (offset < ino_size) {
+                truncated_page = true;
                 ret = btrfs_truncate_page(inode, offset, 0, 0);
                 if (ret) {
                         mutex_unlock(&inode->i_mutex);
@@ -2348,6 +2355,7 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
                 if (!ret) {
                         /* zero the front end of the last page */
                         if (tail_start + tail_len < ino_size) {
+                                truncated_page = true;
                                 ret = btrfs_truncate_page(inode,
                                                 tail_start + tail_len, 0, 1);
                                 if (ret)
@@ -2357,8 +2365,8 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
         }
 
         if (lockend < lockstart) {
-                mutex_unlock(&inode->i_mutex);
-                return 0;
+                ret = 0;
+                goto out_only_mutex;
         }
 
         while (1) {
@@ -2506,6 +2514,7 @@ out_trans:
 
         trans->block_rsv = &root->fs_info->trans_block_rsv;
         ret = btrfs_update_inode(trans, root, inode);
+        updated_inode = true;
         btrfs_end_transaction(trans, root);
         btrfs_btree_balance_dirty(root);
 out_free:
@@ -2515,6 +2524,22 @@ out:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                              &cached_state, GFP_NOFS);
 out_only_mutex:
+        if (!updated_inode && truncated_page && !ret && !err) {
+                /*
+                 * If we only end up zeroing part of a page, we still need to
+                 * update the inode item, so that all the time fields are
+                 * updated as well as the necessary btrfs inode in memory fields
+                 * for detecting, at fsync time, if the inode isn't yet in the
+                 * log tree or it's there but not up to date.
+                 */
+                trans = btrfs_start_transaction(root, 1);
+                if (IS_ERR(trans)) {
+                        err = PTR_ERR(trans);
+                } else {
+                        err = btrfs_update_inode(trans, root, inode);
+                        ret = btrfs_end_transaction(trans, root);
+                }
+        }
         mutex_unlock(&inode->i_mutex);
         if (ret && !err)
                 err = ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index a85c23dfcddb..da828cf5e8f8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7285,7 +7285,6 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
             ((BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) &&
              em->block_start != EXTENT_MAP_HOLE)) {
                 int type;
-                int ret;
                 u64 block_start, orig_start, orig_block_len, ram_bytes;
 
                 if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 534544e08f76..157cc54fc634 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -452,9 +452,7 @@ void btrfs_get_logged_extents(struct inode *inode,
                         continue;
                 if (entry_end(ordered) <= start)
                         break;
-                if (!list_empty(&ordered->log_list))
-                        continue;
-                if (test_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
+                if (test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
                         continue;
                 list_add(&ordered->log_list, logged_list);
                 atomic_inc(&ordered->refs);
@@ -511,8 +509,7 @@ void btrfs_wait_logged_extents(struct btrfs_trans_handle *trans,
                 wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
                                                    &ordered->flags));
 
-                if (!test_and_set_bit(BTRFS_ORDERED_LOGGED, &ordered->flags))
-                        list_add_tail(&ordered->trans_list, &trans->ordered);
+                list_add_tail(&ordered->trans_list, &trans->ordered);
                 spin_lock_irq(&log->log_extents_lock[index]);
         }
         spin_unlock_irq(&log->log_extents_lock[index]);
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index fe5857223515..d6033f540cc7 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -230,6 +230,7 @@ struct pending_dir_move {
         u64 parent_ino;
         u64 ino;
         u64 gen;
+        bool is_orphan;
         struct list_head update_refs;
 };
 
@@ -2984,7 +2985,8 @@ static int add_pending_dir_move(struct send_ctx *sctx,
                                 u64 ino_gen,
                                 u64 parent_ino,
                                 struct list_head *new_refs,
-                                struct list_head *deleted_refs)
+                                struct list_head *deleted_refs,
+                                const bool is_orphan)
 {
         struct rb_node **p = &sctx->pending_dir_moves.rb_node;
         struct rb_node *parent = NULL;
@@ -2999,6 +3001,7 @@ static int add_pending_dir_move(struct send_ctx *sctx,
         pm->parent_ino = parent_ino;
         pm->ino = ino;
         pm->gen = ino_gen;
+        pm->is_orphan = is_orphan;
         INIT_LIST_HEAD(&pm->list);
         INIT_LIST_HEAD(&pm->update_refs);
         RB_CLEAR_NODE(&pm->node);
@@ -3131,16 +3134,20 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
         rmdir_ino = dm->rmdir_ino;
         free_waiting_dir_move(sctx, dm);
 
-        ret = get_first_ref(sctx->parent_root, pm->ino,
-                            &parent_ino, &parent_gen, name);
-        if (ret < 0)
-                goto out;
-
-        ret = get_cur_path(sctx, parent_ino, parent_gen,
-                           from_path);
-        if (ret < 0)
-                goto out;
-        ret = fs_path_add_path(from_path, name);
+        if (pm->is_orphan) {
+                ret = gen_unique_name(sctx, pm->ino,
+                                      pm->gen, from_path);
+        } else {
+                ret = get_first_ref(sctx->parent_root, pm->ino,
+                                    &parent_ino, &parent_gen, name);
+                if (ret < 0)
+                        goto out;
+                ret = get_cur_path(sctx, parent_ino, parent_gen,
+                                   from_path);
+                if (ret < 0)
+                        goto out;
+                ret = fs_path_add_path(from_path, name);
+        }
         if (ret < 0)
                 goto out;
 
@@ -3150,7 +3157,8 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
                 LIST_HEAD(deleted_refs);
                 ASSERT(ancestor > BTRFS_FIRST_FREE_OBJECTID);
                 ret = add_pending_dir_move(sctx, pm->ino, pm->gen, ancestor,
-                                           &pm->update_refs, &deleted_refs);
+                                           &pm->update_refs, &deleted_refs,
+                                           pm->is_orphan);
                 if (ret < 0)
                         goto out;
                 if (rmdir_ino) {
@@ -3283,6 +3291,127 @@ out:
         return ret;
 }
 
+/*
+ * We might need to delay a directory rename even when no ancestor directory
+ * (in the send root) with a higher inode number than ours (sctx->cur_ino) was
+ * renamed. This happens when we rename a directory to the old name (the name
+ * in the parent root) of some other unrelated directory that got its rename
+ * delayed due to some ancestor with higher number that got renamed.
+ *
+ * Example:
+ *
+ * Parent snapshot:
+ * .                                       (ino 256)
+ * |---- a/                                (ino 257)
+ * |     |---- file                        (ino 260)
+ * |
+ * |---- b/                                (ino 258)
+ * |---- c/                                (ino 259)
+ *
+ * Send snapshot:
+ * .                                       (ino 256)
+ * |---- a/                                (ino 258)
+ * |---- x/                                (ino 259)
+ *       |---- y/                          (ino 257)
+ *             |----- file                 (ino 260)
+ *
+ * Here we can not rename 258 from 'b' to 'a' without the rename of inode 257
+ * from 'a' to 'x/y' happening first, which in turn depends on the rename of
+ * inode 259 from 'c' to 'x'. So the order of rename commands the send stream
+ * must issue is:
+ *
+ * 1 - rename 259 from 'c' to 'x'
+ * 2 - rename 257 from 'a' to 'x/y'
+ * 3 - rename 258 from 'b' to 'a'
+ *
+ * Returns 1 if the rename of sctx->cur_ino needs to be delayed, 0 if it can
+ * be done right away and < 0 on error.
+ */
+static int wait_for_dest_dir_move(struct send_ctx *sctx,
+                                  struct recorded_ref *parent_ref,
+                                  const bool is_orphan)
+{
+        struct btrfs_path *path;
+        struct btrfs_key key;
+        struct btrfs_key di_key;
+        struct btrfs_dir_item *di;
+        u64 left_gen;
+        u64 right_gen;
+        int ret = 0;
+
+        if (RB_EMPTY_ROOT(&sctx->waiting_dir_moves))
+                return 0;
+
+        path = alloc_path_for_send();
+        if (!path)
+                return -ENOMEM;
+
+        key.objectid = parent_ref->dir;
+        key.type = BTRFS_DIR_ITEM_KEY;
+        key.offset = btrfs_name_hash(parent_ref->name, parent_ref->name_len);
+
+        ret = btrfs_search_slot(NULL, sctx->parent_root, &key, path, 0, 0);
+        if (ret < 0) {
+                goto out;
+        } else if (ret > 0) {
+                ret = 0;
+                goto out;
+        }
+
+        di = btrfs_match_dir_item_name(sctx->parent_root, path,
+                                       parent_ref->name, parent_ref->name_len);
+        if (!di) {
+                ret = 0;
+                goto out;
+        }
+        /*
+         * di_key.objectid has the number of the inode that has a dentry in the
+         * parent directory with the same name that sctx->cur_ino is being
+         * renamed to. We need to check if that inode is in the send root as
+         * well and if it is currently marked as an inode with a pending rename,
+         * if it is, we need to delay the rename of sctx->cur_ino as well, so
+         * that it happens after that other inode is renamed.
+         */
+        btrfs_dir_item_key_to_cpu(path->nodes[0], di, &di_key);
+        if (di_key.type != BTRFS_INODE_ITEM_KEY) {
+                ret = 0;
+                goto out;
+        }
+
+        ret = get_inode_info(sctx->parent_root, di_key.objectid, NULL,
+                             &left_gen, NULL, NULL, NULL, NULL);
+        if (ret < 0)
+                goto out;
+        ret = get_inode_info(sctx->send_root, di_key.objectid, NULL,
+                             &right_gen, NULL, NULL, NULL, NULL);
+        if (ret < 0) {
+                if (ret == -ENOENT)
+                        ret = 0;
+                goto out;
+        }
+
+        /* Different inode, no need to delay the rename of sctx->cur_ino */
+        if (right_gen != left_gen) {
+                ret = 0;
+                goto out;
+        }
+
+        if (is_waiting_for_move(sctx, di_key.objectid)) {
+                ret = add_pending_dir_move(sctx,
+                                           sctx->cur_ino,
+                                           sctx->cur_inode_gen,
+                                           di_key.objectid,
+                                           &sctx->new_refs,
+                                           &sctx->deleted_refs,
+                                           is_orphan);
+                if (!ret)
+                        ret = 1;
+        }
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
 static int wait_for_parent_move(struct send_ctx *sctx,
                                 struct recorded_ref *parent_ref)
 {
@@ -3349,7 +3478,8 @@ out:
                                            sctx->cur_inode_gen,
                                            ino,
                                            &sctx->new_refs,
-                                           &sctx->deleted_refs);
+                                           &sctx->deleted_refs,
+                                           false);
                 if (!ret)
                         ret = 1;
         }
@@ -3372,6 +3502,7 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move)
         int did_overwrite = 0;
         int is_orphan = 0;
         u64 last_dir_ino_rm = 0;
+        bool can_rename = true;
 
 verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
 
@@ -3490,12 +3621,22 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                         }
                 }
 
+                if (S_ISDIR(sctx->cur_inode_mode) && sctx->parent_root) {
+                        ret = wait_for_dest_dir_move(sctx, cur, is_orphan);
+                        if (ret < 0)
+                                goto out;
+                        if (ret == 1) {
+                                can_rename = false;
+                                *pending_move = 1;
+                        }
+                }
+
                 /*
                  * link/move the ref to the new place. If we have an orphan
                  * inode, move it and update valid_path. If not, link or move
                  * it depending on the inode mode.
                  */
-                if (is_orphan) {
+                if (is_orphan && can_rename) {
                         ret = send_rename(sctx, valid_path, cur->full_path);
                         if (ret < 0)
                                 goto out;
@@ -3503,7 +3644,7 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                         ret = fs_path_copy(valid_path, cur->full_path);
                         if (ret < 0)
                                 goto out;
-                } else {
+                } else if (can_rename) {
                         if (S_ISDIR(sctx->cur_inode_mode)) {
                                 /*
                                  * Dirs can't be linked, so move it. For moved
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 7e80f32550a6..88e51aded6bd 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1052,9 +1052,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                 ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
                 if (ret)
                         return ret;
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                if (ret)
-                        return ret;
         }
 
         return 0;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9a37f8b39bae..c5b8ba37f88e 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1012,7 +1012,7 @@ again:
                 base = btrfs_item_ptr_offset(leaf, path->slots[0]);
 
                 while (cur_offset < item_size) {
-                        extref = (struct btrfs_inode_extref *)base + cur_offset;
+                        extref = (struct btrfs_inode_extref *)(base + cur_offset);
 
                         victim_name_len = btrfs_inode_extref_name_len(leaf, extref);
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index cd4d1315aaa9..8222f6f74147 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4903,10 +4903,17 @@ static void sort_parity_stripes(struct btrfs_bio *bbio, int num_stripes)
 static struct btrfs_bio *alloc_btrfs_bio(int total_stripes, int real_stripes)
 {
         struct btrfs_bio *bbio = kzalloc(
+                 /* the size of the btrfs_bio */
                 sizeof(struct btrfs_bio) +
+                /* plus the variable array for the stripes */
                 sizeof(struct btrfs_bio_stripe) * (total_stripes) +
+                /* plus the variable array for the tgt dev */
                 sizeof(int) * (real_stripes) +
-                sizeof(u64) * (real_stripes),
+                /*
+                 * plus the raid_map, which includes both the tgt dev
+                 * and the stripes
+                 */
+                sizeof(u64) * (total_stripes),
                 GFP_NOFS);
         if (!bbio)
                 return NULL;
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 47b19465f0dc..883b93623bc5 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -111,6 +111,8 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                                         name, name_len, -1);
                 if (!di && (flags & XATTR_REPLACE))
                         ret = -ENODATA;
+                else if (IS_ERR(di))
+                        ret = PTR_ERR(di);
                 else if (di)
                         ret = btrfs_delete_one_dir_name(trans, root, path, di);
                 goto out;
@@ -127,10 +129,12 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                 ASSERT(mutex_is_locked(&inode->i_mutex));
                 di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
                                         name, name_len, 0);
-                if (!di) {
+                if (!di)
                         ret = -ENODATA;
+                else if (IS_ERR(di))
+                        ret = PTR_ERR(di);
+                if (ret)
                         goto out;
-                }
                 btrfs_release_path(path);
                 di = NULL;
         }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 90d1882b306f..5ba029e627cc 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -124,7 +124,7 @@ ecryptfs_get_key_payload_data(struct key *key)
 }
 
 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
-#define ECRYPTFS_MAX_CIPHER_NAME_SIZE 32
+#define ECRYPTFS_MAX_CIPHER_NAME_SIZE 31
 #define ECRYPTFS_MAX_NUM_ENC_KEYS 64
 #define ECRYPTFS_MAX_IV_BYTES 16        /* 128 bits */
 #define ECRYPTFS_SALT_BYTES 2
@@ -237,7 +237,7 @@ struct ecryptfs_crypt_stat {
         struct crypto_ablkcipher *tfm;
         struct crypto_hash *hash_tfm; /* Crypto context for generating
                                        * the initialization vectors */
-        unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
+        unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];
         unsigned char key[ECRYPTFS_MAX_KEY_BYTES];
         unsigned char root_iv[ECRYPTFS_MAX_IV_BYTES];
         struct list_head keysig_list;
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index b07731e68c0b..fd39bad6f1bd 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -303,9 +303,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOTTY;
 
-        if (lower_file->f_op->unlocked_ioctl)
+        if (!lower_file->f_op->unlocked_ioctl)
+                return rc;
+
+        switch (cmd) {
+        case FITRIM:
+        case FS_IOC_GETFLAGS:
+        case FS_IOC_SETFLAGS:
+        case FS_IOC_GETVERSION:
+        case FS_IOC_SETVERSION:
                 rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
-        return rc;
+                fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+                return rc;
+        default:
+                return rc;
+        }
 }
 
 #ifdef CONFIG_COMPAT
@@ -315,9 +328,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         long rc = -ENOIOCTLCMD;
 
-        if (lower_file->f_op->compat_ioctl)
+        if (!lower_file->f_op->compat_ioctl)
+                return rc;
+
+        switch (cmd) {
+        case FITRIM:
+        case FS_IOC32_GETFLAGS:
+        case FS_IOC32_SETFLAGS:
+        case FS_IOC32_GETVERSION:
+        case FS_IOC32_SETVERSION:
                 rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
-        return rc;
+                fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
+
+                return rc;
+        default:
+                return rc;
+        }
 }
 #endif
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 917bd5c9776a..6bd67e2011f0 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -891,7 +891,7 @@ struct ecryptfs_parse_tag_70_packet_silly_stack {
         struct blkcipher_desc desc;
         char fnek_sig_hex[ECRYPTFS_SIG_SIZE_HEX + 1];
         char iv[ECRYPTFS_MAX_IV_BYTES];
-        char cipher_string[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
+        char cipher_string[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];
 };
 
 /**
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 1895d60f4122..c095d3264259 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -407,7 +407,7 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
         if (!cipher_name_set) {
                 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);
 
-                BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE);
+                BUG_ON(cipher_name_len > ECRYPTFS_MAX_CIPHER_NAME_SIZE);
                 strcpy(mount_crypt_stat->global_default_cipher_name,
                        ECRYPTFS_DEFAULT_CIPHER);
         }
diff --git a/fs/locks.c b/fs/locks.c
index 365c82e1b3a9..f1bad681fc1c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1665,7 +1665,8 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
         }
 
         if (my_fl != NULL) {
-                error = lease->fl_lmops->lm_change(my_fl, arg, &dispose);
+                lease = my_fl;
+                error = lease->fl_lmops->lm_change(lease, arg, &dispose);
                 if (error)
                         goto out;
                 goto out_setup;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index f9f4845db989..19874151e95c 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -433,7 +433,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
 
 static bool nfs_client_init_is_complete(const struct nfs_client *clp)
 {
-        return clp->cl_cons_state != NFS_CS_INITING;
+        return clp->cl_cons_state <= NFS_CS_READY;
 }
 
 int nfs_wait_client_init_complete(const struct nfs_client *clp)
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index a1f0685b42ff..a6ad68865880 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -181,8 +181,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred,
                         clear_bit(NFS_DELEGATION_NEED_RECLAIM,
                                   &delegation->flags);
                         spin_unlock(&delegation->lock);
-                        put_rpccred(oldcred);
                         rcu_read_unlock();
+                        put_rpccred(oldcred);
                         trace_nfs4_reclaim_delegation(inode, res->delegation_type);
                 } else {
                         /* We appear to have raced with a delegation return. */
@@ -370,7 +370,10 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
                         delegation = NULL;
                         goto out;
                 }
-                freeme = nfs_detach_delegation_locked(nfsi, 
+                if (test_and_set_bit(NFS_DELEGATION_RETURNING,
+                                        &old_delegation->flags))
+                        goto out;
+                freeme = nfs_detach_delegation_locked(nfsi,
                                 old_delegation, clp);
                 if (freeme == NULL)
                         goto out;
@@ -433,6 +436,8 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)
 {
         bool ret = false;
 
+        if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
+                goto out;
         if (test_and_clear_bit(NFS_DELEGATION_RETURN, &delegation->flags))
                 ret = true;
         if (test_and_clear_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags) && !ret) {
@@ -444,6 +449,7 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)
                         ret = true;
                 spin_unlock(&delegation->lock);
         }
+out:
         return ret;
 }
 
@@ -471,14 +477,20 @@ restart:
                                                                 super_list) {
                         if (!nfs_delegation_need_return(delegation))
                                 continue;
-                        inode = nfs_delegation_grab_inode(delegation);
-                        if (inode == NULL)
+                        if (!nfs_sb_active(server->super))
                                 continue;
+                        inode = nfs_delegation_grab_inode(delegation);
+                        if (inode == NULL) {
+                                rcu_read_unlock();
+                                nfs_sb_deactive(server->super);
+                                goto restart;
+                        }
                         delegation = nfs_start_delegation_return_locked(NFS_I(inode));
                         rcu_read_unlock();
 
                         err = nfs_end_delegation_return(inode, delegation, 0);
                         iput(inode);
+                        nfs_sb_deactive(server->super);
                         if (!err)
                                 goto restart;
                         set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
@@ -809,19 +821,30 @@ restart:
         list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
                 list_for_each_entry_rcu(delegation, &server->delegations,
                                                                 super_list) {
+                        if (test_bit(NFS_DELEGATION_RETURNING,
+                                                &delegation->flags))
+                                continue;
                         if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
                                                 &delegation->flags) == 0)
                                 continue;
-                        inode = nfs_delegation_grab_inode(delegation);
-                        if (inode == NULL)
+                        if (!nfs_sb_active(server->super))
                                 continue;
-                        delegation = nfs_detach_delegation(NFS_I(inode),
-                                        delegation, server);
+                        inode = nfs_delegation_grab_inode(delegation);
+                        if (inode == NULL) {
+                                rcu_read_unlock();
+                                nfs_sb_deactive(server->super);
+                                goto restart;
+                        }
+                        delegation = nfs_start_delegation_return_locked(NFS_I(inode));
                         rcu_read_unlock();
-
-                        if (delegation != NULL)
-                                nfs_free_delegation(delegation);
+                        if (delegation != NULL) {
+                                delegation = nfs_detach_delegation(NFS_I(inode),
+                                        delegation, server);
+                                if (delegation != NULL)
+                                        nfs_free_delegation(delegation);
+                        }
                         iput(inode);
+                        nfs_sb_deactive(server->super);
                         goto restart;
                 }
         }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 9b0c55cb2a2e..c19e16f0b2d0 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -408,14 +408,22 @@ static int xdr_decode(nfs_readdir_descriptor_t *desc,
         return 0;
 }
 
+/* Match file and dirent using either filehandle or fileid
+ * Note: caller is responsible for checking the fsid
+ */
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
+        struct nfs_inode *nfsi;
+
         if (dentry->d_inode == NULL)
                 goto different;
-        if (nfs_compare_fh(entry->fh, NFS_FH(dentry->d_inode)) != 0)
-                goto different;
-        return 1;
+
+        nfsi = NFS_I(dentry->d_inode);
+        if (entry->fattr->fileid == nfsi->fileid)
+                return 1;
+        if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
+                return 1;
 different:
         return 0;
 }
@@ -469,6 +477,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
         struct inode *inode;
         int status;
 
+        if (!(entry->fattr->valid & NFS_ATTR_FATTR_FILEID))
+                return;
+        if (!(entry->fattr->valid & NFS_ATTR_FATTR_FSID))
+                return;
         if (filename.name[0] == '.') {
                 if (filename.len == 1)
                         return;
@@ -479,6 +491,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
 
         dentry = d_lookup(parent, &filename);
         if (dentry != NULL) {
+                /* Is there a mountpoint here? If so, just exit */
+                if (!nfs_fsid_equal(&NFS_SB(dentry->d_sb)->fsid,
+                                        &entry->fattr->fsid))
+                        goto out;
                 if (nfs_same_file(dentry, entry)) {
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         status = nfs_refresh_inode(dentry->d_inode, entry->fattr);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 94712fc781fa..e679d24c39d3 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -178,7 +178,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to)
                 iocb->ki_filp,
                 iov_iter_count(to), (unsigned long) iocb->ki_pos);
 
-        result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping);
+        result = nfs_revalidate_mapping_protected(inode, iocb->ki_filp->f_mapping);
         if (!result) {
                 result = generic_file_read_iter(iocb, to);
                 if (result > 0)
@@ -199,7 +199,7 @@ nfs_file_splice_read(struct file *filp, loff_t *ppos,
         dprintk("NFS: splice_read(%pD2, %lu@%Lu)\n",
                 filp, (unsigned long) count, (unsigned long long) *ppos);
 
-        res = nfs_revalidate_mapping(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping_protected(inode, filp->f_mapping);
         if (!res) {
                 res = generic_file_splice_read(filp, ppos, pipe, count, flags);
                 if (res > 0)
@@ -372,6 +372,10 @@ start:
                                  nfs_wait_bit_killable, TASK_KILLABLE);
         if (ret)
                 return ret;
+        /*
+         * Wait for O_DIRECT to complete
+         */
+        nfs_inode_dio_wait(mapping->host);
 
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page)
@@ -619,6 +623,9 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         /* make sure the cache has finished storing the page */
         nfs_fscache_wait_on_page_write(NFS_I(inode), page);
 
+        wait_on_bit_action(&NFS_I(inode)->flags, NFS_INO_INVALIDATING,
+                        nfs_wait_bit_killable, TASK_KILLABLE);
+
         lock_page(page);
         mapping = page_file_mapping(page);
         if (mapping != inode->i_mapping)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 83107be3dd01..d42dff6d5e98 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -556,6 +556,7 @@ EXPORT_SYMBOL_GPL(nfs_setattr);
  * This is a copy of the common vmtruncate, but with the locking
  * corrected to take into account the fact that NFS requires
  * inode->i_size to be updated under the inode->i_lock.
+ * Note: must be called with inode->i_lock held!
  */
 static int nfs_vmtruncate(struct inode * inode, loff_t offset)
 {
@@ -565,14 +566,14 @@ static int nfs_vmtruncate(struct inode * inode, loff_t offset)
         if (err)
                 goto out;
 
-        spin_lock(&inode->i_lock);
         i_size_write(inode, offset);
         /* Optimisation */
         if (offset == 0)
                 NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_DATA;
-        spin_unlock(&inode->i_lock);
 
+        spin_unlock(&inode->i_lock);
         truncate_pagecache(inode, offset);
+        spin_lock(&inode->i_lock);
 out:
         return err;
 }
@@ -585,10 +586,15 @@ out:
  * Note: we do this in the *proc.c in order to ensure that
  *       it works for things like exclusive creates too.
  */
-void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
+void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr,
+                struct nfs_fattr *fattr)
 {
+        /* Barrier: bump the attribute generation count. */
+        nfs_fattr_set_barrier(fattr);
+
+        spin_lock(&inode->i_lock);
+        NFS_I(inode)->attr_gencount = fattr->gencount;
         if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0) {
-                spin_lock(&inode->i_lock);
                 if ((attr->ia_valid & ATTR_MODE) != 0) {
                         int mode = attr->ia_mode & S_IALLUGO;
                         mode |= inode->i_mode & ~S_IALLUGO;
@@ -600,12 +606,13 @@ void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
                         inode->i_gid = attr->ia_gid;
                 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ACCESS
                                 | NFS_INO_INVALID_ACL);
-                spin_unlock(&inode->i_lock);
         }
         if ((attr->ia_valid & ATTR_SIZE) != 0) {
                 nfs_inc_stats(inode, NFSIOS_SETATTRTRUNC);
                 nfs_vmtruncate(inode, attr->ia_size);
         }
+        nfs_update_inode(inode, fattr);
+        spin_unlock(&inode->i_lock);
 }
 EXPORT_SYMBOL_GPL(nfs_setattr_update_inode);
 
@@ -1028,6 +1035,7 @@ static int nfs_invalidate_mapping(struct inode *inode, struct address_space *map
 
         if (mapping->nrpages != 0) {
                 if (S_ISREG(inode->i_mode)) {
+                        unmap_mapping_range(mapping, 0, 0, 0);
                         ret = nfs_sync_mapping(mapping);
                         if (ret < 0)
                                 return ret;
@@ -1060,11 +1068,14 @@ static bool nfs_mapping_need_revalidate_inode(struct inode *inode)
 }
 
 /**
- * nfs_revalidate_mapping - Revalidate the pagecache
+ * __nfs_revalidate_mapping - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
+ * @may_lock - take inode->i_mutex?
  */
-int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+static int __nfs_revalidate_mapping(struct inode *inode,
+                struct address_space *mapping,
+                bool may_lock)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         unsigned long *bitlock = &nfsi->flags;
@@ -1113,7 +1124,12 @@ int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
         nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
         spin_unlock(&inode->i_lock);
         trace_nfs_invalidate_mapping_enter(inode);
-        ret = nfs_invalidate_mapping(inode, mapping);
+        if (may_lock) {
+                mutex_lock(&inode->i_mutex);
+                ret = nfs_invalidate_mapping(inode, mapping);
+                mutex_unlock(&inode->i_mutex);
+        } else
+                ret = nfs_invalidate_mapping(inode, mapping);
         trace_nfs_invalidate_mapping_exit(inode, ret);
 
         clear_bit_unlock(NFS_INO_INVALIDATING, bitlock);
@@ -1123,6 +1139,29 @@ out:
         return ret;
 }
 
+/**
+ * nfs_revalidate_mapping - Revalidate the pagecache
+ * @inode - pointer to host inode
+ * @mapping - pointer to mapping
+ */
+int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
+{
+        return __nfs_revalidate_mapping(inode, mapping, false);
+}
+
+/**
+ * nfs_revalidate_mapping_protected - Revalidate the pagecache
+ * @inode - pointer to host inode
+ * @mapping - pointer to mapping
+ *
+ * Differs from nfs_revalidate_mapping() in that it grabs the inode->i_mutex
+ * while invalidating the mapping.
+ */
+int nfs_revalidate_mapping_protected(struct inode *inode, struct address_space *mapping)
+{
+        return __nfs_revalidate_mapping(inode, mapping, true);
+}
+
 static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
@@ -1231,13 +1270,6 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
         return timespec_compare(&fattr->ctime, &inode->i_ctime) > 0;
 }
 
-static int nfs_size_need_update(const struct inode *inode, const struct nfs_fattr *fattr)
-{
-        if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
-                return 0;
-        return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
-}
-
 static atomic_long_t nfs_attr_generation_counter;
 
 static unsigned long nfs_read_attr_generation_counter(void)
@@ -1249,6 +1281,7 @@ unsigned long nfs_inc_attr_generation_counter(void)
 {
         return atomic_long_inc_return(&nfs_attr_generation_counter);
 }
+EXPORT_SYMBOL_GPL(nfs_inc_attr_generation_counter);
 
 void nfs_fattr_init(struct nfs_fattr *fattr)
 {
@@ -1260,6 +1293,22 @@ void nfs_fattr_init(struct nfs_fattr *fattr)
 }
 EXPORT_SYMBOL_GPL(nfs_fattr_init);
 
+/**
+ * nfs_fattr_set_barrier
+ * @fattr: attributes
+ *
+ * Used to set a barrier after an attribute was updated. This
+ * barrier ensures that older attributes from RPC calls that may
+ * have raced with our update cannot clobber these new values.
+ * Note that you are still responsible for ensuring that other
+ * operations which change the attribute on the server do not
+ * collide.
+ */
+void nfs_fattr_set_barrier(struct nfs_fattr *fattr)
+{
+        fattr->gencount = nfs_inc_attr_generation_counter();
+}
+
 struct nfs_fattr *nfs_alloc_fattr(void)
 {
         struct nfs_fattr *fattr;
@@ -1370,7 +1419,6 @@ static int nfs_inode_attrs_need_update(const struct inode *inode, const struct n
 
         return ((long)fattr->gencount - (long)nfsi->attr_gencount) > 0 ||
                 nfs_ctime_need_update(inode, fattr) ||
-                nfs_size_need_update(inode, fattr) ||
                 ((long)nfsi->attr_gencount - (long)nfs_read_attr_generation_counter() > 0);
 }
 
@@ -1460,6 +1508,7 @@ int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
         int status;
 
         spin_lock(&inode->i_lock);
+        nfs_fattr_set_barrier(fattr);
         status = nfs_post_op_update_inode_locked(inode, fattr);
         spin_unlock(&inode->i_lock);
 
@@ -1468,7 +1517,7 @@ int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 EXPORT_SYMBOL_GPL(nfs_post_op_update_inode);
 
 /**
- * nfs_post_op_update_inode_force_wcc - try to update the inode attribute cache
+ * nfs_post_op_update_inode_force_wcc_locked - update the inode attribute cache
  * @inode - pointer to inode
  * @fattr - updated attributes
  *
@@ -1478,11 +1527,10 @@ EXPORT_SYMBOL_GPL(nfs_post_op_update_inode);
  *
  * This function is mainly designed to be used by the ->write_done() functions.
  */
-int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr)
+int nfs_post_op_update_inode_force_wcc_locked(struct inode *inode, struct nfs_fattr *fattr)
 {
         int status;
 
-        spin_lock(&inode->i_lock);
         /* Don't do a WCC update if these attributes are already stale */
         if ((fattr->valid & NFS_ATTR_FATTR) == 0 ||
                         !nfs_inode_attrs_need_update(inode, fattr)) {
@@ -1514,6 +1562,27 @@ int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fa
         }
 out_noforce:
         status = nfs_post_op_update_inode_locked(inode, fattr);
+        return status;
+}
+
+/**
+ * nfs_post_op_update_inode_force_wcc - try to update the inode attribute cache
+ * @inode - pointer to inode
+ * @fattr - updated attributes
+ *
+ * After an operation that has changed the inode metadata, mark the
+ * attribute cache as being invalid, then try to update it. Fake up
+ * weak cache consistency data, if none exist.
+ *
+ * This function is mainly designed to be used by the ->write_done() functions.
+ */
+int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr)
+{
+        int status;
+
+        spin_lock(&inode->i_lock);
+        nfs_fattr_set_barrier(fattr);
+        status = nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
         spin_unlock(&inode->i_lock);
         return status;
 }
@@ -1715,6 +1784,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 nfs_inc_stats(inode, NFSIOS_ATTRINVALIDATE);
                 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
                 nfsi->attrtimeo_timestamp = now;
+                /* Set barrier to be more recent than all outstanding updates */
                 nfsi->attr_gencount = nfs_inc_attr_generation_counter();
         } else {
                 if (!time_in_range_open(now, nfsi->attrtimeo_timestamp, nfsi->attrtimeo_timestamp + nfsi->attrtimeo)) {
@@ -1722,6 +1792,9 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                                 nfsi->attrtimeo = NFS_MAXATTRTIMEO(inode);
                         nfsi->attrtimeo_timestamp = now;
                 }
+                /* Set the barrier to be more recent than this fattr */
+                if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0)
+                        nfsi->attr_gencount = fattr->gencount;
         }
         invalid &= ~NFS_INO_INVALID_ATTR;
         /* Don't invalidate the data if we were to blame */
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index b802fb3a2d99..9e6475bc5ba2 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -459,6 +459,7 @@ void nfs_mark_request_commit(struct nfs_page *req,
                              struct nfs_commit_info *cinfo,
                              u32 ds_commit_idx);
 int nfs_write_need_commit(struct nfs_pgio_header *);
+void nfs_writeback_update_inode(struct nfs_pgio_header *hdr);
 int nfs_generic_commit_list(struct inode *inode, struct list_head *head,
                             int how, struct nfs_commit_info *cinfo);
 void nfs_retry_commit(struct list_head *page_list,
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 78e557c3ab87..1f11d2533ee4 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -138,7 +138,7 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         if (status == 0)
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
@@ -834,7 +834,7 @@ static int nfs3_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
         if (nfs3_async_handle_jukebox(task, inode))
                 return -EAGAIN;
         if (task->tk_status >= 0)
-                nfs_post_op_update_inode_force_wcc(inode, hdr->res.fattr);
+                nfs_writeback_update_inode(hdr);
         return 0;
 }
 
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 2a932fdc57cb..53852a4bd88b 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1987,6 +1987,11 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
                 if (entry->fattr->valid & NFS_ATTR_FATTR_V3)
                         entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
 
+                if (entry->fattr->fileid != entry->ino) {
+                        entry->fattr->mounted_on_fileid = entry->ino;
+                        entry->fattr->valid |= NFS_ATTR_FATTR_MOUNTED_ON_FILEID;
+                }
+
                 /* In fact, a post_op_fh3: */
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(p == NULL))
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8646af9b11d2..86d6214ea022 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -621,6 +621,9 @@ int nfs41_walk_client_list(struct nfs_client *new,
         spin_lock(&nn->nfs_client_lock);
         list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
 
+                if (pos == new)
+                        goto found;
+
                 if (pos->rpc_ops != new->rpc_ops)
                         continue;
 
@@ -639,10 +642,6 @@ int nfs41_walk_client_list(struct nfs_client *new,
                         prev = pos;
 
                         status = nfs_wait_client_init_complete(pos);
-                        if (pos->cl_cons_state == NFS_CS_SESSION_INITING) {
-                                nfs4_schedule_lease_recovery(pos);
-                                status = nfs4_wait_clnt_recover(pos);
-                        }
                         spin_lock(&nn->nfs_client_lock);
                         if (status < 0)
                                 break;
@@ -668,7 +667,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
                  */
                 if (!nfs4_match_client_owner_id(pos, new))
                         continue;
-
+found:
                 atomic_inc(&pos->cl_count);
                 *result = pos;
                 status = 0;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 88180ac5ea0e..627f37c44456 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -901,6 +901,7 @@ static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
         if (!cinfo->atomic || cinfo->before != dir->i_version)
                 nfs_force_lookup_revalidate(dir);
         dir->i_version = cinfo->after;
+        nfsi->attr_gencount = nfs_inc_attr_generation_counter();
         nfs_fscache_invalidate(dir);
         spin_unlock(&dir->i_lock);
 }
@@ -1552,6 +1553,9 @@ static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, fmode_t fmod
 
         opendata->o_arg.open_flags = 0;
         opendata->o_arg.fmode = fmode;
+        opendata->o_arg.share_access = nfs4_map_atomic_open_share(
+                        NFS_SB(opendata->dentry->d_sb),
+                        fmode, 0);
         memset(&opendata->o_res, 0, sizeof(opendata->o_res));
         memset(&opendata->c_res, 0, sizeof(opendata->c_res));
         nfs4_init_opendata_res(opendata);
@@ -2413,8 +2417,8 @@ static int _nfs4_do_open(struct inode *dir,
                                 opendata->o_res.f_attr, sattr,
                                 state, label, olabel);
                 if (status == 0) {
-                        nfs_setattr_update_inode(state->inode, sattr);
-                        nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
+                        nfs_setattr_update_inode(state->inode, sattr,
+                                        opendata->o_res.f_attr);
                         nfs_setsecurity(state->inode, opendata->o_res.f_attr, olabel);
                 }
         }
@@ -2651,7 +2655,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                 case -NFS4ERR_BAD_STATEID:
                 case -NFS4ERR_EXPIRED:
                         if (!nfs4_stateid_match(&calldata->arg.stateid,
-                                                &state->stateid)) {
+                                                &state->open_stateid)) {
                                 rpc_restart_call_prepare(task);
                                 goto out_release;
                         }
@@ -2687,7 +2691,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
         is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
         is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
         is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
-        nfs4_stateid_copy(&calldata->arg.stateid, &state->stateid);
+        nfs4_stateid_copy(&calldata->arg.stateid, &state->open_stateid);
         /* Calculate the change in open mode */
         calldata->arg.fmode = 0;
         if (state->n_rdwr == 0) {
@@ -3288,7 +3292,7 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
 
         status = nfs4_do_setattr(inode, cred, fattr, sattr, state, NULL, label);
         if (status == 0) {
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
                 nfs_setsecurity(inode, fattr, label);
         }
         nfs4_label_free(label);
@@ -4234,7 +4238,7 @@ static int nfs4_write_done_cb(struct rpc_task *task,
         }
         if (task->tk_status >= 0) {
                 renew_lease(NFS_SERVER(inode), hdr->timestamp);
-                nfs_post_op_update_inode_force_wcc(inode, &hdr->fattr);
+                nfs_writeback_update_inode(hdr);
         }
         return 0;
 }
@@ -6893,9 +6897,13 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
 
         if (status == 0) {
                 clp->cl_clientid = res.clientid;
-                clp->cl_exchange_flags = (res.flags & ~EXCHGID4_FLAG_CONFIRMED_R);
-                if (!(res.flags & EXCHGID4_FLAG_CONFIRMED_R))
+                clp->cl_exchange_flags = res.flags;
+                /* Client ID is not confirmed */
+                if (!(res.flags & EXCHGID4_FLAG_CONFIRMED_R)) {
+                        clear_bit(NFS4_SESSION_ESTABLISHED,
+                                        &clp->cl_session->session_state);
                         clp->cl_seqid = res.seqid;
+                }
 
                 kfree(clp->cl_serverowner);
                 clp->cl_serverowner = res.server_owner;
@@ -7227,6 +7235,9 @@ static void nfs4_update_session(struct nfs4_session *session,
                 struct nfs41_create_session_res *res)
 {
         nfs4_copy_sessionid(&session->sess_id, &res->sessionid);
+        /* Mark client id and session as being confirmed */
+        session->clp->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
+        set_bit(NFS4_SESSION_ESTABLISHED, &session->session_state);
         session->flags = res->flags;
         memcpy(&session->fc_attrs, &res->fc_attrs, sizeof(session->fc_attrs));
         if (res->flags & SESSION4_BACK_CHAN)
@@ -7322,8 +7333,8 @@ int nfs4_proc_destroy_session(struct nfs4_session *session,
         dprintk("--> nfs4_proc_destroy_session\n");
 
         /* session is still being setup */
-        if (session->clp->cl_cons_state != NFS_CS_READY)
-                return status;
+        if (!test_and_clear_bit(NFS4_SESSION_ESTABLISHED, &session->session_state))
+                return 0;
 
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         trace_nfs4_destroy_session(session->clp, status);
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index fc46c7455898..e3ea2c5324d6 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -70,6 +70,7 @@ struct nfs4_session {
 
 enum nfs4_session_state {
         NFS4_SESSION_INITING,
+        NFS4_SESSION_ESTABLISHED,
 };
 
 extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 5ad908e9ce9c..f95e3b58bbc3 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -346,9 +346,23 @@ int nfs41_discover_server_trunking(struct nfs_client *clp,
         status = nfs4_proc_exchange_id(clp, cred);
         if (status != NFS4_OK)
                 return status;
-        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
 
-        return nfs41_walk_client_list(clp, result, cred);
+        status = nfs41_walk_client_list(clp, result, cred);
+        if (status < 0)
+                return status;
+        if (clp != *result)
+                return 0;
+
+        /* Purge state if the client id was established in a prior instance */
+        if (clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)
+                set_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state);
+        else
+                set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+        nfs4_schedule_state_manager(clp);
+        status = nfs_wait_client_init_complete(clp);
+        if (status < 0)
+                nfs_put_client(clp);
+        return status;
 }
 
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index b09cc23d6f43..c63189acd052 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -139,7 +139,7 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         if (status == 0)
-                nfs_setattr_update_inode(inode, sattr);
+                nfs_setattr_update_inode(inode, sattr, fattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
@@ -609,10 +609,8 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task,
 
 static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
 {
-        struct inode *inode = hdr->inode;
-
         if (task->tk_status >= 0)
-                nfs_post_op_update_inode_force_wcc(inode, hdr->res.fattr);
+                nfs_writeback_update_inode(hdr);
         return 0;
 }
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 595d81e354d1..849ed784d6ac 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1377,6 +1377,36 @@ static int nfs_should_remove_suid(const struct inode *inode)
         return 0;
 }
 
+static void nfs_writeback_check_extend(struct nfs_pgio_header *hdr,
+                struct nfs_fattr *fattr)
+{
+        struct nfs_pgio_args *argp = &hdr->args;
+        struct nfs_pgio_res *resp = &hdr->res;
+
+        if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
+                return;
+        if (argp->offset + resp->count != fattr->size)
+                return;
+        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode))
+                return;
+        /* Set attribute barrier */
+        nfs_fattr_set_barrier(fattr);
+}
+
+void nfs_writeback_update_inode(struct nfs_pgio_header *hdr)
+{
+        struct nfs_fattr *fattr = hdr->res.fattr;
+        struct inode *inode = hdr->inode;
+
+        if (fattr == NULL)
+                return;
+        spin_lock(&inode->i_lock);
+        nfs_writeback_check_extend(hdr, fattr);
+        nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
+        spin_unlock(&inode->i_lock);
+}
+EXPORT_SYMBOL_GPL(nfs_writeback_update_inode);
+
 /*
  * This function is called when the WRITE call is complete.
  */
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index f6b2a09f793f..d2f2c37dc2db 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1638,7 +1638,7 @@ __destroy_client(struct nfs4_client *clp)
                 nfs4_put_stid(&dp->dl_stid);
         }
         while (!list_empty(&clp->cl_revoked)) {
-                dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
+                dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
                 list_del_init(&dp->dl_recall_lru);
                 nfs4_put_stid(&dp->dl_stid);
         }
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index b2e3ff347620..ecdbae19a766 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -31,6 +31,8 @@
 #include "alloc.h"
 #include "dat.h"
 
+static void __nilfs_btree_init(struct nilfs_bmap *bmap);
+
 static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
 {
         struct nilfs_btree_path *path;
@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
         return ret;
 }
 
+/**
+ * nilfs_btree_root_broken - verify consistency of btree root node
+ * @node: btree root node to be examined
+ * @ino: inode number
+ *
+ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
+ */
+static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+                                   unsigned long ino)
+{
+        int level, flags, nchildren;
+        int ret = 0;
+
+        level = nilfs_btree_node_get_level(node);
+        flags = nilfs_btree_node_get_flags(node);
+        nchildren = nilfs_btree_node_get_nchildren(node);
+
+        if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+                     level > NILFS_BTREE_LEVEL_MAX ||
+                     nchildren < 0 ||
+                     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+                pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+                        ino, level, flags, nchildren);
+                ret = 1;
+        }
+        return ret;
+}
+
 int nilfs_btree_broken_node_block(struct buffer_head *bh)
 {
         int ret;
@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree,
 
         /* convert and insert */
         dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
-        nilfs_btree_init(btree);
+        __nilfs_btree_init(btree);
         if (nreq != NULL) {
                 nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
                 nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = {
         .bop_gather_data        =       NULL,
 };
 
-int nilfs_btree_init(struct nilfs_bmap *bmap)
+static void __nilfs_btree_init(struct nilfs_bmap *bmap)
 {
         bmap->b_ops = &nilfs_btree_ops;
         bmap->b_nchildren_per_block =
                 NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
-        return 0;
+}
+
+int nilfs_btree_init(struct nilfs_bmap *bmap)
+{
+        int ret = 0;
+
+        __nilfs_btree_init(bmap);
+
+        if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
+                                    bmap->b_inode->i_ino))
+                ret = -EIO;
+        return ret;
 }
 
 void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ce615d12fb44..a2e1cb8a568b 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -397,7 +397,8 @@ STATIC int				/* error (positive) */
 xfs_zero_last_block(
         struct xfs_inode        *ip,
         xfs_fsize_t             offset,
-        xfs_fsize_t             isize)
+        xfs_fsize_t             isize,
+        bool                    *did_zeroing)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           last_fsb = XFS_B_TO_FSBT(mp, isize);
@@ -425,6 +426,7 @@ xfs_zero_last_block(
         zero_len = mp->m_sb.sb_blocksize - zero_offset;
         if (isize + zero_len > offset)
                 zero_len = offset - isize;
+        *did_zeroing = true;
         return xfs_iozero(ip, isize, zero_len);
 }
 
@@ -443,7 +445,8 @@ int					/* error (positive) */
 xfs_zero_eof(
         struct xfs_inode        *ip,
         xfs_off_t               offset,         /* starting I/O offset */
-        xfs_fsize_t             isize)          /* current inode size */
+        xfs_fsize_t             isize,          /* current inode size */
+        bool                    *did_zeroing)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           start_zero_fsb;
@@ -465,7 +468,7 @@ xfs_zero_eof(
          * We only zero a part of that block so it is handled specially.
          */
         if (XFS_B_FSB_OFFSET(mp, isize) != 0) {
-                error = xfs_zero_last_block(ip, offset, isize);
+                error = xfs_zero_last_block(ip, offset, isize, did_zeroing);
                 if (error)
                         return error;
         }
@@ -525,6 +528,7 @@ xfs_zero_eof(
                 if (error)
                         return error;
 
+                *did_zeroing = true;
                 start_zero_fsb = imap.br_startoff + imap.br_blockcount;
                 ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
         }
@@ -567,13 +571,15 @@ restart:
          * having to redo all checks before.
          */
         if (*pos > i_size_read(inode)) {
+                bool    zero = false;
+
                 if (*iolock == XFS_IOLOCK_SHARED) {
                         xfs_rw_iunlock(ip, *iolock);
                         *iolock = XFS_IOLOCK_EXCL;
                         xfs_rw_ilock(ip, *iolock);
                         goto restart;
                 }
-                error = xfs_zero_eof(ip, *pos, i_size_read(inode));
+                error = xfs_zero_eof(ip, *pos, i_size_read(inode), &zero);
                 if (error)
                         return error;
         }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index daafa1f6d260..6163767aa856 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2867,6 +2867,10 @@ xfs_rename(
          * Handle RENAME_EXCHANGE flags
          */
         if (flags & RENAME_EXCHANGE) {
+                if (target_ip == NULL) {
+                        error = -EINVAL;
+                        goto error_return;
+                }
                 error = xfs_cross_rename(tp, src_dp, src_name, src_ip,
                                          target_dp, target_name, target_ip,
                                          &free_list, &first_block, spaceres);
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 86cd6b39bed7..a1cd55f3f351 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -384,10 +384,11 @@ enum xfs_prealloc_flags {
         XFS_PREALLOC_INVISIBLE  = (1 << 4),
 };
 
-int             xfs_update_prealloc_flags(struct xfs_inode *,
-                        enum xfs_prealloc_flags);
-int             xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
-int             xfs_iozero(struct xfs_inode *, loff_t, size_t);
+int     xfs_update_prealloc_flags(struct xfs_inode *ip,
+                                  enum xfs_prealloc_flags flags);
+int     xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+                     xfs_fsize_t isize, bool *did_zeroing);
+int     xfs_iozero(struct xfs_inode *ip, loff_t pos, size_t count);
 
 
 #define IHOLD(ip) \
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index d919ad7b16bf..e53a90331422 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -751,6 +751,7 @@ xfs_setattr_size(
         int                     error;
         uint                    lock_flags = 0;
         uint                    commit_flags = 0;
+        bool                    did_zeroing = false;
 
         trace_xfs_setattr(ip);
 
@@ -794,20 +795,16 @@ xfs_setattr_size(
                 return error;
 
         /*
-         * Now we can make the changes.  Before we join the inode to the
-         * transaction, take care of the part of the truncation that must be
-         * done without the inode lock.  This needs to be done before joining
-         * the inode to the transaction, because the inode cannot be unlocked
-         * once it is a part of the transaction.
+         * File data changes must be complete before we start the transaction to
+         * modify the inode.  This needs to be done before joining the inode to
+         * the transaction because the inode cannot be unlocked once it is a
+         * part of the transaction.
+         *
+         * Start with zeroing any data block beyond EOF that we may expose on
+         * file extension.
          */
         if (newsize > oldsize) {
-                /*
-                 * Do the first part of growing a file: zero any data in the
-                 * last block that is beyond the old EOF.  We need to do this
-                 * before the inode is joined to the transaction to modify
-                 * i_size.
-                 */
-                error = xfs_zero_eof(ip, newsize, oldsize);
+                error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
                 if (error)
                         return error;
         }
@@ -817,23 +814,18 @@ xfs_setattr_size(
          * any previous writes that are beyond the on disk EOF and the new
          * EOF that have not been written out need to be written here.  If we
          * do not write the data out, we expose ourselves to the null files
-         * problem.
-         *
-         * Only flush from the on disk size to the smaller of the in memory
-         * file size or the new size as that's the range we really care about
-         * here and prevents waiting for other data not within the range we
-         * care about here.
+         * problem. Note that this includes any block zeroing we did above;
+         * otherwise those blocks may not be zeroed after a crash.
          */
-        if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
+        if (newsize > ip->i_d.di_size &&
+            (oldsize != ip->i_d.di_size || did_zeroing)) {
                 error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
                                                       ip->i_d.di_size, newsize);
                 if (error)
                         return error;
         }
 
-        /*
-         * Wait for all direct I/O to complete.
-         */
+        /* Now wait for all direct I/O to complete. */
         inode_dio_wait(inode);
 
         /*
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index 4b33ef112400..365dd57ea760 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -300,8 +300,10 @@ xfs_fs_commit_blocks(
 
         tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
         error = xfs_trans_reserve(tp, &M_RES(mp)->tr_ichange, 0, 0);
-        if (error)
+        if (error) {
+                xfs_trans_cancel(tp, 0);
                 goto out_drop_iolock;
+        }
 
         xfs_ilock(ip, XFS_ILOCK_EXCL);
         xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 53cc2aaf8d2b..fbbb9e62e274 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -836,6 +836,11 @@ xfs_qm_reset_dqcounts(
                  */
                 xfs_dqcheck(mp, ddq, id+j, type, XFS_QMOPT_DQREPAIR,
                             "xfs_quotacheck");
+                /*
+                 * Reset type in case we are reusing group quota file for
+                 * project quotas or vice versa
+                 */
+                ddq->d_flags = type;
                 ddq->d_bcount = 0;
                 ddq->d_icount = 0;
                 ddq->d_rtbcount = 0;
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index a24addfdfcec..0de6290df4da 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -68,8 +68,8 @@ struct drm_mm_node {
         unsigned scanned_preceeds_hole : 1;
         unsigned allocated : 1;
         unsigned long color;
-        unsigned long start;
-        unsigned long size;
+        u64 start;
+        u64 size;
         struct drm_mm *mm;
 };
 
@@ -82,16 +82,16 @@ struct drm_mm {
         unsigned int scan_check_range : 1;
         unsigned scan_alignment;
         unsigned long scan_color;
-        unsigned long scan_size;
-        unsigned long scan_hit_start;
-        unsigned long scan_hit_end;
+        u64 scan_size;
+        u64 scan_hit_start;
+        u64 scan_hit_end;
         unsigned scanned_blocks;
-        unsigned long scan_start;
-        unsigned long scan_end;
+        u64 scan_start;
+        u64 scan_end;
         struct drm_mm_node *prev_scanned_node;
 
         void (*color_adjust)(struct drm_mm_node *node, unsigned long color,
-                             unsigned long *start, unsigned long *end);
+                             u64 *start, u64 *end);
 };
 
 /**
@@ -124,7 +124,7 @@ static inline bool drm_mm_initialized(struct drm_mm *mm)
         return mm->hole_stack.next;
 }
 
-static inline unsigned long __drm_mm_hole_node_start(struct drm_mm_node *hole_node)
+static inline u64 __drm_mm_hole_node_start(struct drm_mm_node *hole_node)
 {
         return hole_node->start + hole_node->size;
 }
@@ -140,13 +140,13 @@ static inline unsigned long __drm_mm_hole_node_start(struct drm_mm_node *hole_no
  * Returns:
  * Start of the subsequent hole.
  */
-static inline unsigned long drm_mm_hole_node_start(struct drm_mm_node *hole_node)
+static inline u64 drm_mm_hole_node_start(struct drm_mm_node *hole_node)
 {
         BUG_ON(!hole_node->hole_follows);
         return __drm_mm_hole_node_start(hole_node);
 }
 
-static inline unsigned long __drm_mm_hole_node_end(struct drm_mm_node *hole_node)
+static inline u64 __drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 {
         return list_entry(hole_node->node_list.next,
                           struct drm_mm_node, node_list)->start;
@@ -163,7 +163,7 @@ static inline unsigned long __drm_mm_hole_node_end(struct drm_mm_node *hole_node
  * Returns:
  * End of the subsequent hole.
  */
-static inline unsigned long drm_mm_hole_node_end(struct drm_mm_node *hole_node)
+static inline u64 drm_mm_hole_node_end(struct drm_mm_node *hole_node)
 {
         return __drm_mm_hole_node_end(hole_node);
 }
@@ -222,7 +222,7 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node);
 
 int drm_mm_insert_node_generic(struct drm_mm *mm,
                                struct drm_mm_node *node,
-                               unsigned long size,
+                               u64 size,
                                unsigned alignment,
                                unsigned long color,
                                enum drm_mm_search_flags sflags,
@@ -245,7 +245,7 @@ int drm_mm_insert_node_generic(struct drm_mm *mm,
  */
 static inline int drm_mm_insert_node(struct drm_mm *mm,
                                      struct drm_mm_node *node,
-                                     unsigned long size,
+                                     u64 size,
                                      unsigned alignment,
                                      enum drm_mm_search_flags flags)
 {
@@ -255,11 +255,11 @@ static inline int drm_mm_insert_node(struct drm_mm *mm,
 
 int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
                                         struct drm_mm_node *node,
-                                        unsigned long size,
+                                        u64 size,
                                         unsigned alignment,
                                         unsigned long color,
-                                        unsigned long start,
-                                        unsigned long end,
+                                        u64 start,
+                                        u64 end,
                                         enum drm_mm_search_flags sflags,
                                         enum drm_mm_allocator_flags aflags);
 /**
@@ -282,10 +282,10 @@ int drm_mm_insert_node_in_range_generic(struct drm_mm *mm,
  */
 static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
                                               struct drm_mm_node *node,
-                                              unsigned long size,
+                                              u64 size,
                                               unsigned alignment,
-                                              unsigned long start,
-                                              unsigned long end,
+                                              u64 start,
+                                              u64 end,
                                               enum drm_mm_search_flags flags)
 {
         return drm_mm_insert_node_in_range_generic(mm, node, size, alignment,
@@ -296,21 +296,21 @@ static inline int drm_mm_insert_node_in_range(struct drm_mm *mm,
 void drm_mm_remove_node(struct drm_mm_node *node);
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new);
 void drm_mm_init(struct drm_mm *mm,
-                 unsigned long start,
-                 unsigned long size);
+                 u64 start,
+                 u64 size);
 void drm_mm_takedown(struct drm_mm *mm);
 bool drm_mm_clean(struct drm_mm *mm);
 
 void drm_mm_init_scan(struct drm_mm *mm,
-                      unsigned long size,
+                      u64 size,
                       unsigned alignment,
                       unsigned long color);
 void drm_mm_init_scan_with_range(struct drm_mm *mm,
-                                 unsigned long size,
+                                 u64 size,
                                  unsigned alignment,
                                  unsigned long color,
-                                 unsigned long start,
-                                 unsigned long end);
+                                 u64 start,
+                                 u64 end);
 bool drm_mm_scan_add_block(struct drm_mm_node *node);
 bool drm_mm_scan_remove_block(struct drm_mm_node *node);
 
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 180ad0e6de21..d016dc57f007 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -214,9 +214,9 @@
         INTEL_VGA_DEVICE((((gt) - 1) << 4) | (id), info)
 
 #define _INTEL_BDW_M_IDS(gt, info) \
-        _INTEL_BDW_M(gt, 0x1602, info), /* ULT */ \
+        _INTEL_BDW_M(gt, 0x1602, info), /* Halo */ \
         _INTEL_BDW_M(gt, 0x1606, info), /* ULT */ \
-        _INTEL_BDW_M(gt, 0x160B, info), /* Iris */ \
+        _INTEL_BDW_M(gt, 0x160B, info), /* ULT */ \
         _INTEL_BDW_M(gt, 0x160E, info) /* ULX */
 
 #define _INTEL_BDW_D_IDS(gt, info) \
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 0ccf7f267ff9..c768ddfbe53c 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -249,7 +249,7 @@ struct ttm_buffer_object {
          * either of these locks held.
          */
 
-        unsigned long offset;
+        uint64_t offset; /* GPU address space is independent of CPU word size */
         uint32_t cur_placement;
 
         struct sg_table *sg;
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 142d752fc450..813042cede57 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -277,7 +277,7 @@ struct ttm_mem_type_manager {
         bool has_type;
         bool use_type;
         uint32_t flags;
-        unsigned long gpu_offset;
+        uint64_t gpu_offset; /* GPU address space is independent of CPU word size */
         uint64_t size;
         uint32_t available_caching;
         uint32_t default_caching;
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 16ec2c8b784d..133ea00aa83b 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -115,6 +115,7 @@ struct vgic_ops {
         void    (*sync_lr_elrsr)(struct kvm_vcpu *, int, struct vgic_lr);
         u64     (*get_elrsr)(const struct kvm_vcpu *vcpu);
         u64     (*get_eisr)(const struct kvm_vcpu *vcpu);
+        void    (*clear_eisr)(struct kvm_vcpu *vcpu);
         u32     (*get_interrupt_status)(const struct kvm_vcpu *vcpu);
         void    (*enable_underflow)(struct kvm_vcpu *vcpu);
         void    (*disable_underflow)(struct kvm_vcpu *vcpu);
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index f551a9299ac9..306178d7309f 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -126,6 +126,8 @@ struct cpuidle_driver {
 
 #ifdef CONFIG_CPU_IDLE
 extern void disable_cpuidle(void);
+extern bool cpuidle_not_available(struct cpuidle_driver *drv,
+                                  struct cpuidle_device *dev);
 
 extern int cpuidle_select(struct cpuidle_driver *drv,
                           struct cpuidle_device *dev);
@@ -150,11 +152,17 @@ extern void cpuidle_resume(void);
 extern int cpuidle_enable_device(struct cpuidle_device *dev);
 extern void cpuidle_disable_device(struct cpuidle_device *dev);
 extern int cpuidle_play_dead(void);
-extern void cpuidle_enter_freeze(void);
+extern int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                                      struct cpuidle_device *dev);
+extern int cpuidle_enter_freeze(struct cpuidle_driver *drv,
+                                struct cpuidle_device *dev);
 
 extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev);
 #else
 static inline void disable_cpuidle(void) { }
+static inline bool cpuidle_not_available(struct cpuidle_driver *drv,
+                                         struct cpuidle_device *dev)
+{return true; }
 static inline int cpuidle_select(struct cpuidle_driver *drv,
                                  struct cpuidle_device *dev)
 {return -ENODEV; }
@@ -183,7 +191,12 @@ static inline int cpuidle_enable_device(struct cpuidle_device *dev)
 {return -ENODEV; }
 static inline void cpuidle_disable_device(struct cpuidle_device *dev) { }
 static inline int cpuidle_play_dead(void) {return -ENODEV; }
-static inline void cpuidle_enter_freeze(void) { }
+static inline int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
+                                             struct cpuidle_device *dev)
+{return -ENODEV; }
+static inline int cpuidle_enter_freeze(struct cpuidle_driver *drv,
+                                       struct cpuidle_device *dev)
+{return -ENODEV; }
 static inline struct cpuidle_driver *cpuidle_get_cpu_driver(
         struct cpuidle_device *dev) {return NULL; }
 #endif
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 51f7ccadf923..4173a8fdad9e 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -33,6 +33,8 @@
  * @units:              Measurment unit for this attribute.
  * @unit_expo:          Exponent used in the data.
  * @size:               Size in bytes for data size.
+ * @logical_minimum:    Logical minimum value for this attribute.
+ * @logical_maximum:    Logical maximum value for this attribute.
  */
 struct hid_sensor_hub_attribute_info {
         u32 usage_id;
@@ -146,6 +148,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
 
 /**
 * sensor_hub_input_attr_get_raw_value() - Synchronous read request
+* @hsdev:       Hub device instance.
 * @usage_id:    Attribute usage id of parent physical device as per spec
 * @attr_usage_id:       Attribute usage id as per spec
 * @report_id:   Report id to look for
@@ -160,6 +163,7 @@ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
                         u32 attr_usage_id, u32 report_id);
 /**
 * sensor_hub_set_feature() - Feature set request
+* @hsdev:       Hub device instance.
 * @report_id:   Report id to look for
 * @field_index: Field index inside a report
 * @value:       Value to set
@@ -172,6 +176,7 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
 /**
 * sensor_hub_get_feature() - Feature get request
+* @hsdev:       Hub device instance.
 * @report_id:   Report id to look for
 * @field_index: Field index inside a report
 * @value:       Place holder for return value
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index d9b05b5bf8c7..2e88580194f0 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -52,11 +52,17 @@
  * IRQF_ONESHOT - Interrupt is not reenabled after the hardirq handler finished.
  *                Used by threaded interrupts which need to keep the
  *                irq line disabled until the threaded handler has been run.
- * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
+ * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend.  Does not guarantee
+ *                   that this interrupt will wake the system from a suspended
+ *                   state.  See Documentation/power/suspend-and-interrupts.txt
  * IRQF_FORCE_RESUME - Force enable it on resume even if IRQF_NO_SUSPEND is set
  * IRQF_NO_THREAD - Interrupt cannot be threaded
  * IRQF_EARLY_RESUME - Resume IRQ early during syscore instead of at device
  *                resume time.
+ * IRQF_COND_SUSPEND - If the IRQ is shared with a NO_SUSPEND user, execute this
+ *                interrupt handler after suspending interrupts. For system
+ *                wakeup devices users need to implement wakeup detection in
+ *                their interrupt handlers.
  */
 #define IRQF_DISABLED           0x00000020
 #define IRQF_SHARED             0x00000080
@@ -70,6 +76,7 @@
 #define IRQF_FORCE_RESUME       0x00008000
 #define IRQF_NO_THREAD          0x00010000
 #define IRQF_EARLY_RESUME       0x00020000
+#define IRQF_COND_SUSPEND       0x00040000
 
 #define IRQF_TIMER              (__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)
 
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index faf433af425e..dd1109fb241e 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -78,6 +78,7 @@ struct irq_desc {
 #ifdef CONFIG_PM_SLEEP
         unsigned int            nr_actions;
         unsigned int            no_suspend_depth;
+        unsigned int            cond_suspend_depth;
         unsigned int            force_resume_depth;
 #endif
 #ifdef CONFIG_PROC_FS
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 9605e46fce0b..27bd53b69080 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -658,7 +658,6 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu);
 int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu);
 
 void *kvm_kvzalloc(unsigned long size);
-void kvm_kvfree(const void *addr);
 
 #ifndef __KVM_HAVE_ARCH_VM_ALLOC
 static inline struct kvm *kvm_arch_alloc_vm(void)
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index 2bbc62aa818a..551f85456c11 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -427,7 +427,7 @@ struct mlx4_wqe_inline_seg {
 
 enum mlx4_update_qp_attr {
         MLX4_UPDATE_QP_SMAC             = 1 << 0,
-        MLX4_UPDATE_QP_VSD              = 1 << 2,
+        MLX4_UPDATE_QP_VSD              = 1 << 1,
         MLX4_UPDATE_QP_SUPPORTED_ATTRS  = (1 << 2) - 1
 };
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5897b4ea5a3f..429d1790a27e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2342,6 +2342,7 @@ struct gro_remcsum {
 
 static inline void skb_gro_remcsum_init(struct gro_remcsum *grc)
 {
+        grc->offset = 0;
         grc->delta = 0;
 }
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 2f77e0c651c8..b01ccf371fdc 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -343,6 +343,7 @@ extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
 extern int nfs_refresh_inode(struct inode *, struct nfs_fattr *);
 extern int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr);
+extern int nfs_post_op_update_inode_force_wcc_locked(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 extern void nfs_access_add_cache(struct inode *, struct nfs_access_entry *);
 extern void nfs_access_set_mask(struct nfs_access_entry *, u32);
@@ -355,8 +356,9 @@ extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int nfs_revalidate_inode_rcu(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
+extern int nfs_revalidate_mapping_protected(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
-extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
+extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr, struct nfs_fattr *);
 extern void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                 struct nfs4_label *label);
 extern struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx);
@@ -369,6 +371,7 @@ extern struct nfs_lock_context *nfs_get_lock_context(struct nfs_open_context *ct
 extern void nfs_put_lock_context(struct nfs_lock_context *l_ctx);
 extern u64 nfs_compat_user_ino64(u64 fileid);
 extern void nfs_fattr_init(struct nfs_fattr *fattr);
+extern void nfs_fattr_set_barrier(struct nfs_fattr *fattr);
 extern unsigned long nfs_inc_attr_generation_counter(void);
 
 extern struct nfs_fattr *nfs_alloc_fattr(void);
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index 58851275fed9..d438eeb08bff 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -54,10 +54,11 @@ struct rhash_head {
  * @buckets: size * hash buckets
  */
 struct bucket_table {
-        size_t                          size;
-        unsigned int                    locks_mask;
-        spinlock_t                      *locks;
-        struct rhash_head __rcu         *buckets[];
+        size_t                  size;
+        unsigned int            locks_mask;
+        spinlock_t              *locks;
+
+        struct rhash_head __rcu *buckets[] ____cacheline_aligned_in_smp;
 };
 
 typedef u32 (*rht_hashfn_t)(const void *data, u32 len, u32 seed);
@@ -78,12 +79,6 @@ struct rhashtable;
  * @locks_mul: Number of bucket locks to allocate per cpu (default: 128)
  * @hashfn: Function to hash key
  * @obj_hashfn: Function to hash object
- * @grow_decision: If defined, may return true if table should expand
- * @shrink_decision: If defined, may return true if table should shrink
- *
- * Note: when implementing the grow and shrink decision function, min/max
- * shift must be enforced, otherwise, resizing watermarks they set may be
- * useless.
  */
 struct rhashtable_params {
         size_t                  nelem_hint;
@@ -97,10 +92,6 @@ struct rhashtable_params {
         size_t                  locks_mul;
         rht_hashfn_t            hashfn;
         rht_obj_hashfn_t        obj_hashfn;
-        bool                    (*grow_decision)(const struct rhashtable *ht,
-                                                 size_t new_size);
-        bool                    (*shrink_decision)(const struct rhashtable *ht,
-                                                   size_t new_size);
 };
 
 /**
@@ -192,9 +183,6 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params);
 void rhashtable_insert(struct rhashtable *ht, struct rhash_head *node);
 bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *node);
 
-bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size);
-bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size);
-
 int rhashtable_expand(struct rhashtable *ht);
 int rhashtable_shrink(struct rhashtable *ht);
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6d77432e14ff..be98910cc1e2 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -176,6 +176,14 @@ extern void get_iowait_load(unsigned long *nr_waiters, unsigned long *load);
 extern void calc_global_load(unsigned long ticks);
 extern void update_cpu_load_nohz(void);
 
+/* Notifier for when a task gets migrated to a new CPU */
+struct task_migration_notifier {
+        struct task_struct *task;
+        int from_cpu;
+        int to_cpu;
+};
+extern void register_task_migration_notifier(struct notifier_block *n);
+
 extern unsigned long get_parent_ip(unsigned long addr);
 
 extern void dump_cpu_task(int cpu);
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index baf3e1d08416..d10965f0d8a4 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -143,13 +143,13 @@ struct uart_port {
         unsigned char           iotype;                 /* io access style */
         unsigned char           unused1;
 
-#define UPIO_PORT               (0)                     /* 8b I/O port access */
-#define UPIO_HUB6               (1)                     /* Hub6 ISA card */
-#define UPIO_MEM                (2)                     /* 8b MMIO access */
-#define UPIO_MEM32              (3)                     /* 32b little endian */
-#define UPIO_MEM32BE            (4)                     /* 32b big endian */
-#define UPIO_AU                 (5)                     /* Au1x00 and RT288x type IO */
-#define UPIO_TSI                (6)                     /* Tsi108/109 type IO */
+#define UPIO_PORT               (SERIAL_IO_PORT)        /* 8b I/O port access */
+#define UPIO_HUB6               (SERIAL_IO_HUB6)        /* Hub6 ISA card */
+#define UPIO_MEM                (SERIAL_IO_MEM)         /* 8b MMIO access */
+#define UPIO_MEM32              (SERIAL_IO_MEM32)       /* 32b little endian */
+#define UPIO_AU                 (SERIAL_IO_AU)          /* Au1x00 and RT288x type IO */
+#define UPIO_TSI                (SERIAL_IO_TSI)         /* Tsi108/109 type IO */
+#define UPIO_MEM32BE            (SERIAL_IO_MEM32BE)     /* 32b big endian */
 
         unsigned int            read_status_mask;       /* driver specific */
         unsigned int            ignore_status_mask;     /* driver specific */
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index ed9489d893a4..856d34dde79b 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -649,7 +649,7 @@ struct spi_transfer {
  * sequence completes.  On some systems, many such sequences can execute as
  * as single programmed DMA transfer.  On all systems, these messages are
  * queued, and might complete after transactions to other devices.  Messages
- * sent to a given spi_device are alway executed in FIFO order.
+ * sent to a given spi_device are always executed in FIFO order.
  *
  * The code that submits an spi_message (and its spi_transfers)
  * to the lower layers is responsible for managing its memory.
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index fc52e307efab..5eac316490ea 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -314,6 +314,8 @@ void thermal_zone_of_sensor_unregister(struct device *dev,
 }
 
 #endif
+
+#if IS_ENABLED(CONFIG_THERMAL)
 struct thermal_zone_device *thermal_zone_device_register(const char *, int, int,
                 void *, struct thermal_zone_device_ops *,
                 const struct thermal_zone_params *, int, int);
@@ -340,8 +342,58 @@ struct thermal_instance *get_thermal_instance(struct thermal_zone_device *,
                 struct thermal_cooling_device *, int);
 void thermal_cdev_update(struct thermal_cooling_device *);
 void thermal_notify_framework(struct thermal_zone_device *, int);
-
-#ifdef CONFIG_NET
+#else
+static inline struct thermal_zone_device *thermal_zone_device_register(
+        const char *type, int trips, int mask, void *devdata,
+        struct thermal_zone_device_ops *ops,
+        const struct thermal_zone_params *tzp,
+        int passive_delay, int polling_delay)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_zone_device_unregister(
+        struct thermal_zone_device *tz)
+{ }
+static inline int thermal_zone_bind_cooling_device(
+        struct thermal_zone_device *tz, int trip,
+        struct thermal_cooling_device *cdev,
+        unsigned long upper, unsigned long lower)
+{ return -ENODEV; }
+static inline int thermal_zone_unbind_cooling_device(
+        struct thermal_zone_device *tz, int trip,
+        struct thermal_cooling_device *cdev)
+{ return -ENODEV; }
+static inline void thermal_zone_device_update(struct thermal_zone_device *tz)
+{ }
+static inline struct thermal_cooling_device *
+thermal_cooling_device_register(char *type, void *devdata,
+        const struct thermal_cooling_device_ops *ops)
+{ return ERR_PTR(-ENODEV); }
+static inline struct thermal_cooling_device *
+thermal_of_cooling_device_register(struct device_node *np,
+        char *type, void *devdata, const struct thermal_cooling_device_ops *ops)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_cooling_device_unregister(
+        struct thermal_cooling_device *cdev)
+{ }
+static inline struct thermal_zone_device *thermal_zone_get_zone_by_name(
+                const char *name)
+{ return ERR_PTR(-ENODEV); }
+static inline int thermal_zone_get_temp(
+                struct thermal_zone_device *tz, unsigned long *temp)
+{ return -ENODEV; }
+static inline int get_tz_trend(struct thermal_zone_device *tz, int trip)
+{ return -ENODEV; }
+static inline struct thermal_instance *
+get_thermal_instance(struct thermal_zone_device *tz,
+        struct thermal_cooling_device *cdev, int trip)
+{ return ERR_PTR(-ENODEV); }
+static inline void thermal_cdev_update(struct thermal_cooling_device *cdev)
+{ }
+static inline void thermal_notify_framework(struct thermal_zone_device *tz,
+        int trip)
+{ }
+#endif /* CONFIG_THERMAL */
+
+#if defined(CONFIG_NET) && IS_ENABLED(CONFIG_THERMAL)
 extern int thermal_generate_netlink_event(struct thermal_zone_device *tz,
                                                 enum events event);
 #else
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 9bb547c7bce7..704a1ab8240c 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -190,8 +190,7 @@ static inline void usb_set_serial_data(struct usb_serial *serial, void *data)
  * @num_ports: the number of different ports this device will have.
  * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
  *      (0 = end-point size)
- * @bulk_out_size: minimum number of bytes to allocate for bulk-out buffer
- *      (0 = end-point size)
+ * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
  * @calc_num_ports: pointer to a function to determine how many ports this
  *      device has dynamically.  It will be called after the probe()
  *      callback is called, but before attach()
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 74db135f9957..f597846ff605 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -70,7 +70,8 @@ enum {
         /* data contains off-queue information when !WORK_STRUCT_PWQ */
         WORK_OFFQ_FLAG_BASE     = WORK_STRUCT_COLOR_SHIFT,
 
-        WORK_OFFQ_CANCELING     = (1 << WORK_OFFQ_FLAG_BASE),
+        __WORK_OFFQ_CANCELING   = WORK_OFFQ_FLAG_BASE,
+        WORK_OFFQ_CANCELING     = (1 << __WORK_OFFQ_CANCELING),
 
         /*
          * When a work item is off queue, its high bits point to the last
diff --git a/include/net/caif/cfpkt.h b/include/net/caif/cfpkt.h
index 1c1ad46250d5..fe328c52c46b 100644
--- a/include/net/caif/cfpkt.h
+++ b/include/net/caif/cfpkt.h
@@ -171,7 +171,7 @@ struct cfpkt *cfpkt_split(struct cfpkt *pkt, u16 pos);
  * @return    Checksum of buffer.
  */
 
-u16 cfpkt_iterate(struct cfpkt *pkt,
+int cfpkt_iterate(struct cfpkt *pkt,
                 u16 (*iter_func)(u16 chks, void *buf, u16 len),
                 u16 data);
 
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 9eaaa7884586..decb9a095ae7 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -119,6 +119,22 @@ int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
                            const struct nft_data *data,
                            enum nft_data_types type);
 
+
+/**
+ *      struct nft_userdata - user defined data associated with an object
+ *
+ *      @len: length of the data
+ *      @data: content
+ *
+ *      The presence of user data is indicated in an object specific fashion,
+ *      so a length of zero can't occur and the value "len" indicates data
+ *      of length len + 1.
+ */
+struct nft_userdata {
+        u8                      len;
+        unsigned char           data[0];
+};
+
 /**
  *      struct nft_set_elem - generic representation of set elements
  *
@@ -380,7 +396,7 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
  *      @handle: rule handle
  *      @genmask: generation mask
  *      @dlen: length of expression data
- *      @ulen: length of user data (used for comments)
+ *      @udata: user data is appended to the rule
  *      @data: expression data
  */
 struct nft_rule {
@@ -388,7 +404,7 @@ struct nft_rule {
         u64                             handle:42,
                                         genmask:2,
                                         dlen:12,
-                                        ulen:8;
+                                        udata:1;
         unsigned char                   data[]
                 __attribute__((aligned(__alignof__(struct nft_expr))));
 };
@@ -476,7 +492,7 @@ static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
         return (struct nft_expr *)&rule->data[rule->dlen];
 }
 
-static inline void *nft_userdata(const struct nft_rule *rule)
+static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)
 {
         return (void *)&rule->data[rule->dlen];
 }
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 805570650062..05a2083f7a28 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -147,6 +147,16 @@ struct kvm_pit_config {
 
 #define KVM_PIT_SPEAKER_DUMMY     1
 
+struct kvm_s390_skeys {
+        __u64 start_gfn;
+        __u64 count;
+        __u64 skeydata_addr;
+        __u32 flags;
+        __u32 reserved[9];
+};
+#define KVM_S390_GET_SKEYS_NONE   1
+#define KVM_S390_SKEYS_MAX        1048576
+
 #define KVM_EXIT_UNKNOWN          0
 #define KVM_EXIT_EXCEPTION        1
 #define KVM_EXIT_IO               2
@@ -172,6 +182,7 @@ struct kvm_pit_config {
 #define KVM_EXIT_S390_TSCH        22
 #define KVM_EXIT_EPR              23
 #define KVM_EXIT_SYSTEM_EVENT     24
+#define KVM_EXIT_S390_STSI        25
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -309,6 +320,15 @@ struct kvm_run {
                         __u32 type;
                         __u64 flags;
                 } system_event;
+                /* KVM_EXIT_S390_STSI */
+                struct {
+                        __u64 addr;
+                        __u8 ar;
+                        __u8 reserved;
+                        __u8 fc;
+                        __u8 sel1;
+                        __u16 sel2;
+                } s390_stsi;
                 /* Fix the size of the union. */
                 char padding[256];
         };
@@ -324,7 +344,7 @@ struct kvm_run {
         __u64 kvm_dirty_regs;
         union {
                 struct kvm_sync_regs regs;
-                char padding[1024];
+                char padding[2048];
         } s;
 };
 
@@ -365,6 +385,24 @@ struct kvm_translation {
         __u8  pad[5];
 };
 
+/* for KVM_S390_MEM_OP */
+struct kvm_s390_mem_op {
+        /* in */
+        __u64 gaddr;            /* the guest address */
+        __u64 flags;            /* flags */
+        __u32 size;             /* amount of bytes */
+        __u32 op;               /* type of operation */
+        __u64 buf;              /* buffer in userspace */
+        __u8 ar;                /* the access register number */
+        __u8 reserved[31];      /* should be set to 0 */
+};
+/* types for kvm_s390_mem_op->op */
+#define KVM_S390_MEMOP_LOGICAL_READ     0
+#define KVM_S390_MEMOP_LOGICAL_WRITE    1
+/* flags for kvm_s390_mem_op->flags */
+#define KVM_S390_MEMOP_F_CHECK_ONLY             (1ULL << 0)
+#define KVM_S390_MEMOP_F_INJECT_EXCEPTION       (1ULL << 1)
+
 /* for KVM_INTERRUPT */
 struct kvm_interrupt {
         /* in */
@@ -760,6 +798,12 @@ struct kvm_ppc_smmu_info {
 #define KVM_CAP_PPC_ENABLE_HCALL 104
 #define KVM_CAP_CHECK_EXTENSION_VM 105
 #define KVM_CAP_S390_USER_SIGP 106
+#define KVM_CAP_S390_VECTOR_REGISTERS 107
+#define KVM_CAP_S390_MEM_OP 108
+#define KVM_CAP_S390_USER_STSI 109
+#define KVM_CAP_S390_SKEYS 110
+#define KVM_CAP_MIPS_FPU 111
+#define KVM_CAP_MIPS_MSA 112
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -1135,6 +1179,11 @@ struct kvm_s390_ucas_mapping {
 #define KVM_ARM_VCPU_INIT         _IOW(KVMIO,  0xae, struct kvm_vcpu_init)
 #define KVM_ARM_PREFERRED_TARGET  _IOR(KVMIO,  0xaf, struct kvm_vcpu_init)
 #define KVM_GET_REG_LIST          _IOWR(KVMIO, 0xb0, struct kvm_reg_list)
+/* Available with KVM_CAP_S390_MEM_OP */
+#define KVM_S390_MEM_OP           _IOW(KVMIO,  0xb1, struct kvm_s390_mem_op)
+/* Available with KVM_CAP_S390_SKEYS */
+#define KVM_S390_GET_SKEYS      _IOW(KVMIO, 0xb2, struct kvm_s390_skeys)
+#define KVM_S390_SET_SKEYS      _IOW(KVMIO, 0xb3, struct kvm_s390_skeys)
 
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
 #define KVM_DEV_ASSIGN_PCI_2_3          (1 << 1)
diff --git a/include/uapi/linux/serial.h b/include/uapi/linux/serial.h
index 5e0d0ed61cf3..25331f9faa76 100644
--- a/include/uapi/linux/serial.h
+++ b/include/uapi/linux/serial.h
@@ -65,6 +65,10 @@ struct serial_struct {
 #define SERIAL_IO_PORT  0
 #define SERIAL_IO_HUB6  1
 #define SERIAL_IO_MEM   2
+#define SERIAL_IO_MEM32   3
+#define SERIAL_IO_AU      4
+#define SERIAL_IO_TSI     5
+#define SERIAL_IO_MEM32BE 6
 
 #define UART_CLEAR_FIFO         0x01
 #define UART_USE_FIFO           0x02
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 19d5219b0b99..242cf0c6e33d 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -9,3 +9,4 @@ header-y += tc_pedit.h
 header-y += tc_skbedit.h
 header-y += tc_vlan.h
 header-y += tc_bpf.h
+header-y += tc_connmark.h
diff --git a/include/video/omapdss.h b/include/video/omapdss.h
index 60de61fea8e3..c8ed15daad02 100644
--- a/include/video/omapdss.h
+++ b/include/video/omapdss.h
@@ -689,6 +689,7 @@ struct omapdss_dsi_ops {
 };
 
 struct omap_dss_device {
+        struct kobject kobj;
         struct device *dev;
 
         struct module *owner;
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 7491ee5d8164..83338210ee04 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -46,4 +46,30 @@ static inline efi_system_table_t __init *xen_efi_probe(void)
 }
 #endif
 
+#ifdef CONFIG_PREEMPT
+
+static inline void xen_preemptible_hcall_begin(void)
+{
+}
+
+static inline void xen_preemptible_hcall_end(void)
+{
+}
+
+#else
+
+DECLARE_PER_CPU(bool, xen_in_preemptible_hcall);
+
+static inline void xen_preemptible_hcall_begin(void)
+{
+        __this_cpu_write(xen_in_preemptible_hcall, true);
+}
+
+static inline void xen_preemptible_hcall_end(void)
+{
+        __this_cpu_write(xen_in_preemptible_hcall, false);
+}
+
+#endif /* CONFIG_PREEMPT */
+
 #endif /* INCLUDE_XEN_OPS_H */
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 1d1fe9361d29..fc7f4748d34a 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -548,9 +548,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
 
         rcu_read_lock();
         cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-                if (cp == root_cs)
-                        continue;
-
                 /* skip the whole subtree if @cp doesn't have any CPU */
                 if (cpumask_empty(cp->cpus_allowed)) {
                         pos_css = css_rightmost_descendant(pos_css);
@@ -873,7 +870,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
                  * If it becomes empty, inherit the effective mask of the
                  * parent, which is guaranteed to have some CPUs.
                  */
-                if (cpumask_empty(new_cpus))
+                if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
                         cpumask_copy(new_cpus, parent->effective_cpus);
 
                 /* Skip the whole subtree if the cpumask remains the same. */
@@ -1129,7 +1126,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
                  * If it becomes empty, inherit the effective mask of the
                  * parent, which is guaranteed to have some MEMs.
                  */
-                if (nodes_empty(*new_mems))
+                if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
                         *new_mems = parent->effective_mems;
 
                 /* Skip the whole subtree if the nodemask remains the same. */
@@ -1979,7 +1976,9 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
 
         spin_lock_irq(&callback_lock);
         cs->mems_allowed = parent->mems_allowed;
+        cs->effective_mems = parent->mems_allowed;
         cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
+        cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
         spin_unlock_irq(&callback_lock);
 out_unlock:
         mutex_unlock(&cpuset_mutex);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 196a06fbc122..886d09e691d5 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1474,8 +1474,13 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
          * otherwise we'll have trouble later trying to figure out
          * which interrupt is which (messes up the interrupt freeing
          * logic etc).
+         *
+         * Also IRQF_COND_SUSPEND only makes sense for shared interrupts and
+         * it cannot be set along with IRQF_NO_SUSPEND.
          */
-        if ((irqflags & IRQF_SHARED) && !dev_id)
+        if (((irqflags & IRQF_SHARED) && !dev_id) ||
+            (!(irqflags & IRQF_SHARED) && (irqflags & IRQF_COND_SUSPEND)) ||
+            ((irqflags & IRQF_NO_SUSPEND) && (irqflags & IRQF_COND_SUSPEND)))
                 return -EINVAL;
 
         desc = irq_to_desc(irq);
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index 3ca532592704..5204a6d1b985 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -43,9 +43,12 @@ void irq_pm_install_action(struct irq_desc *desc, struct irqaction *action)
 
         if (action->flags & IRQF_NO_SUSPEND)
                 desc->no_suspend_depth++;
+        else if (action->flags & IRQF_COND_SUSPEND)
+                desc->cond_suspend_depth++;
 
         WARN_ON_ONCE(desc->no_suspend_depth &&
-                     desc->no_suspend_depth != desc->nr_actions);
+                     (desc->no_suspend_depth +
+                        desc->cond_suspend_depth) != desc->nr_actions);
 }
 
 /*
@@ -61,6 +64,8 @@ void irq_pm_remove_action(struct irq_desc *desc, struct irqaction *action)
 
         if (action->flags & IRQF_NO_SUSPEND)
                 desc->no_suspend_depth--;
+        else if (action->flags & IRQF_COND_SUSPEND)
+                desc->cond_suspend_depth--;
 }
 
 static bool suspend_device_irq(struct irq_desc *desc, int irq)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index ff7f47d026ac..01ca08804f51 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -248,11 +248,12 @@ static int klp_find_external_symbol(struct module *pmod, const char *name,
         /* first, check if it's an exported symbol */
         preempt_disable();
         sym = find_symbol(name, NULL, NULL, true, true);
-        preempt_enable();
         if (sym) {
                 *addr = sym->value;
+                preempt_enable();
                 return 0;
         }
+        preempt_enable();
 
         /* otherwise check if it's in another .o within the patch module */
         return klp_find_object_symbol(pmod->name, name, addr);
@@ -314,12 +315,12 @@ static void notrace klp_ftrace_handler(unsigned long ip,
         rcu_read_lock();
         func = list_first_or_null_rcu(&ops->func_stack, struct klp_func,
                                       stack_node);
-        rcu_read_unlock();
-
         if (WARN_ON_ONCE(!func))
-                return;
+                goto unlock;
 
         klp_arch_set_pc(regs, (unsigned long)func->new_func);
+unlock:
+        rcu_read_unlock();
 }
 
 static int klp_disable_func(struct klp_func *func)
@@ -731,7 +732,7 @@ static int klp_init_func(struct klp_object *obj, struct klp_func *func)
         func->state = KLP_DISABLED;
 
         return kobject_init_and_add(&func->kobj, &klp_ktype_func,
-                                    obj->kobj, func->old_name);
+                                    obj->kobj, "%s", func->old_name);
 }
 
 /* parts of the initialization that is done only when the object is loaded */
@@ -807,7 +808,7 @@ static int klp_init_patch(struct klp_patch *patch)
         patch->state = KLP_DISABLED;
 
         ret = kobject_init_and_add(&patch->kobj, &klp_ktype_patch,
-                                   klp_root_kobj, patch->mod->name);
+                                   klp_root_kobj, "%s", patch->mod->name);
         if (ret)
                 goto unlock;
 
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index e16e5542bf13..6357265a31ad 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1193,6 +1193,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
                 ret = __rt_mutex_slowlock(lock, state, timeout, &waiter);
 
         if (unlikely(ret)) {
+                __set_current_state(TASK_RUNNING);
                 if (rt_mutex_has_waiters(lock))
                         remove_waiter(lock, &waiter);
                 rt_mutex_handle_deadlock(ret, chwalk, &waiter);
diff --git a/kernel/module.c b/kernel/module.c
index b34813f725e9..cc93cf68653c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2313,11 +2313,13 @@ static void layout_symtab(struct module *mod, struct load_info *info)
         info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
         info->stroffs = mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
         mod->core_size += strtab_size;
+        mod->core_size = debug_align(mod->core_size);
 
         /* Put string table section at end of init part of module. */
         strsect->sh_flags |= SHF_ALLOC;
         strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
                                          info->index.str) | INIT_OFFSET_MASK;
+        mod->init_size = debug_align(mod->init_size);
         pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
 }
 
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
index cbd69d842341..2ca4a8b5fe57 100644
--- a/kernel/printk/console_cmdline.h
+++ b/kernel/printk/console_cmdline.h
@@ -3,7 +3,7 @@
 
 struct console_cmdline
 {
-        char    name[8];                        /* Name of the driver       */
+        char    name[16];                       /* Name of the driver       */
         int     index;                          /* Minor dev. to use        */
         char    *options;                       /* Options for the driver   */
 #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 01cfd69c54c6..bb0635bd74f2 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2464,6 +2464,7 @@ void register_console(struct console *newcon)
         for (i = 0, c = console_cmdline;
              i < MAX_CMDLINECONSOLES && c->name[0];
              i++, c++) {
+                BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
                 if (strcmp(c->name, newcon->name) != 0)
                         continue;
                 if (newcon->index >= 0 &&
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index f0f831e8a345..d0c4209bb836 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -996,6 +996,13 @@ void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
                 rq_clock_skip_update(rq, true);
 }
 
+static ATOMIC_NOTIFIER_HEAD(task_migration_notifier);
+
+void register_task_migration_notifier(struct notifier_block *n)
+{
+        atomic_notifier_chain_register(&task_migration_notifier, n);
+}
+
 #ifdef CONFIG_SMP
 void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
 {
@@ -1026,10 +1033,18 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
         trace_sched_migrate_task(p, new_cpu);
 
         if (task_cpu(p) != new_cpu) {
+                struct task_migration_notifier tmn;
+
                 if (p->sched_class->migrate_task_rq)
                         p->sched_class->migrate_task_rq(p, new_cpu);
                 p->se.nr_migrations++;
                 perf_sw_event_sched(PERF_COUNT_SW_CPU_MIGRATIONS, 1, 0);
+
+                tmn.task = p;
+                tmn.from_cpu = task_cpu(p);
+                tmn.to_cpu = new_cpu;
+
+                atomic_notifier_call_chain(&task_migration_notifier, 0, &tmn);
         }
 
         __set_task_cpu(p, new_cpu);
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 94b2d7b88a27..80014a178342 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -82,6 +82,7 @@ static void cpuidle_idle_call(void)
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
         int next_state, entered_state;
         unsigned int broadcast;
+        bool reflect;
 
         /*
          * Check if the idle task must be rescheduled. If it is the
@@ -105,6 +106,9 @@ static void cpuidle_idle_call(void)
          */
         rcu_idle_enter();
 
+        if (cpuidle_not_available(drv, dev))
+                goto use_default;
+
         /*
          * Suspend-to-idle ("freeze") is a system state in which all user space
          * has been frozen, all I/O devices have been suspended and the only
@@ -115,30 +119,24 @@ static void cpuidle_idle_call(void)
          * until a proper wakeup interrupt happens.
          */
         if (idle_should_freeze()) {
-                cpuidle_enter_freeze();
-                local_irq_enable();
-                goto exit_idle;
-        }
+                entered_state = cpuidle_enter_freeze(drv, dev);
+                if (entered_state >= 0) {
+                        local_irq_enable();
+                        goto exit_idle;
+                }
 
-        /*
-         * Ask the cpuidle framework to choose a convenient idle state.
-         * Fall back to the default arch idle method on errors.
-         */
-        next_state = cpuidle_select(drv, dev);
-        if (next_state < 0) {
-use_default:
+                reflect = false;
+                next_state = cpuidle_find_deepest_state(drv, dev);
+        } else {
+                reflect = true;
                 /*
-                 * We can't use the cpuidle framework, let's use the default
-                 * idle routine.
+                 * Ask the cpuidle framework to choose a convenient idle state.
                  */
-                if (current_clr_polling_and_test())
-                        local_irq_enable();
-                else
-                        arch_cpu_idle();
-
-                goto exit_idle;
+                next_state = cpuidle_select(drv, dev);
         }
-
+        /* Fall back to the default arch idle method on errors. */
+        if (next_state < 0)
+                goto use_default;
 
         /*
          * The idle task must be scheduled, it is pointless to
@@ -183,7 +181,8 @@ use_default:
         /*
          * Give the governor an opportunity to reflect on the outcome
          */
-        cpuidle_reflect(dev, entered_state);
+        if (reflect)
+                cpuidle_reflect(dev, entered_state);
 
 exit_idle:
         __current_set_polling();
@@ -196,6 +195,19 @@ exit_idle:
 
         rcu_idle_exit();
         start_critical_timings();
+        return;
+
+use_default:
+        /*
+         * We can't use the cpuidle framework, let's use the default
+         * idle routine.
+         */
+        if (current_clr_polling_and_test())
+                local_irq_enable();
+        else
+                arch_cpu_idle();
+
+        goto exit_idle;
 }
 
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index 667b2e62fad2..a03d9cd23ed7 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1108,6 +1108,7 @@ DECLARE_RWSEM(uts_sem);
 /*
  * Work around broken programs that cannot handle "Linux 3.0".
  * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
+ * And we map 4.x to 2.6.60+x, so 4.0 would be 2.6.60.
  */
 static int override_release(char __user *release, size_t len)
 {
@@ -1127,7 +1128,7 @@ static int override_release(char __user *release, size_t len)
                                 break;
                         rest++;
                 }
-                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
+                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 60;
                 copy = clamp_t(size_t, len, 1, sizeof(buf));
                 copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
                 ret = copy_to_user(release, buf, copy + 1);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 45e5cb143d17..4f228024055b 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
 
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int ftrace_graph_active;
+#else
+# define ftrace_graph_active 0
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 static struct ftrace_ops *removed_ops;
@@ -2041,8 +2047,12 @@ static int ftrace_check_record(struct dyn_ftrace *rec, int enable, int update)
                 if (!ftrace_rec_count(rec))
                         rec->flags = 0;
                 else
-                        /* Just disable the record (keep REGS state) */
-                        rec->flags &= ~FTRACE_FL_ENABLED;
+                        /*
+                         * Just disable the record, but keep the ops TRAMP
+                         * and REGS states. The _EN flags must be disabled though.
+                         */
+                        rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
+                                        FTRACE_FL_REGS_EN);
         }
 
         return FTRACE_UPDATE_MAKE_NOP;
@@ -2688,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
 
 static void ftrace_startup_sysctl(void)
 {
+        int command;
+
         if (unlikely(ftrace_disabled))
                 return;
 
         /* Force update next time */
         saved_ftrace_func = NULL;
         /* ftrace_start_up is true if we want ftrace running */
-        if (ftrace_start_up)
-                ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+        if (ftrace_start_up) {
+                command = FTRACE_UPDATE_CALLS;
+                if (ftrace_graph_active)
+                        command |= FTRACE_START_FUNC_RET;
+                ftrace_startup_enable(command);
+        }
 }
 
 static void ftrace_shutdown_sysctl(void)
 {
+        int command;
+
         if (unlikely(ftrace_disabled))
                 return;
 
         /* ftrace_start_up is true if ftrace is running */
-        if (ftrace_start_up)
-                ftrace_run_update_code(FTRACE_DISABLE_CALLS);
+        if (ftrace_start_up) {
+                command = FTRACE_DISABLE_CALLS;
+                if (ftrace_graph_active)
+                        command |= FTRACE_STOP_FUNC_RET;
+                ftrace_run_update_code(command);
+        }
 }
 
 static cycle_t          ftrace_update_time;
@@ -5558,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
 
         if (ftrace_enabled) {
 
-                ftrace_startup_sysctl();
-
                 /* we are starting ftrace again */
                 if (ftrace_ops_list != &ftrace_list_end)
                         update_ftrace_function();
 
+                ftrace_startup_sysctl();
+
         } else {
                 /* stopping ftrace calls (just send to ftrace_stub) */
                 ftrace_trace_function = ftrace_stub;
@@ -5590,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
         ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
 };
 
-static int ftrace_graph_active;
-
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
 {
         return 0;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index f28849394791..41ff75b478c6 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2728,19 +2728,57 @@ bool flush_work(struct work_struct *work)
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
+struct cwt_wait {
+        wait_queue_t            wait;
+        struct work_struct      *work;
+};
+
+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+        struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
+
+        if (cwait->work != key)
+                return 0;
+        return autoremove_wake_function(wait, mode, sync, key);
+}
+
 static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
 {
+        static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
         unsigned long flags;
         int ret;
 
         do {
                 ret = try_to_grab_pending(work, is_dwork, &flags);
                 /*
-                 * If someone else is canceling, wait for the same event it
-                 * would be waiting for before retrying.
+                 * If someone else is already canceling, wait for it to
+                 * finish.  flush_work() doesn't work for PREEMPT_NONE
+                 * because we may get scheduled between @work's completion
+                 * and the other canceling task resuming and clearing
+                 * CANCELING - flush_work() will return false immediately
+                 * as @work is no longer busy, try_to_grab_pending() will
+                 * return -ENOENT as @work is still being canceled and the
+                 * other canceling task won't be able to clear CANCELING as
+                 * we're hogging the CPU.
+                 *
+                 * Let's wait for completion using a waitqueue.  As this
+                 * may lead to the thundering herd problem, use a custom
+                 * wake function which matches @work along with exclusive
+                 * wait and wakeup.
                  */
-                if (unlikely(ret == -ENOENT))
-                        flush_work(work);
+                if (unlikely(ret == -ENOENT)) {
+                        struct cwt_wait cwait;
+
+                        init_wait(&cwait.wait);
+                        cwait.wait.func = cwt_wakefn;
+                        cwait.work = work;
+
+                        prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
+                                                  TASK_UNINTERRUPTIBLE);
+                        if (work_is_canceling(work))
+                                schedule();
+                        finish_wait(&cancel_waitq, &cwait.wait);
+                }
         } while (unlikely(ret < 0));
 
         /* tell other tasks trying to grab @work to back off */
@@ -2749,6 +2787,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
 
         flush_work(work);
         clear_work_data(work);
+
+        /*
+         * Paired with prepare_to_wait() above so that either
+         * waitqueue_active() is visible here or !work_is_canceling() is
+         * visible there.
+         */
+        smp_mb();
+        if (waitqueue_active(&cancel_waitq))
+                __wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
+
         return ret;
 }
 
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9cc4c4a90d00..b5344ef4c684 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/log2.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
@@ -217,15 +218,15 @@ static void bucket_table_free(const struct bucket_table *tbl)
 static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
                                                size_t nbuckets)
 {
-        struct bucket_table *tbl;
+        struct bucket_table *tbl = NULL;
         size_t size;
         int i;
 
         size = sizeof(*tbl) + nbuckets * sizeof(tbl->buckets[0]);
-        tbl = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER))
+                tbl = kzalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
         if (tbl == NULL)
                 tbl = vzalloc(size);
-
         if (tbl == NULL)
                 return NULL;
 
@@ -247,26 +248,24 @@ static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
  * @ht:         hash table
  * @new_size:   new table size
  */
-bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size)
+static bool rht_grow_above_75(const struct rhashtable *ht, size_t new_size)
 {
         /* Expand table when exceeding 75% load */
         return atomic_read(&ht->nelems) > (new_size / 4 * 3) &&
-               (ht->p.max_shift && atomic_read(&ht->shift) < ht->p.max_shift);
+               (!ht->p.max_shift || atomic_read(&ht->shift) < ht->p.max_shift);
 }
-EXPORT_SYMBOL_GPL(rht_grow_above_75);
 
 /**
  * rht_shrink_below_30 - returns true if nelems < 0.3 * table-size
  * @ht:         hash table
  * @new_size:   new table size
  */
-bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size)
+static bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size)
 {
         /* Shrink table beneath 30% load */
         return atomic_read(&ht->nelems) < (new_size * 3 / 10) &&
                (atomic_read(&ht->shift) > ht->p.min_shift);
 }
-EXPORT_SYMBOL_GPL(rht_shrink_below_30);
 
 static void lock_buckets(struct bucket_table *new_tbl,
                          struct bucket_table *old_tbl, unsigned int hash)
@@ -414,6 +413,7 @@ int rhashtable_expand(struct rhashtable *ht)
                         }
                 }
                 unlock_buckets(new_tbl, old_tbl, new_hash);
+                cond_resched();
         }
 
         /* Unzip interleaved hash chains */
@@ -437,6 +437,7 @@ int rhashtable_expand(struct rhashtable *ht)
                                 complete = false;
 
                         unlock_buckets(new_tbl, old_tbl, old_hash);
+                        cond_resched();
                 }
         }
 
@@ -495,6 +496,7 @@ int rhashtable_shrink(struct rhashtable *ht)
                                    tbl->buckets[new_hash + new_tbl->size]);
 
                 unlock_buckets(new_tbl, tbl, new_hash);
+                cond_resched();
         }
 
         /* Publish the new, valid hash table */
@@ -528,31 +530,19 @@ static void rht_deferred_worker(struct work_struct *work)
         list_for_each_entry(walker, &ht->walkers, list)
                 walker->resize = true;
 
-        if (ht->p.grow_decision && ht->p.grow_decision(ht, tbl->size))
+        if (rht_grow_above_75(ht, tbl->size))
                 rhashtable_expand(ht);
-        else if (ht->p.shrink_decision && ht->p.shrink_decision(ht, tbl->size))
+        else if (rht_shrink_below_30(ht, tbl->size))
                 rhashtable_shrink(ht);
-
 unlock:
         mutex_unlock(&ht->mutex);
 }
 
-static void rhashtable_wakeup_worker(struct rhashtable *ht)
-{
-        struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht);
-        struct bucket_table *new_tbl = rht_dereference_rcu(ht->future_tbl, ht);
-        size_t size = tbl->size;
-
-        /* Only adjust the table if no resizing is currently in progress. */
-        if (tbl == new_tbl &&
-            ((ht->p.grow_decision && ht->p.grow_decision(ht, size)) ||
-             (ht->p.shrink_decision && ht->p.shrink_decision(ht, size))))
-                schedule_work(&ht->run_work);
-}
-
 static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
-                                struct bucket_table *tbl, u32 hash)
+                                struct bucket_table *tbl,
+                                const struct bucket_table *old_tbl, u32 hash)
 {
+        bool no_resize_running = tbl == old_tbl;
         struct rhash_head *head;
 
         hash = rht_bucket_index(tbl, hash);
@@ -568,8 +558,8 @@ static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
         rcu_assign_pointer(tbl->buckets[hash], obj);
 
         atomic_inc(&ht->nelems);
-
-        rhashtable_wakeup_worker(ht);
+        if (no_resize_running && rht_grow_above_75(ht, tbl->size))
+                schedule_work(&ht->run_work);
 }
 
 /**
@@ -599,7 +589,7 @@ void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj)
         hash = obj_raw_hashfn(ht, rht_obj(ht, obj));
 
         lock_buckets(tbl, old_tbl, hash);
-        __rhashtable_insert(ht, obj, tbl, hash);
+        __rhashtable_insert(ht, obj, tbl, old_tbl, hash);
         unlock_buckets(tbl, old_tbl, hash);
 
         rcu_read_unlock();
@@ -681,8 +671,11 @@ found:
         unlock_buckets(new_tbl, old_tbl, new_hash);
 
         if (ret) {
+                bool no_resize_running = new_tbl == old_tbl;
+
                 atomic_dec(&ht->nelems);
-                rhashtable_wakeup_worker(ht);
+                if (no_resize_running && rht_shrink_below_30(ht, new_tbl->size))
+                        schedule_work(&ht->run_work);
         }
 
         rcu_read_unlock();
@@ -852,7 +845,7 @@ bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
                 goto exit;
         }
 
-        __rhashtable_insert(ht, obj, new_tbl, new_hash);
+        __rhashtable_insert(ht, obj, new_tbl, old_tbl, new_hash);
 
 exit:
         unlock_buckets(new_tbl, old_tbl, new_hash);
@@ -894,6 +887,9 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
         if (!iter->walker)
                 return -ENOMEM;
 
+        INIT_LIST_HEAD(&iter->walker->list);
+        iter->walker->resize = false;
+
         mutex_lock(&ht->mutex);
         list_add(&iter->walker->list, &ht->walkers);
         mutex_unlock(&ht->mutex);
@@ -1111,8 +1107,7 @@ int rhashtable_init(struct rhashtable *ht, struct rhashtable_params *params)
         if (!ht->p.hash_rnd)
                 get_random_bytes(&ht->p.hash_rnd, sizeof(ht->p.hash_rnd));
 
-        if (ht->p.grow_decision || ht->p.shrink_decision)
-                INIT_WORK(&ht->run_work, rht_deferred_worker);
+        INIT_WORK(&ht->run_work, rht_deferred_worker);
 
         return 0;
 }
@@ -1130,8 +1125,7 @@ void rhashtable_destroy(struct rhashtable *ht)
 {
         ht->being_destroyed = true;
 
-        if (ht->p.grow_decision || ht->p.shrink_decision)
-                cancel_work_sync(&ht->run_work);
+        cancel_work_sync(&ht->run_work);
 
         mutex_lock(&ht->mutex);
         bucket_table_free(rht_dereference(ht->tbl, ht));
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 88c0854bd752..5c94e1012a91 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args)
 
         if (s->len < s->size) {
                 len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
-                if (seq_buf_can_fit(s, len)) {
+                if (s->len + len < s->size) {
                         s->len += len;
                         return 0;
                 }
@@ -118,7 +118,7 @@ int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
 
         if (s->len < s->size) {
                 ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
-                if (seq_buf_can_fit(s, ret)) {
+                if (s->len + ret < s->size) {
                         s->len += ret;
                         return 0;
                 }
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 1dfeba73fc74..67c7593d1dd6 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -191,18 +191,18 @@ error:
         return err;
 }
 
+static struct rhashtable ht;
+
 static int __init test_rht_init(void)
 {
-        struct rhashtable ht;
         struct rhashtable_params params = {
                 .nelem_hint = TEST_HT_SIZE,
                 .head_offset = offsetof(struct test_obj, node),
                 .key_offset = offsetof(struct test_obj, value),
                 .key_len = sizeof(int),
                 .hashfn = jhash,
+                .max_shift = 1, /* we expand/shrink manually here */
                 .nulls_base = (3U << RHT_BASE_SHIFT),
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
         int err;
 
@@ -222,6 +222,11 @@ static int __init test_rht_init(void)
         return err;
 }
 
+static void __exit test_rht_exit(void)
+{
+}
+
 module_init(test_rht_init);
+module_exit(test_rht_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d18d3a6e7337..9fe07692eaad 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5247,7 +5247,7 @@ static int memory_low_show(struct seq_file *m, void *v)
         unsigned long low = ACCESS_ONCE(memcg->low);
 
         if (low == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)low * PAGE_SIZE);
 
@@ -5262,7 +5262,7 @@ static ssize_t memory_low_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &low);
+        err = page_counter_memparse(buf, "max", &low);
         if (err)
                 return err;
 
@@ -5277,7 +5277,7 @@ static int memory_high_show(struct seq_file *m, void *v)
         unsigned long high = ACCESS_ONCE(memcg->high);
 
         if (high == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)high * PAGE_SIZE);
 
@@ -5292,7 +5292,7 @@ static ssize_t memory_high_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &high);
+        err = page_counter_memparse(buf, "max", &high);
         if (err)
                 return err;
 
@@ -5307,7 +5307,7 @@ static int memory_max_show(struct seq_file *m, void *v)
         unsigned long max = ACCESS_ONCE(memcg->memory.limit);
 
         if (max == PAGE_COUNTER_MAX)
-                seq_puts(m, "infinity\n");
+                seq_puts(m, "max\n");
         else
                 seq_printf(m, "%llu\n", (u64)max * PAGE_SIZE);
 
@@ -5322,7 +5322,7 @@ static ssize_t memory_max_write(struct kernfs_open_file *of,
         int err;
 
         buf = strstrip(buf);
-        err = page_counter_memparse(buf, "infinity", &max);
+        err = page_counter_memparse(buf, "max", &max);
         if (err)
                 return err;
 
@@ -5426,7 +5426,7 @@ bool mem_cgroup_low(struct mem_cgroup *root, struct mem_cgroup *memcg)
         if (memcg == root_mem_cgroup)
                 return false;
 
-        if (page_counter_read(&memcg->memory) > memcg->low)
+        if (page_counter_read(&memcg->memory) >= memcg->low)
                 return false;
 
         while (memcg != root) {
@@ -5435,7 +5435,7 @@ bool mem_cgroup_low(struct mem_cgroup *root, struct mem_cgroup *memcg)
                 if (memcg == root_mem_cgroup)
                         break;
 
-                if (page_counter_read(&memcg->memory) > memcg->low)
+                if (page_counter_read(&memcg->memory) >= memcg->low)
                         return false;
         }
         return true;
diff --git a/mm/nommu.c b/mm/nommu.c
index 7296360fc057..3e67e7538ecf 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1213,11 +1213,9 @@ static int do_mmap_private(struct vm_area_struct *vma,
         if (sysctl_nr_trim_pages && total - point >= sysctl_nr_trim_pages) {
                 total = point;
                 kdebug("try to alloc exact %lu pages", total);
-                base = alloc_pages_exact(len, GFP_KERNEL);
-        } else {
-                base = (void *)__get_free_pages(GFP_KERNEL, order);
         }
 
+        base = alloc_pages_exact(total << PAGE_SHIFT, GFP_KERNEL);
         if (!base)
                 goto enomem;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a47f0b229a1a..7abfa70cdc1a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2353,8 +2353,15 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                 if (ac->high_zoneidx < ZONE_NORMAL)
                         goto out;
                 /* The OOM killer does not compensate for light reclaim */
-                if (!(gfp_mask & __GFP_FS))
+                if (!(gfp_mask & __GFP_FS)) {
+                        /*
+                         * XXX: Page reclaim didn't yield anything,
+                         * and the OOM killer can't be invoked, but
+                         * keep looping as per should_alloc_retry().
+                         */
+                        *did_some_progress = 1;
                         goto out;
+                }
                 /*
                  * GFP_THISNODE contains __GFP_NORETRY and we never hit this.
                  * Sanity check for bare calls of __GFP_THISNODE, not real OOM.
diff --git a/mm/shmem.c b/mm/shmem.c
index 2f17cb5f00a4..cf2d0ca010bc 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1455,6 +1455,9 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
 
 bool shmem_mapping(struct address_space *mapping)
 {
+        if (!mapping->host)
+                return false;
+
         return mapping->host->i_sb->s_op == &shmem_ops;
 }
 
diff --git a/net/bridge/br.c b/net/bridge/br.c
index fb57ab6b24f9..02c24cf63c34 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -190,6 +190,8 @@ static int __init br_init(void)
 {
         int err;
 
+        BUILD_BUG_ON(sizeof(struct br_input_skb_cb) > FIELD_SIZEOF(struct sk_buff, cb));
+
         err = stp_proto_register(&br_stp_proto);
         if (err < 0) {
                 pr_err("bridge: can't register sap for STP\n");
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index 8bc7caa28e64..434ba8557826 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -84,7 +84,7 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
         u16 tmp;
         u16 len;
         u16 hdrchks;
-        u16 pktchks;
+        int pktchks;
         struct cffrml *this;
         this = container_obj(layr);
 
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 1be0b521ac49..f6c3b2137eea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -255,9 +255,9 @@ inline u16 cfpkt_getlen(struct cfpkt *pkt)
         return skb->len;
 }
 
-inline u16 cfpkt_iterate(struct cfpkt *pkt,
-                         u16 (*iter_func)(u16, void *, u16),
-                         u16 data)
+int cfpkt_iterate(struct cfpkt *pkt,
+                  u16 (*iter_func)(u16, void *, u16),
+                  u16 data)
 {
         /*
          * Don't care about the performance hit of linearizing,
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 66e08040ced7..32d710eaf1fc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
                 goto inval_skb;
         }
 
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        skb_reset_mac_header(skb);
         skb_reset_network_header(skb);
         skb_reset_transport_header(skb);
 
diff --git a/net/compat.c b/net/compat.c
index 3236b4167a32..94d3d5e97883 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -711,24 +711,18 @@ static unsigned char nas[21] = {
 
 COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
                        unsigned int, vlen, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                               flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_recvmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
@@ -751,9 +745,6 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
         int datagrams;
         struct timespec ktspec;
 
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
-
         if (timeout == NULL)
                 return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                       flags | MSG_CMSG_COMPAT, NULL);
diff --git a/net/core/dev.c b/net/core/dev.c
index 8f9710c62e20..962ee9d71964 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -946,7 +946,7 @@ bool dev_valid_name(const char *name)
                 return false;
 
         while (*name) {
-                if (*name == '/' || isspace(*name))
+                if (*name == '/' || *name == ':' || isspace(*name))
                         return false;
                 name++;
         }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 91f74f3eb204..aa378ecef186 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -98,6 +98,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXALL_BIT] =            "rx-all",
         [NETIF_F_HW_L2FW_DOFFLOAD_BIT] = "l2-fwd-offload",
         [NETIF_F_BUSY_POLL_BIT] =        "busy-poll",
+        [NETIF_F_HW_SWITCH_OFFLOAD_BIT] = "hw-switch-offload",
 };
 
 static const char
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 0c08062d1796..1e2f46a69d50 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
         return 0;
 
 nla_put_failure:
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return -1;
 }
@@ -305,7 +308,9 @@ int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
         if (d->compat_xstats) {
-                d->xstats = st;
+                d->xstats = kmemdup(st, len, GFP_ATOMIC);
+                if (!d->xstats)
+                        goto err_out;
                 d->xstats_len = len;
         }
 
@@ -313,6 +318,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
                 return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 
         return 0;
+
+err_out:
+        d->xstats_len = 0;
+        spin_unlock_bh(d->lock);
+        return -1;
 }
 EXPORT_SYMBOL(gnet_stats_copy_app);
 
@@ -345,6 +355,9 @@ gnet_stats_finish_copy(struct gnet_dump *d)
                         return -1;
         }
 
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return 0;
 }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b4899f5b7388..508155b283dd 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1134,6 +1134,9 @@ static ssize_t pktgen_if_write(struct file *file,
                         return len;
 
                 i += len;
+                if ((value > 1) &&
+                    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
+                        return -ENOTSUPP;
                 pkt_dev->burst = value < 1 ? 1 : value;
                 sprintf(pg_result, "OK: burst=%d", pkt_dev->burst);
                 return count;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ab293a3066b3..25b4b5d23485 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1300,7 +1300,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         s_h = cb->args[0];
         s_idx = cb->args[1];
 
-        rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
         /* A hack to preserve kernel<->userspace interface.
@@ -1322,7 +1321,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, head, index_hlist) {
+                hlist_for_each_entry(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@@ -1344,7 +1343,6 @@ cont:
                 }
         }
 out:
-        rcu_read_unlock();
         cb->args[1] = idx;
         cb->args[0] = h;
 
@@ -2012,8 +2010,8 @@ replay:
         }
 
         if (1) {
-                struct nlattr *attr[ops ? ops->maxtype + 1 : 0];
-                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 0];
+                struct nlattr *attr[ops ? ops->maxtype + 1 : 1];
+                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 1];
                 struct nlattr **data = NULL;
                 struct nlattr **slave_data = NULL;
                 struct net *dest_net, *link_net = NULL;
@@ -2122,6 +2120,10 @@ replay:
                 if (IS_ERR(dest_net))
                         return PTR_ERR(dest_net);
 
+                err = -EPERM;
+                if (!netlink_ns_capable(skb, dest_net->user_ns, CAP_NET_ADMIN))
+                        goto out;
+
                 if (tb[IFLA_LINK_NETNSID]) {
                         int id = nla_get_s32(tb[IFLA_LINK_NETNSID]);
 
@@ -2130,6 +2132,9 @@ replay:
                                 err =  -EINVAL;
                                 goto out;
                         }
+                        err = -EPERM;
+                        if (!netlink_ns_capable(skb, link_net->user_ns, CAP_NET_ADMIN))
+                                goto out;
                 }
 
                 dev = rtnl_create_link(link_net ? : dest_net, ifname,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 88c613eab142..f80507823531 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3621,13 +3621,14 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 {
         struct sk_buff_head *q = &sk->sk_error_queue;
         struct sk_buff *skb, *skb_next;
+        unsigned long flags;
         int err = 0;
 
-        spin_lock_bh(&q->lock);
+        spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
         if (skb && (skb_next = skb_peek(q)))
                 err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
-        spin_unlock_bh(&q->lock);
+        spin_unlock_irqrestore(&q->lock, flags);
 
         sk->sk_err = err;
         if (err)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1d7c1256e845..3b81092771f8 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1062,7 +1062,7 @@ source_ok:
         if (decnet_debug_level & 16)
                 printk(KERN_DEBUG
                        "dn_route_output_slow: initial checks complete."
-                       " dst=%o4x src=%04x oif=%d try_hard=%d\n",
+                       " dst=%04x src=%04x oif=%d try_hard=%d\n",
                        le16_to_cpu(fld.daddr), le16_to_cpu(fld.saddr),
                        fld.flowidn_oif, try_hard);
 
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index a138d75751df..44d27469ae55 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -359,8 +359,11 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         struct hsr_port *port;
 
         hsr = netdev_priv(hsr_dev);
+
+        rtnl_lock();
         hsr_for_each_port(hsr, port)
                 hsr_del_port(port);
+        rtnl_unlock();
 
         del_timer_sync(&hsr->prune_timer);
         del_timer_sync(&hsr->announce_timer);
diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
index 779d28b65417..cd37d0011b42 100644
--- a/net/hsr/hsr_main.c
+++ b/net/hsr/hsr_main.c
@@ -36,6 +36,10 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
                         return NOTIFY_DONE;     /* Not an HSR device */
                 hsr = netdev_priv(dev);
                 port = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
+                if (port == NULL) {
+                        /* Resend of notification concerning removed device? */
+                        return NOTIFY_DONE;
+                }
         } else {
                 hsr = port->hsr;
         }
diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
index a348dcbcd683..7d37366cc695 100644
--- a/net/hsr/hsr_slave.c
+++ b/net/hsr/hsr_slave.c
@@ -181,8 +181,10 @@ void hsr_del_port(struct hsr_port *port)
         list_del_rcu(&port->port_list);
 
         if (port != master) {
-                netdev_update_features(master->dev);
-                dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                if (master != NULL) {
+                        netdev_update_features(master->dev);
+                        dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                }
                 netdev_rx_handler_unregister(port->dev);
                 dev_set_promiscuity(port->dev, -1);
         }
@@ -192,5 +194,7 @@ void hsr_del_port(struct hsr_port *port)
          */
 
         synchronize_rcu();
-        dev_put(port->dev);
+
+        if (port != master)
+                dev_put(port->dev);
 }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index e5b6d0ddcb58..145a50c4d566 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -659,27 +659,30 @@ EXPORT_SYMBOL(ip_defrag);
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
         struct iphdr iph;
+        int netoff;
         u32 len;
 
         if (skb->protocol != htons(ETH_P_IP))
                 return skb;
 
-        if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
+        netoff = skb_network_offset(skb);
+
+        if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
                 return skb;
 
         if (iph.ihl < 5 || iph.version != 4)
                 return skb;
 
         len = ntohs(iph.tot_len);
-        if (skb->len < len || len < (iph.ihl * 4))
+        if (skb->len < netoff + len || len < (iph.ihl * 4))
                 return skb;
 
         if (ip_is_fragment(&iph)) {
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (skb) {
-                        if (!pskb_may_pull(skb, iph.ihl*4))
+                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
                                 return skb;
-                        if (pskb_trim_rcsum(skb, len))
+                        if (pskb_trim_rcsum(skb, netoff + len))
                                 return skb;
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                         if (ip_defrag(skb, user))
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d68199d9b2b0..a7aea2048a0d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -888,7 +888,8 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          maxfraglen, flags);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 31d8c71986b4..5cd99271d3a6 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -432,17 +432,32 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
                 kfree_skb(skb);
 }
 
-static bool ipv4_pktinfo_prepare_errqueue(const struct sock *sk,
-                                          const struct sk_buff *skb,
-                                          int ee_origin)
+/* IPv4 supports cmsg on all imcp errors and some timestamps
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ipv4_datagram_support_cmsg(const struct sock *sk,
+                                       struct sk_buff *skb,
+                                       int ee_origin)
 {
-        struct in_pktinfo *info = PKTINFO_SKB_CB(skb);
+        struct in_pktinfo *info;
+
+        if (ee_origin == SO_EE_ORIGIN_ICMP)
+                return true;
 
-        if ((ee_origin != SO_EE_ORIGIN_TIMESTAMPING) ||
-            (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
+        if (ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        /* Support IP_PKTINFO on tstamp packets if requested, to correlate
+         * timestamp with egress dev. Not possible for packets without dev
+         * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
+         */
+        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
             (!skb->dev))
                 return false;
 
+        info = PKTINFO_SKB_CB(skb);
         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
         info->ipi_ifindex = skb->dev->ifindex;
         return true;
@@ -483,7 +498,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
                                                    serr->addr_offset);
@@ -496,9 +511,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
 
-        if (skb->len &&
-            (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
-             ipv4_pktinfo_prepare_errqueue(sk, skb, serr->ee.ee_origin))) {
+        if (ipv4_datagram_support_cmsg(sk, skb, serr->ee.ee_origin)) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 if (inet_sk(sk)->cmsg_flags)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index e9f66e1cda50..208d5439e59b 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
         kgid_t low, high;
         int ret = 0;
 
+        if (sk->sk_family == AF_INET6)
+                sk->sk_ipv6only = 1;
+
         inet_get_ping_group_range_net(net, &low, &high);
         if (gid_lte(low, group) && gid_lte(group, high))
                 return 0;
@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                 if (addr_len < sizeof(*addr))
                         return -EINVAL;
 
+                if (addr->sin_family != AF_INET &&
+                    !(addr->sin_family == AF_UNSPEC &&
+                      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
+                        return -EAFNOSUPPORT;
+
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
                          sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                         return -EINVAL;
 
                 if (addr->sin6_family != AF_INET6)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
 
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                          sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@@ -716,7 +724,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
                 daddr = usin->sin_addr.s_addr;
                 /* no remote port */
         } else {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9d72a0fcd928..995a2259bcfc 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -835,17 +835,13 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                                        int large_allowed)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 new_size_goal, size_goal, hlen;
+        u32 new_size_goal, size_goal;
 
         if (!large_allowed || !sk_can_gso(sk))
                 return mss_now;
 
-        /* Maybe we should/could use sk->sk_prot->max_header here ? */
-        hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
-               inet_csk(sk)->icsk_ext_hdr_len +
-               tp->tcp_header_len;
-
-        new_size_goal = sk->sk_gso_max_size - 1 - hlen;
+        /* Note : tcp_tso_autosize() will eventually split this later */
+        new_size_goal = sk->sk_gso_max_size - 1 - MAX_TCP_HEADER;
         new_size_goal = tcp_bound_to_half_wnd(tp, new_size_goal);
 
         /* We try hard to avoid divides here */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8fdd27b17306..fb4cf8b8e121 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4770,7 +4770,7 @@ static bool tcp_should_expand_sndbuf(const struct sock *sk)
                 return false;
 
         /* If we filled the congestion window, do not expand.  */
-        if (tp->packets_out >= tp->snd_cwnd)
+        if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
                 return false;
 
         return true;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 98e4a63d72bb..b6030025f411 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4903,6 +4903,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
         return ret;
 }
 
+static
+int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
+                        void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        struct inet6_dev *idev = ctl->extra1;
+        int min_mtu = IPV6_MIN_MTU;
+        struct ctl_table lctl;
+
+        lctl = *ctl;
+        lctl.extra1 = &min_mtu;
+        lctl.extra2 = idev ? &idev->dev->mtu : NULL;
+
+        return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
+}
+
 static void dev_disable_change(struct inet6_dev *idev)
 {
         struct netdev_notifier_info info;
@@ -5054,7 +5069,7 @@ static struct addrconf_sysctl_table
                         .data           = &ipv6_devconf.mtu6,
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .proc_handler   = addrconf_sysctl_mtu,
                 },
                 {
                         .procname       = "accept_ra",
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index c215be70cac0..ace8daca5c83 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -325,14 +325,34 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
         kfree_skb(skb);
 }
 
-static void ip6_datagram_prepare_pktinfo_errqueue(struct sk_buff *skb)
+/* IPv6 supports cmsg on all origins aside from SO_EE_ORIGIN_LOCAL.
+ *
+ * At one point, excluding local errors was a quick test to identify icmp/icmp6
+ * errors. This is no longer true, but the test remained, so the v6 stack,
+ * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
+                                      struct sock_exterr_skb *serr)
 {
-        int ifindex = skb->dev ? skb->dev->ifindex : -1;
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
+            serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6)
+                return true;
+
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        if (!skb->dev)
+                return false;
 
         if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = ifindex;
+                IP6CB(skb)->iif = skb->dev->ifindex;
         else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = ifindex;
+                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
+
+        return true;
 }
 
 /*
@@ -369,7 +389,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 const unsigned char *nh = skb_network_header(skb);
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
@@ -394,14 +414,11 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
-        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL && skb->len) {
+
+        if (ip6_datagram_support_cmsg(skb, serr)) {
                 sin->sin6_family = AF_INET6;
-                if (np->rxopt.all) {
-                        if (serr->ee.ee_origin != SO_EE_ORIGIN_ICMP &&
-                            serr->ee.ee_origin != SO_EE_ORIGIN_ICMP6)
-                                ip6_datagram_prepare_pktinfo_errqueue(skb);
+                if (np->rxopt.all)
                         ip6_datagram_recv_common_ctl(sk, msg, skb);
-                }
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7deebf102cba..0a04a37305d5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1298,7 +1298,8 @@ emsgsize:
         if (((length > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO) &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen,
                                           transhdrlen, mtu, flags, rt);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index bd46f736f61d..a2dfff6ff227 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -102,9 +102,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         if (msg->msg_name) {
                 DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
-                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
-                    u->sin6_family != AF_INET6) {
+                if (msg->msg_namelen < sizeof(*u))
                         return -EINVAL;
+                if (u->sin6_family != AF_INET6) {
+                        return -EAFNOSUPPORT;
                 }
                 if (sk->sk_bound_dev_if &&
                     sk->sk_bound_dev_if != u->sin6_scope_id) {
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 40695b9751c1..683346d2d633 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
         orig_jiffies = jiffies;
 
         /* Set poll time to 200 ms */
-        poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
+        poll_time = msecs_to_jiffies(200);
+        if (timeout)
+                poll_time = min_t(unsigned long, timeout, poll_time);
 
         spin_lock_irqsave(&self->spinlock, flags);
         while (self->tx_skb && self->tx_skb->len) {
@@ -811,7 +813,7 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         spin_unlock_irqrestore(&self->spinlock, flags);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
 }
 
 /*
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 3c83a1e5ab03..1215693fdd22 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -305,7 +305,7 @@ irnet_ctrl_read(irnet_socket *	ap,
 
   /* Put ourselves on the wait queue to be woken up */
   add_wait_queue(&irnet_events.rwait, &wait);
-  current->state = TASK_INTERRUPTIBLE;
+  set_current_state(TASK_INTERRUPTIBLE);
   for(;;)
     {
       /* If there is unread events */
@@ -321,7 +321,7 @@ irnet_ctrl_read(irnet_socket *	ap,
       /* Yield and wait to be woken up */
       schedule();
     }
-  current->state = TASK_RUNNING;
+  __set_current_state(TASK_RUNNING);
   remove_wait_queue(&irnet_events.rwait, &wait);
 
   /* Did we got it ? */
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index ff0d2db09df9..5bcd4e5589d3 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1508,6 +1508,8 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
         if (ieee80211_chanctx_refcount(local, ctx) == 0)
                 ieee80211_free_chanctx(local, ctx);
 
+        sdata->radar_required = false;
+
         /* Unreserving may ready an in-place reservation. */
         if (use_reserved_switch)
                 ieee80211_vif_use_reserved_switch(local);
@@ -1566,6 +1568,9 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
  out:
+        if (ret)
+                sdata->radar_required = false;
+
         mutex_unlock(&local->chanctx_mtx);
         return ret;
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 7c86a002df95..ef6e8a6c4253 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -373,7 +373,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                 rate++;
                 mi->sample_deferred++;
         } else {
-                if (!msr->sample_limit != 0)
+                if (!msr->sample_limit)
                         return;
 
                 mi->sample_packets++;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 88a18ffe2975..07bd8db00af8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -566,6 +566,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
                 if (tx->sdata->control_port_no_encrypt)
                         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
                 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+                info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
         }
 
         return TX_CONTINUE;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e55759056361..ed99448671c3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3402,7 +3402,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
                 if (udest.af == 0)
                         udest.af = svc->af;
 
-                if (udest.af != svc->af) {
+                if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
                         /* The synchronization protocol is incompatible
                          * with mixed family services
                          */
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index c47ffd7a0a70..d93ceeb3ef04 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                         IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
                         return;
                 }
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
+                        kfree(param->pe_data);
         }
 
         if (opt)
@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
                                 (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
                                 );
 #endif
+        ip_vs_pe_put(param.pe);
         return 0;
         /* Error exit */
 out:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 199fd0f27b0e..6ab777912237 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
 
 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
 {
-        rule->genmask = 0;
+        rule->genmask &= ~(1 << gencursor_next(net));
 }
 
 static int
@@ -1711,9 +1711,12 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
         }
         nla_nest_end(skb, list);
 
-        if (rule->ulen &&
-            nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
-                goto nla_put_failure;
+        if (rule->udata) {
+                struct nft_userdata *udata = nft_userdata(rule);
+                if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
+                            udata->data) < 0)
+                        goto nla_put_failure;
+        }
 
         nlmsg_end(skb, nlh);
         return 0;
@@ -1896,11 +1899,12 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
         struct nft_table *table;
         struct nft_chain *chain;
         struct nft_rule *rule, *old_rule = NULL;
+        struct nft_userdata *udata;
         struct nft_trans *trans = NULL;
         struct nft_expr *expr;
         struct nft_ctx ctx;
         struct nlattr *tmp;
-        unsigned int size, i, n, ulen = 0;
+        unsigned int size, i, n, ulen = 0, usize = 0;
         int err, rem;
         bool create;
         u64 handle, pos_handle;
@@ -1968,12 +1972,19 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                         n++;
                 }
         }
+        /* Check for overflow of dlen field */
+        err = -EFBIG;
+        if (size >= 1 << 12)
+                goto err1;
 
-        if (nla[NFTA_RULE_USERDATA])
+        if (nla[NFTA_RULE_USERDATA]) {
                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
+                if (ulen > 0)
+                        usize = sizeof(struct nft_userdata) + ulen;
+        }
 
         err = -ENOMEM;
-        rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
+        rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
         if (rule == NULL)
                 goto err1;
 
@@ -1981,10 +1992,13 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         rule->handle = handle;
         rule->dlen   = size;
-        rule->ulen   = ulen;
+        rule->udata  = ulen ? 1 : 0;
 
-        if (ulen)
-                nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
+        if (ulen) {
+                udata = nft_userdata(rule);
+                udata->len = ulen - 1;
+                nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
+        }
 
         expr = nft_expr_first(rule);
         for (i = 0; i < n; i++) {
@@ -2031,12 +2045,6 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
 err3:
         list_del_rcu(&rule->list);
-        if (trans) {
-                list_del_rcu(&nft_trans_rule(trans)->list);
-                nft_rule_clear(net, nft_trans_rule(trans));
-                nft_trans_destroy(trans);
-                chain->use++;
-        }
 err2:
         nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3612,12 +3620,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                                                  &te->elem,
                                                  NFT_MSG_DELSETELEM, 0);
                         te->set->ops->get(te->set, &te->elem);
-                        te->set->ops->remove(te->set, &te->elem);
                         nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-                        if (te->elem.flags & NFT_SET_MAP) {
-                                nft_data_uninit(&te->elem.data,
-                                                te->set->dtype);
-                        }
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 }
@@ -3658,7 +3665,7 @@ static int nf_tables_abort(struct sk_buff *skb)
 {
         struct net *net = sock_net(skb->sk);
         struct nft_trans *trans, *next;
-        struct nft_set *set;
+        struct nft_trans_elem *te;
 
         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                 switch (trans->msg_type) {
@@ -3719,9 +3726,13 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_NEWSETELEM:
                         nft_trans_elem_set(trans)->nelems--;
-                        set = nft_trans_elem_set(trans);
-                        set->ops->get(set, &nft_trans_elem(trans));
-                        set->ops->remove(set, &nft_trans_elem(trans));
+                        te = (struct nft_trans_elem *)trans->data;
+                        te->set->ops->get(te->set, &te->elem);
+                        nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_DELSETELEM:
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index c598f74063a1..213584cf04b3 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -123,7 +123,7 @@ static void
 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                            const struct nft_ctx *ctx,
                            struct xt_target *target, void *info,
-                           union nft_entry *entry, u8 proto, bool inv)
+                           union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -137,7 +137,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         }
@@ -171,7 +171,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
 
-static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 {
         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
         u32 flags;
@@ -203,7 +203,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_target *target = expr->ops->data;
         struct xt_tgchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
@@ -334,7 +334,7 @@ static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
 static void
 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                           struct xt_match *match, void *info,
-                          union nft_entry *entry, u8 proto, bool inv)
+                          union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -348,7 +348,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         }
@@ -385,7 +385,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_match *match = expr->ops->data;
         struct xt_mtchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
@@ -625,8 +625,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                 struct xt_match *match = nft_match->ops.data;
 
                 if (strcmp(match->name, mt_name) == 0 &&
-                    match->revision == rev && match->family == family)
+                    match->revision == rev && match->family == family) {
+                        if (!try_module_get(match->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_match->ops;
+                }
         }
 
         match = xt_request_find_match(family, mt_name, rev);
@@ -695,8 +699,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                 struct xt_target *target = nft_target->ops.data;
 
                 if (strcmp(target->name, tg_name) == 0 &&
-                    target->revision == rev && target->family == family)
+                    target->revision == rev && target->family == family) {
+                        if (!try_module_get(target->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_target->ops;
+                }
         }
 
         target = xt_request_find_target(family, tg_name, rev);
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 61e6c407476a..c82df0a48fcd 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -192,8 +192,6 @@ static int nft_hash_init(const struct nft_set *set,
                 .key_offset = offsetof(struct nft_hash_elem, key),
                 .key_len = set->klen,
                 .hashfn = jhash,
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(priv, &params);
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 30dbe34915ae..45e1b30e4fb2 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -378,12 +378,11 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         mutex_lock(&recent_mutex);
         t = recent_table_lookup(recent_net, info->name);
         if (t != NULL) {
-                if (info->hit_count > t->nstamps_max_mask) {
-                        pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n",
-                                info->hit_count, t->nstamps_max_mask + 1,
-                                info->name);
-                        ret = -EINVAL;
-                        goto out;
+                if (nstamp_mask > t->nstamps_max_mask) {
+                        spin_lock_bh(&recent_lock);
+                        recent_table_flush(t);
+                        t->nstamps_max_mask = nstamp_mask;
+                        spin_unlock_bh(&recent_lock);
                 }
 
                 t->refcnt++;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 1ba67931eb1b..13332dbf291d 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -243,12 +243,13 @@ static int
 extract_icmp6_fields(const struct sk_buff *skb,
                      unsigned int outside_hdrlen,
                      int *protocol,
-                     struct in6_addr **raddr,
-                     struct in6_addr **laddr,
+                     const struct in6_addr **raddr,
+                     const struct in6_addr **laddr,
                      __be16 *rport,
-                     __be16 *lport)
+                     __be16 *lport,
+                     struct ipv6hdr *ipv6_var)
 {
-        struct ipv6hdr *inside_iph, _inside_iph;
+        const struct ipv6hdr *inside_iph;
         struct icmp6hdr *icmph, _icmph;
         __be16 *ports, _ports[2];
         u8 inside_nexthdr;
@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
         if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
                 return 1;
 
-        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
+        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
+                                        sizeof(*ipv6_var), ipv6_var);
         if (inside_iph == NULL)
                 return 1;
         inside_nexthdr = inside_iph->nexthdr;
 
-        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
+        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
+                                              sizeof(*ipv6_var),
                                          &inside_nexthdr, &inside_fragoff);
         if (inside_hdrlen < 0)
                 return 1; /* hjm: Packet has no/incomplete transport layer headers. */
@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
 static bool
 socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
         struct sock *sk = skb->sk;
-        struct in6_addr *daddr = NULL, *saddr = NULL;
+        const struct in6_addr *daddr = NULL, *saddr = NULL;
         __be16 uninitialized_var(dport), uninitialized_var(sport);
         int thoff = 0, uninitialized_var(tproto);
         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
         } else if (tproto == IPPROTO_ICMPV6) {
                 if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-                                         &sport, &dport))
+                                         &sport, &dport, &ipv6_var))
                         return false;
         } else {
                 return false;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2702673f0f23..05919bf3f670 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -3126,8 +3126,6 @@ static int __init netlink_proto_init(void)
                 .key_len = sizeof(u32), /* portid */
                 .hashfn = jhash,
                 .max_shift = 16, /* 64K */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         if (err != 0)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ae5e77cdc0ca..5bae7243c577 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2194,14 +2194,55 @@ static int __net_init ovs_init_net(struct net *net)
         return 0;
 }
 
-static void __net_exit ovs_exit_net(struct net *net)
+static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
+                                            struct list_head *head)
 {
-        struct datapath *dp, *dp_next;
         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+        struct datapath *dp;
+
+        list_for_each_entry(dp, &ovs_net->dps, list_node) {
+                int i;
+
+                for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
+                        struct vport *vport;
+
+                        hlist_for_each_entry(vport, &dp->ports[i], dp_hash_node) {
+                                struct netdev_vport *netdev_vport;
+
+                                if (vport->ops->type != OVS_VPORT_TYPE_INTERNAL)
+                                        continue;
+
+                                netdev_vport = netdev_vport_priv(vport);
+                                if (dev_net(netdev_vport->dev) == dnet)
+                                        list_add(&vport->detach_list, head);
+                        }
+                }
+        }
+}
+
+static void __net_exit ovs_exit_net(struct net *dnet)
+{
+        struct datapath *dp, *dp_next;
+        struct ovs_net *ovs_net = net_generic(dnet, ovs_net_id);
+        struct vport *vport, *vport_next;
+        struct net *net;
+        LIST_HEAD(head);
 
         ovs_lock();
         list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
                 __dp_destroy(dp);
+
+        rtnl_lock();
+        for_each_net(net)
+                list_vports_from_net(net, dnet, &head);
+        rtnl_unlock();
+
+        /* Detach all vports from given namespace. */
+        list_for_each_entry_safe(vport, vport_next, &head, detach_list) {
+                list_del(&vport->detach_list);
+                ovs_dp_detach_port(vport);
+        }
+
         ovs_unlock();
 
         cancel_work_sync(&ovs_net->dp_notify_work);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 216f20b90aa5..22b18c145c92 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2253,14 +2253,20 @@ static int masked_set_action_to_set_action_attr(const struct nlattr *a,
                                                 struct sk_buff *skb)
 {
         const struct nlattr *ovs_key = nla_data(a);
+        struct nlattr *nla;
         size_t key_len = nla_len(ovs_key) / 2;
 
         /* Revert the conversion we did from a non-masked set action to
          * masked set action.
          */
-        if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a) - key_len, ovs_key))
+        nla = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
+        if (!nla)
                 return -EMSGSIZE;
 
+        if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
+                return -EMSGSIZE;
+
+        nla_nest_end(skb, nla);
         return 0;
 }
 
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index f8ae295fb001..bc85331a6c60 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -103,6 +103,7 @@ struct vport_portids {
  * @ops: Class structure.
  * @percpu_stats: Points to per-CPU statistics used and maintained by vport
  * @err_stats: Points to error statistics used and maintained by vport
+ * @detach_list: list used for detaching vport in net-exit call.
  */
 struct vport {
         struct rcu_head rcu;
@@ -117,6 +118,7 @@ struct vport {
         struct pcpu_sw_netstats __percpu *percpu_stats;
 
         struct vport_err_stats err_stats;
+        struct list_head detach_list;
 };
 
 /**
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9c28cec1a083..f8db7064d81c 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -698,6 +698,10 @@ static void prb_retire_rx_blk_timer_expired(unsigned long data)
 
         if (pkc->last_kactive_blk_num == pkc->kactive_blk_num) {
                 if (!frozen) {
+                        if (!BLOCK_NUM_PKTS(pbd)) {
+                                /* An empty block. Just refresh the timer. */
+                                goto refresh_timer;
+                        }
                         prb_retire_current_block(pkc, po, TP_STATUS_BLK_TMO);
                         if (!prb_dispatch_next_block(pkc, po))
                                 goto refresh_timer;
@@ -798,7 +802,11 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
                 h1->ts_last_pkt.ts_sec = last_pkt->tp_sec;
                 h1->ts_last_pkt.ts_nsec = last_pkt->tp_nsec;
         } else {
-                /* Ok, we tmo'd - so get the current time */
+                /* Ok, we tmo'd - so get the current time.
+                 *
+                 * It shouldn't really happen as we don't close empty
+                 * blocks. See prb_retire_rx_blk_timer_expired().
+                 */
                 struct timespec ts;
                 getnstimeofday(&ts);
                 h1->ts_last_pkt.ts_sec = ts.tv_sec;
@@ -1349,14 +1357,14 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
                 return 0;
         }
 
+        if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
+                skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
+                if (!skb)
+                        return 0;
+        }
         switch (f->type) {
         case PACKET_FANOUT_HASH:
         default:
-                if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
-                        skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
-                        if (!skb)
-                                return 0;
-                }
                 idx = fanout_demux_hash(f, skb, num);
                 break;
         case PACKET_FANOUT_LB:
@@ -3115,11 +3123,18 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
         return 0;
 }
 
-static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
+static void packet_dev_mclist_delete(struct net_device *dev,
+                                     struct packet_mclist **mlp)
 {
-        for ( ; i; i = i->next) {
-                if (i->ifindex == dev->ifindex)
-                        packet_dev_mc(dev, i, what);
+        struct packet_mclist *ml;
+
+        while ((ml = *mlp) != NULL) {
+                if (ml->ifindex == dev->ifindex) {
+                        packet_dev_mc(dev, ml, -1);
+                        *mlp = ml->next;
+                        kfree(ml);
+                } else
+                        mlp = &ml->next;
         }
 }
 
@@ -3196,12 +3211,11 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                                         packet_dev_mc(dev, ml, -1);
                                 kfree(ml);
                         }
-                        rtnl_unlock();
-                        return 0;
+                        break;
                 }
         }
         rtnl_unlock();
-        return -EADDRNOTAVAIL;
+        return 0;
 }
 
 static void packet_flush_mclist(struct sock *sk)
@@ -3551,7 +3565,7 @@ static int packet_notifier(struct notifier_block *this,
                 switch (msg) {
                 case NETDEV_UNREGISTER:
                         if (po->mclist)
-                                packet_dev_mclist(dev, po->mclist, -1);
+                                packet_dev_mclist_delete(dev, &po->mclist);
                         /* fallthrough */
 
                 case NETDEV_DOWN:
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index c6be17a959a6..e0547f521f20 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -218,7 +218,8 @@ static void rxrpc_resend(struct rxrpc_call *call)
         struct rxrpc_header *hdr;
         struct sk_buff *txb;
         unsigned long *p_txb, resend_at;
-        int loop, stop;
+        bool stop;
+        int loop;
         u8 resend;
 
         _enter("{%d,%d,%d,%d},",
@@ -226,7 +227,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
                atomic_read(&call->sequence),
                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 
-        stop = 0;
+        stop = false;
         resend = 0;
         resend_at = 0;
 
@@ -255,11 +256,11 @@ static void rxrpc_resend(struct rxrpc_call *call)
                         _proto("Tx DATA %%%u { #%d }",
                                ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
                         if (rxrpc_send_packet(call->conn->trans, txb) < 0) {
-                                stop = 0;
+                                stop = true;
                                 sp->resend_at = jiffies + 3;
                         } else {
                                 sp->resend_at =
-                                        jiffies + rxrpc_resend_timeout * HZ;
+                                        jiffies + rxrpc_resend_timeout;
                         }
                 }
 
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index 5394b6be46ec..0610efa83d72 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -42,7 +42,8 @@ void rxrpc_UDP_error_report(struct sock *sk)
                 _leave("UDP socket errqueue empty");
                 return;
         }
-        if (!skb->len) {
+        serr = SKB_EXT_ERR(skb);
+        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                 _leave("UDP empty message");
                 kfree_skb(skb);
                 return;
@@ -50,7 +51,6 @@ void rxrpc_UDP_error_report(struct sock *sk)
 
         rxrpc_new_skb(skb);
 
-        serr = SKB_EXT_ERR(skb);
         addr = *(__be32 *)(skb_network_header(skb) + serr->addr_offset);
         port = serr->port;
 
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 6742200b1307..fbb7ebfc58c6 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -228,6 +228,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
                                  * to replay the request.
                                  */
                                 module_put(em->ops->owner);
+                                em->ops = NULL;
                                 err = -EAGAIN;
                         }
 #endif
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index abbb7dcd1689..59eeed43eda2 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -217,6 +217,8 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
 
         for (i = 0; i < arg->npages && arg->pages[i]; i++)
                 __free_page(arg->pages[i]);
+
+        kfree(arg->pages);
 }
 
 static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 224a82f24d3c..1095be9c80ab 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -463,6 +463,8 @@ static int rsc_parse(struct cache_detail *cd,
                 /* number of additional gid's */
                 if (get_int(&mesg, &N))
                         goto out;
+                if (N < 0 || N > NGROUPS_MAX)
+                        goto out;
                 status = -ENOMEM;
                 rsci.cred.cr_group_info = groups_alloc(N);
                 if (rsci.cred.cr_group_info == NULL)
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 33fb105d4352..5199bb1a017e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -921,7 +921,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
         poll_wait(filp, &queue_wait, wait);
 
         /* alway allow write */
-        mask = POLL_OUT | POLLWRNORM;
+        mask = POLLOUT | POLLWRNORM;
 
         if (!rp)
                 return mask;
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 7e9acd9361c5..91ffde82fa0c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -738,8 +738,9 @@ rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         struct rpc_xprt *xprt = rep->rr_xprt;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
         __be32 *iptr;
-        int credits, rdmalen, status;
+        int rdmalen, status;
         unsigned long cwnd;
+        u32 credits;
 
         /* Check status. If bad, signal disconnect and return rep to pool */
         if (rep->rr_len == ~0U) {
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index d1b70397c60f..0a16fb6f0885 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -285,7 +285,7 @@ rpcr_to_rdmar(struct rpc_rqst *rqst)
  */
 struct rpcrdma_buffer {
         spinlock_t      rb_lock;        /* protects indexes */
-        int             rb_max_requests;/* client max requests */
+        u32             rb_max_requests;/* client max requests */
         struct list_head rb_mws;        /* optional memory windows/fmrs/frmrs */
         struct list_head rb_all;
         int             rb_send_index;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a4cf364316de..14f09b3cb87c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -464,10 +464,11 @@ void tipc_link_reset(struct tipc_link *l_ptr)
         /* Clean up all queues, except inputq: */
         __skb_queue_purge(&l_ptr->outqueue);
         __skb_queue_purge(&l_ptr->deferred_queue);
-        skb_queue_splice_init(&l_ptr->wakeupq, &l_ptr->inputq);
-        if (!skb_queue_empty(&l_ptr->inputq))
+        if (!owner->inputq)
+                owner->inputq = &l_ptr->inputq;
+        skb_queue_splice_init(&l_ptr->wakeupq, owner->inputq);
+        if (!skb_queue_empty(owner->inputq))
                 owner->action_flags |= TIPC_MSG_EVT;
-        owner->inputq = &l_ptr->inputq;
         l_ptr->next_out = NULL;
         l_ptr->unacked_window = 0;
         l_ptr->checkpoint = 1;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f73e975af80b..b4d4467d0bb0 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2364,8 +2364,6 @@ int tipc_sk_rht_init(struct net *net)
                 .hashfn = jhash,
                 .max_shift = 20, /* 1M */
                 .min_shift = 8,  /* 256 */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(&tn->sk_rht, &rht_params);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3af0ecf1cc16..2a0bbd22854b 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1199,6 +1199,7 @@ out_fail_wq:
         regulatory_exit();
 out_fail_reg:
         debugfs_remove(ieee80211_debugfs_dir);
+        nl80211_exit();
 out_fail_nl80211:
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
 out_fail_notifier:
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d78fd8b54515..be2501538011 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2654,10 +2654,6 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return -ENOMEM;
-
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -2666,6 +2662,10 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
         wdev = rdev_add_virtual_intf(rdev,
                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                                 type, err ? NULL : &flags, &params);
@@ -12528,9 +12528,7 @@ static int cfg80211_net_detect_results(struct sk_buff *msg,
                         }
 
                         for (j = 0; j < match->n_channels; j++) {
-                                if (nla_put_u32(msg,
-                                                NL80211_ATTR_WIPHY_FREQ,
-                                                match->channels[j])) {
+                                if (nla_put_u32(msg, j, match->channels[j])) {
                                         nla_nest_cancel(msg, nl_freqs);
                                         nla_nest_cancel(msg, nl_match);
                                         goto out;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b586d0dcb09e..48dfc7b4e981 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -228,7 +228,7 @@ static DECLARE_DELAYED_WORK(reg_timeout, reg_timeout_work);
 
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
-        .n_reg_rules = 6,
+        .n_reg_rules = 8,
         .alpha2 =  "00",
         .reg_rules = {
                 /* IEEE 802.11b/g, channels 1..11 */
diff --git a/scripts/gdb/linux/__init__.py b/scripts/gdb/linux/__init__.py
new file mode 100644
index 000000000000..4680fb176337
--- /dev/null
+++ b/scripts/gdb/linux/__init__.py
@@ -0,0 +1 @@
+# nothing to do for the initialization of this package
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index b03a638b420c..279e24f61305 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1552,6 +1552,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state)
                         if (! snd_pcm_playback_empty(substream)) {
                                 snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
                                 snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
+                        } else {
+                                runtime->status->state = SNDRV_PCM_STATE_SETUP;
                         }
                         break;
                 case SNDRV_PCM_STATE_RUNNING:
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
index f62780ed64ad..7821b07415a7 100644
--- a/sound/drivers/opl3/opl3_midi.c
+++ b/sound/drivers/opl3/opl3_midi.c
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
                 int pitchbend = chan->midi_pitchbend;
                 int segment;
 
+                if (pitchbend < -0x2000)
+                        pitchbend = -0x2000;
                 if (pitchbend > 0x1FFF)
                         pitchbend = 0x1FFF;
 
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index 0d580186ef1a..5cc356db5351 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -33,7 +33,7 @@
  */
 #define MAX_MIDI_RX_BLOCKS      8
 
-#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 µs */
+#define TRANSFER_DELAY_TICKS    0x2e00 /* 479.17 microseconds */
 
 /* isochronous header parameters */
 #define ISO_DATA_LENGTH_SHIFT   16
@@ -78,7 +78,7 @@ static void pcm_period_tasklet(unsigned long data);
 int amdtp_stream_init(struct amdtp_stream *s, struct fw_unit *unit,
                       enum amdtp_stream_direction dir, enum cip_flags flags)
 {
-        s->unit = fw_unit_get(unit);
+        s->unit = unit;
         s->direction = dir;
         s->flags = flags;
         s->context = ERR_PTR(-1);
@@ -102,7 +102,6 @@ void amdtp_stream_destroy(struct amdtp_stream *s)
 {
         WARN_ON(amdtp_stream_running(s));
         mutex_destroy(&s->mutex);
-        fw_unit_put(s->unit);
 }
 EXPORT_SYMBOL(amdtp_stream_destroy);
 
diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
index fc19c99654aa..611b7dae7ee5 100644
--- a/sound/firewire/bebob/bebob.c
+++ b/sound/firewire/bebob/bebob.c
@@ -116,11 +116,22 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void
 bebob_card_free(struct snd_card *card)
 {
         struct snd_bebob *bebob = card->private_data;
 
+        snd_bebob_stream_destroy_duplex(bebob);
+        fw_unit_put(bebob->unit);
+
+        kfree(bebob->maudio_special_quirk);
+
         if (bebob->card_index >= 0) {
                 mutex_lock(&devices_mutex);
                 clear_bit(bebob->card_index, devices_used);
@@ -205,7 +216,7 @@ bebob_probe(struct fw_unit *unit,
         card->private_free = bebob_card_free;
 
         bebob->card = card;
-        bebob->unit = unit;
+        bebob->unit = fw_unit_get(unit);
         bebob->spec = spec;
         mutex_init(&bebob->mutex);
         spin_lock_init(&bebob->lock);
@@ -306,10 +317,11 @@ static void bebob_remove(struct fw_unit *unit)
         if (bebob == NULL)
                 return;
 
-        kfree(bebob->maudio_special_quirk);
+        /* Awake bus-reset waiters. */
+        if (!completion_done(&bebob->bus_reset))
+                complete_all(&bebob->bus_reset);
 
-        snd_bebob_stream_destroy_duplex(bebob);
-        snd_card_disconnect(bebob->card);
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(bebob->card);
 }
 
diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
index 0ebcabfdc7ce..98e4fc8121a1 100644
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -410,8 +410,6 @@ break_both_connections(struct snd_bebob *bebob)
 static void
 destroy_both_connections(struct snd_bebob *bebob)
 {
-        break_both_connections(bebob);
-
         cmp_connection_destroy(&bebob->in_conn);
         cmp_connection_destroy(&bebob->out_conn);
 }
@@ -712,22 +710,16 @@ void snd_bebob_stream_update_duplex(struct snd_bebob *bebob)
         mutex_unlock(&bebob->mutex);
 }
 
+/*
+ * This function should be called before starting streams or after stopping
+ * streams.
+ */
 void snd_bebob_stream_destroy_duplex(struct snd_bebob *bebob)
 {
-        mutex_lock(&bebob->mutex);
-
-        amdtp_stream_pcm_abort(&bebob->rx_stream);
-        amdtp_stream_pcm_abort(&bebob->tx_stream);
-
-        amdtp_stream_stop(&bebob->rx_stream);
-        amdtp_stream_stop(&bebob->tx_stream);
-
         amdtp_stream_destroy(&bebob->rx_stream);
         amdtp_stream_destroy(&bebob->tx_stream);
 
         destroy_both_connections(bebob);
-
-        mutex_unlock(&bebob->mutex);
 }
 
 /*
diff --git a/sound/firewire/dice/dice-interface.h b/sound/firewire/dice/dice-interface.h
index 27b044f84c81..de7602bd69b5 100644
--- a/sound/firewire/dice/dice-interface.h
+++ b/sound/firewire/dice/dice-interface.h
@@ -299,23 +299,23 @@
 #define RX_ISOCHRONOUS                  0x008
 
 /*
- * Index of first quadlet to be interpreted; read/write.  If > 0, that many
- * quadlets at the beginning of each data block will be ignored, and all the
- * audio and MIDI quadlets will follow.
- */
-#define RX_SEQ_START                    0x00c
-
-/*
  * The number of audio channels; read-only.  There will be one quadlet per
  * channel.
  */
-#define RX_NUMBER_AUDIO                 0x010
+#define RX_NUMBER_AUDIO                 0x00c
 
 /*
  * The number of MIDI ports, 0-8; read-only.  If > 0, there will be one
  * additional quadlet in each data block, following the audio quadlets.
  */
-#define RX_NUMBER_MIDI                  0x014
+#define RX_NUMBER_MIDI                  0x010
+
+/*
+ * Index of first quadlet to be interpreted; read/write.  If > 0, that many
+ * quadlets at the beginning of each data block will be ignored, and all the
+ * audio and MIDI quadlets will follow.
+ */
+#define RX_SEQ_START                    0x014
 
 /*
  * Names of all audio channels; read-only.  Quadlets are byte-swapped.  Names
diff --git a/sound/firewire/dice/dice-proc.c b/sound/firewire/dice/dice-proc.c
index f5c1d1bced59..ecfe20fd4de5 100644
--- a/sound/firewire/dice/dice-proc.c
+++ b/sound/firewire/dice/dice-proc.c
@@ -99,9 +99,9 @@ static void dice_proc_read(struct snd_info_entry *entry,
                 } tx;
                 struct {
                         u32 iso;
-                        u32 seq_start;
                         u32 number_audio;
                         u32 number_midi;
+                        u32 seq_start;
                         char names[RX_NAMES_SIZE];
                         u32 ac3_caps;
                         u32 ac3_enable;
@@ -204,10 +204,10 @@ static void dice_proc_read(struct snd_info_entry *entry,
                         break;
                 snd_iprintf(buffer, "rx %u:\n", stream);
                 snd_iprintf(buffer, "  iso channel: %d\n", (int)buf.rx.iso);
-                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 snd_iprintf(buffer, "  audio channels: %u\n",
                             buf.rx.number_audio);
                 snd_iprintf(buffer, "  midi ports: %u\n", buf.rx.number_midi);
+                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 if (quadlets >= 68) {
                         dice_proc_fixup_string(buf.rx.names, RX_NAMES_SIZE);
                         snd_iprintf(buffer, "  names: %s\n", buf.rx.names);
diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
index fa9cf761b610..07dbd01d7a6b 100644
--- a/sound/firewire/dice/dice-stream.c
+++ b/sound/firewire/dice/dice-stream.c
@@ -311,14 +311,21 @@ end:
         return err;
 }
 
+/*
+ * This function should be called before starting streams or after stopping
+ * streams.
+ */
 static void destroy_stream(struct snd_dice *dice, struct amdtp_stream *stream)
 {
-        amdtp_stream_destroy(stream);
+        struct fw_iso_resources *resources;
 
         if (stream == &dice->tx_stream)
-                fw_iso_resources_destroy(&dice->tx_resources);
+                resources = &dice->tx_resources;
         else
-                fw_iso_resources_destroy(&dice->rx_resources);
+                resources = &dice->rx_resources;
+
+        amdtp_stream_destroy(stream);
+        fw_iso_resources_destroy(resources);
 }
 
 int snd_dice_stream_init_duplex(struct snd_dice *dice)
@@ -332,6 +339,8 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice)
                 goto end;
 
         err = init_stream(dice, &dice->rx_stream);
+        if (err < 0)
+                destroy_stream(dice, &dice->tx_stream);
 end:
         return err;
 }
@@ -340,10 +349,7 @@ void snd_dice_stream_destroy_duplex(struct snd_dice *dice)
 {
         snd_dice_transaction_clear_enable(dice);
 
-        stop_stream(dice, &dice->tx_stream);
         destroy_stream(dice, &dice->tx_stream);
-
-        stop_stream(dice, &dice->rx_stream);
         destroy_stream(dice, &dice->rx_stream);
 
         dice->substreams_counter = 0;
diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
index 90d8f40ff727..70a111d7f428 100644
--- a/sound/firewire/dice/dice.c
+++ b/sound/firewire/dice/dice.c
@@ -226,11 +226,20 @@ static void dice_card_strings(struct snd_dice *dice)
         strcpy(card->mixername, "DICE");
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void dice_card_free(struct snd_card *card)
 {
         struct snd_dice *dice = card->private_data;
 
+        snd_dice_stream_destroy_duplex(dice);
         snd_dice_transaction_destroy(dice);
+        fw_unit_put(dice->unit);
+
         mutex_destroy(&dice->mutex);
 }
 
@@ -251,7 +260,7 @@ static int dice_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
 
         dice = card->private_data;
         dice->card = card;
-        dice->unit = unit;
+        dice->unit = fw_unit_get(unit);
         card->private_free = dice_card_free;
 
         spin_lock_init(&dice->lock);
@@ -305,10 +314,7 @@ static void dice_remove(struct fw_unit *unit)
 {
         struct snd_dice *dice = dev_get_drvdata(&unit->device);
 
-        snd_card_disconnect(dice->card);
-
-        snd_dice_stream_destroy_duplex(dice);
-
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(dice->card);
 }
 
diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
index 3e2ed8e82cbc..2682e7e3e5c9 100644
--- a/sound/firewire/fireworks/fireworks.c
+++ b/sound/firewire/fireworks/fireworks.c
@@ -173,11 +173,23 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void
 efw_card_free(struct snd_card *card)
 {
         struct snd_efw *efw = card->private_data;
 
+        snd_efw_stream_destroy_duplex(efw);
+        snd_efw_transaction_remove_instance(efw);
+        fw_unit_put(efw->unit);
+
+        kfree(efw->resp_buf);
+
         if (efw->card_index >= 0) {
                 mutex_lock(&devices_mutex);
                 clear_bit(efw->card_index, devices_used);
@@ -185,7 +197,6 @@ efw_card_free(struct snd_card *card)
         }
 
         mutex_destroy(&efw->mutex);
-        kfree(efw->resp_buf);
 }
 
 static int
@@ -218,7 +229,7 @@ efw_probe(struct fw_unit *unit,
         card->private_free = efw_card_free;
 
         efw->card = card;
-        efw->unit = unit;
+        efw->unit = fw_unit_get(unit);
         mutex_init(&efw->mutex);
         spin_lock_init(&efw->lock);
         init_waitqueue_head(&efw->hwdep_wait);
@@ -289,10 +300,7 @@ static void efw_remove(struct fw_unit *unit)
 {
         struct snd_efw *efw = dev_get_drvdata(&unit->device);
 
-        snd_efw_stream_destroy_duplex(efw);
-        snd_efw_transaction_remove_instance(efw);
-
-        snd_card_disconnect(efw->card);
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(efw->card);
 }
 
diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c
index 4f440e163667..c55db1bddc80 100644
--- a/sound/firewire/fireworks/fireworks_stream.c
+++ b/sound/firewire/fireworks/fireworks_stream.c
@@ -100,17 +100,22 @@ end:
         return err;
 }
 
+/*
+ * This function should be called before starting the stream or after stopping
+ * the streams.
+ */
 static void
 destroy_stream(struct snd_efw *efw, struct amdtp_stream *stream)
 {
-        stop_stream(efw, stream);
-
-        amdtp_stream_destroy(stream);
+        struct cmp_connection *conn;
 
         if (stream == &efw->tx_stream)
-                cmp_connection_destroy(&efw->out_conn);
+                conn = &efw->out_conn;
         else
-                cmp_connection_destroy(&efw->in_conn);
+                conn = &efw->in_conn;
+
+        amdtp_stream_destroy(stream);
+        cmp_connection_destroy(&efw->out_conn);
 }
 
 static int
@@ -319,12 +324,8 @@ void snd_efw_stream_update_duplex(struct snd_efw *efw)
 
 void snd_efw_stream_destroy_duplex(struct snd_efw *efw)
 {
-        mutex_lock(&efw->mutex);
-
         destroy_stream(efw, &efw->rx_stream);
         destroy_stream(efw, &efw->tx_stream);
-
-        mutex_unlock(&efw->mutex);
 }
 
 void snd_efw_stream_lock_changed(struct snd_efw *efw)
diff --git a/sound/firewire/oxfw/oxfw-stream.c b/sound/firewire/oxfw/oxfw-stream.c
index bda845afb470..e6757cd85724 100644
--- a/sound/firewire/oxfw/oxfw-stream.c
+++ b/sound/firewire/oxfw/oxfw-stream.c
@@ -171,9 +171,10 @@ static int start_stream(struct snd_oxfw *oxfw, struct amdtp_stream *stream,
         }
 
         /* Wait first packet */
-        err = amdtp_stream_wait_callback(stream, CALLBACK_TIMEOUT);
-        if (err < 0)
+        if (!amdtp_stream_wait_callback(stream, CALLBACK_TIMEOUT)) {
                 stop_stream(oxfw, stream);
+                err = -ETIMEDOUT;
+        }
 end:
         return err;
 }
@@ -337,6 +338,10 @@ void snd_oxfw_stream_stop_simplex(struct snd_oxfw *oxfw,
         stop_stream(oxfw, stream);
 }
 
+/*
+ * This function should be called before starting the stream or after stopping
+ * the streams.
+ */
 void snd_oxfw_stream_destroy_simplex(struct snd_oxfw *oxfw,
                                      struct amdtp_stream *stream)
 {
@@ -347,8 +352,6 @@ void snd_oxfw_stream_destroy_simplex(struct snd_oxfw *oxfw,
         else
                 conn = &oxfw->in_conn;
 
-        stop_stream(oxfw, stream);
-
         amdtp_stream_destroy(stream);
         cmp_connection_destroy(conn);
 }
diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
index 60e5cad0531a..8c6ce019f437 100644
--- a/sound/firewire/oxfw/oxfw.c
+++ b/sound/firewire/oxfw/oxfw.c
@@ -104,11 +104,23 @@ end:
         return err;
 }
 
+/*
+ * This module releases the FireWire unit data after all ALSA character devices
+ * are released by applications. This is for releasing stream data or finishing
+ * transactions safely. Thus at returning from .remove(), this module still keep
+ * references for the unit.
+ */
 static void oxfw_card_free(struct snd_card *card)
 {
         struct snd_oxfw *oxfw = card->private_data;
         unsigned int i;
 
+        snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
+        if (oxfw->has_output)
+                snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
+
+        fw_unit_put(oxfw->unit);
+
         for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; i++) {
                 kfree(oxfw->tx_stream_formats[i]);
                 kfree(oxfw->rx_stream_formats[i]);
@@ -136,7 +148,7 @@ static int oxfw_probe(struct fw_unit *unit,
         oxfw = card->private_data;
         oxfw->card = card;
         mutex_init(&oxfw->mutex);
-        oxfw->unit = unit;
+        oxfw->unit = fw_unit_get(unit);
         oxfw->device_info = (const struct device_info *)id->driver_data;
         spin_lock_init(&oxfw->lock);
         init_waitqueue_head(&oxfw->hwdep_wait);
@@ -212,12 +224,7 @@ static void oxfw_remove(struct fw_unit *unit)
 {
         struct snd_oxfw *oxfw = dev_get_drvdata(&unit->device);
 
-        snd_card_disconnect(oxfw->card);
-
-        snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
-        if (oxfw->has_output)
-                snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
-
+        /* No need to wait for releasing card object in this context. */
         snd_card_free_when_closed(oxfw->card);
 }
 
diff --git a/sound/isa/msnd/msnd_pinnacle_mixer.c b/sound/isa/msnd/msnd_pinnacle_mixer.c
index 17e49a071af4..b408540798c1 100644
--- a/sound/isa/msnd/msnd_pinnacle_mixer.c
+++ b/sound/isa/msnd/msnd_pinnacle_mixer.c
@@ -306,11 +306,12 @@ int snd_msndmix_new(struct snd_card *card)
         spin_lock_init(&chip->mixer_lock);
         strcpy(card->mixername, "MSND Pinnacle Mixer");
 
-        for (idx = 0; idx < ARRAY_SIZE(snd_msnd_controls); idx++)
+        for (idx = 0; idx < ARRAY_SIZE(snd_msnd_controls); idx++) {
                 err = snd_ctl_add(card,
                                   snd_ctl_new1(snd_msnd_controls + idx, chip));
                 if (err < 0)
                         return err;
+        }
 
         return 0;
 }
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index dfcb5e929f9f..a2ce773bdc62 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -961,7 +961,6 @@ static int azx_alloc_cmd_io(struct azx *chip)
                 dev_err(chip->card->dev, "cannot allocate CORB/RIRB\n");
         return err;
 }
-EXPORT_SYMBOL_GPL(azx_alloc_cmd_io);
 
 static void azx_init_cmd_io(struct azx *chip)
 {
@@ -1026,7 +1025,6 @@ static void azx_init_cmd_io(struct azx *chip)
         azx_writeb(chip, RIRBCTL, AZX_RBCTL_DMA_EN | AZX_RBCTL_IRQ_EN);
         spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_init_cmd_io);
 
 static void azx_free_cmd_io(struct azx *chip)
 {
@@ -1036,7 +1034,6 @@ static void azx_free_cmd_io(struct azx *chip)
         azx_writeb(chip, CORBCTL, 0);
         spin_unlock_irq(&chip->reg_lock);
 }
-EXPORT_SYMBOL_GPL(azx_free_cmd_io);
 
 static unsigned int azx_command_addr(u32 cmd)
 {
@@ -1316,7 +1313,6 @@ static int azx_send_cmd(struct hda_bus *bus, unsigned int val)
         else
                 return azx_corb_send_cmd(bus, val);
 }
-EXPORT_SYMBOL_GPL(azx_send_cmd);
 
 /* get a response */
 static unsigned int azx_get_response(struct hda_bus *bus,
@@ -1330,7 +1326,6 @@ static unsigned int azx_get_response(struct hda_bus *bus,
         else
                 return azx_rirb_get_response(bus, addr);
 }
-EXPORT_SYMBOL_GPL(azx_get_response);
 
 #ifdef CONFIG_SND_HDA_DSP_LOADER
 /*
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 36d2f20db7a4..4ca3d5d02436 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1966,7 +1966,7 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Panther Point */
         { PCI_DEVICE(0x8086, 0x1e20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Lynx Point */
         { PCI_DEVICE(0x8086, 0x8c20),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b2b24a8b3dac..526398a4a442 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5209,6 +5209,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x17, 0x40000000},
                 {0x1d, 0x40700001},
                 {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC255_STANDARD_PINS,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170140},
+                {0x17, 0x40000000},
+                {0x1d, 0x40700001},
+                {0x21, 0x02211050}),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
                 {0x12, 0x90a60130},
                 {0x13, 0x40000000},
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6d36c5b78805..87eff3173ce9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -79,6 +79,7 @@ enum {
         STAC_ALIENWARE_M17X,
         STAC_92HD89XX_HP_FRONT_JACK,
         STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
+        STAC_92HD73XX_ASUS_MOBO,
         STAC_92HD73XX_MODELS
 };
 
@@ -1911,7 +1912,18 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
         [STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = stac92hd89xx_hp_z1_g2_right_mic_jack_pin_configs,
-        }
+        },
+        [STAC_92HD73XX_ASUS_MOBO] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* enable 5.1 and SPDIF out */
+                        { 0x0c, 0x01014411 },
+                        { 0x0d, 0x01014410 },
+                        { 0x0e, 0x01014412 },
+                        { 0x22, 0x014b1180 },
+                        { }
+                }
+        },
 };
 
 static const struct hda_model_fixup stac92hd73xx_models[] = {
@@ -1923,6 +1935,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
         { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
         { .id = STAC_DELL_EQ, .name = "dell-eq" },
         { .id = STAC_ALIENWARE_M17X, .name = "alienware" },
+        { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
         {}
 };
 
@@ -1975,6 +1988,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
                                 "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
                                 "unknown HP", STAC_92HD89XX_HP_FRONT_JACK),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_ASUSTEK, 0x83f8, "ASUS AT4NM10",
+                      STAC_92HD73XX_ASUS_MOBO),
         {} /* terminator */
 };
 
diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
index f5ad214663f9..8de836165cf2 100644
--- a/sound/soc/atmel/sam9g20_wm8731.c
+++ b/sound/soc/atmel/sam9g20_wm8731.c
@@ -46,8 +46,6 @@
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 
-#include <asm/mach-types.h>
-
 #include "../codecs/wm8731.h"
 #include "atmel-pcm.h"
 #include "atmel_ssc_dai.h"
@@ -171,9 +169,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
         int ret;
 
         if (!np) {
-                if (!(machine_is_at91sam9g20ek() ||
-                        machine_is_at91sam9g20ek_2mmc()))
-                        return -ENODEV;
+                return -ENODEV;
         }
 
         ret = atmel_ssc_set_audio(0);
@@ -210,39 +206,37 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
         card->dev = &pdev->dev;
 
         /* Parse device node info */
-        if (np) {
-                ret = snd_soc_of_parse_card_name(card, "atmel,model");
-                if (ret)
-                        goto err;
-
-                ret = snd_soc_of_parse_audio_routing(card,
-                        "atmel,audio-routing");
-                if (ret)
-                        goto err;
-
-                /* Parse codec info */
-                at91sam9g20ek_dai.codec_name = NULL;
-                codec_np = of_parse_phandle(np, "atmel,audio-codec", 0);
-                if (!codec_np) {
-                        dev_err(&pdev->dev, "codec info missing\n");
-                        return -EINVAL;
-                }
-                at91sam9g20ek_dai.codec_of_node = codec_np;
-
-                /* Parse dai and platform info */
-                at91sam9g20ek_dai.cpu_dai_name = NULL;
-                at91sam9g20ek_dai.platform_name = NULL;
-                cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
-                if (!cpu_np) {
-                        dev_err(&pdev->dev, "dai and pcm info missing\n");
-                        return -EINVAL;
-                }
-                at91sam9g20ek_dai.cpu_of_node = cpu_np;
-                at91sam9g20ek_dai.platform_of_node = cpu_np;
-
-                of_node_put(codec_np);
-                of_node_put(cpu_np);
+        ret = snd_soc_of_parse_card_name(card, "atmel,model");
+        if (ret)
+                goto err;
+
+        ret = snd_soc_of_parse_audio_routing(card,
+                "atmel,audio-routing");
+        if (ret)
+                goto err;
+
+        /* Parse codec info */
+        at91sam9g20ek_dai.codec_name = NULL;
+        codec_np = of_parse_phandle(np, "atmel,audio-codec", 0);
+        if (!codec_np) {
+                dev_err(&pdev->dev, "codec info missing\n");
+                return -EINVAL;
+        }
+        at91sam9g20ek_dai.codec_of_node = codec_np;
+
+        /* Parse dai and platform info */
+        at91sam9g20ek_dai.cpu_dai_name = NULL;
+        at91sam9g20ek_dai.platform_name = NULL;
+        cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
+        if (!cpu_np) {
+                dev_err(&pdev->dev, "dai and pcm info missing\n");
+                return -EINVAL;
         }
+        at91sam9g20ek_dai.cpu_of_node = cpu_np;
+        at91sam9g20ek_dai.platform_of_node = cpu_np;
+
+        of_node_put(codec_np);
+        of_node_put(cpu_np);
 
         ret = snd_soc_register_card(card);
         if (ret) {
diff --git a/sound/soc/cirrus/Kconfig b/sound/soc/cirrus/Kconfig
index 7b7fbcd49e5e..c7cd60f009e9 100644
--- a/sound/soc/cirrus/Kconfig
+++ b/sound/soc/cirrus/Kconfig
@@ -16,7 +16,7 @@ config SND_EP93XX_SOC_AC97
 
 config SND_EP93XX_SOC_SNAPPERCL15
         tristate "SoC Audio support for Bluewater Systems Snapper CL15 module"
-        depends on SND_EP93XX_SOC && MACH_SNAPPER_CL15
+        depends on SND_EP93XX_SOC && MACH_SNAPPER_CL15 && I2C
         select SND_EP93XX_SOC_I2S
         select SND_SOC_TLV320AIC23_I2C
         help
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 064e6c18e109..ea9f0e31f9d4 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -69,7 +69,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_MAX98088 if I2C
         select SND_SOC_MAX98090 if I2C
         select SND_SOC_MAX98095 if I2C
-        select SND_SOC_MAX98357A
+        select SND_SOC_MAX98357A if GPIOLIB
         select SND_SOC_MAX9850 if I2C
         select SND_SOC_MAX9768 if I2C
         select SND_SOC_MAX9877 if I2C
diff --git a/sound/soc/codecs/max98357a.c b/sound/soc/codecs/max98357a.c
index 1806333ea29e..e9e6efbc21dd 100644
--- a/sound/soc/codecs/max98357a.c
+++ b/sound/soc/codecs/max98357a.c
@@ -12,9 +12,19 @@
  * max98357a.c -- MAX98357A ALSA SoC Codec driver
  */
 
-#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <sound/pcm.h>
 #include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/soc-dapm.h>
 
 #define DRV_NAME "max98357a"
 
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index e1a4a45c57e2..fd102613d20d 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -225,7 +225,6 @@ static bool rt5670_volatile_register(struct device *dev, unsigned int reg)
         case RT5670_ADC_EQ_CTRL1:
         case RT5670_EQ_CTRL1:
         case RT5670_ALC_CTRL_1:
-        case RT5670_IRQ_CTRL1:
         case RT5670_IRQ_CTRL2:
         case RT5670_INT_IRQ_ST:
         case RT5670_IL_CMD:
@@ -2703,6 +2702,12 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
 
         regmap_write(rt5670->regmap, RT5670_RESET, 0);
 
+        regmap_read(rt5670->regmap, RT5670_VENDOR_ID, &val);
+        if (val >= 4)
+                regmap_write(rt5670->regmap, RT5670_GPIO_CTRL3, 0x0980);
+        else
+                regmap_write(rt5670->regmap, RT5670_GPIO_CTRL3, 0x0d00);
+
         ret = regmap_register_patch(rt5670->regmap, init_list,
                                     ARRAY_SIZE(init_list));
         if (ret != 0)
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 5d0bb8748dd1..fb9c20eace3f 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -3284,8 +3284,8 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "IB45 Bypass Mux", "Bypass", "IB45 Mux" },
         { "IB45 Bypass Mux", "Pass SRC", "IB45 Mux" },
 
-        { "IB6 Mux", "IF1 DAC 6", "IF1 DAC6" },
-        { "IB6 Mux", "IF2 DAC 6", "IF2 DAC6" },
+        { "IB6 Mux", "IF1 DAC 6", "IF1 DAC6 Mux" },
+        { "IB6 Mux", "IF2 DAC 6", "IF2 DAC6 Mux" },
         { "IB6 Mux", "SLB DAC 6", "SLB DAC6" },
         { "IB6 Mux", "STO4 ADC MIX L", "Stereo4 ADC MIXL" },
         { "IB6 Mux", "IF4 DAC L", "IF4 DAC L" },
@@ -3293,8 +3293,8 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "IB6 Mux", "STO2 ADC MIX L", "Stereo2 ADC MIXL" },
         { "IB6 Mux", "STO3 ADC MIX L", "Stereo3 ADC MIXL" },
 
-        { "IB7 Mux", "IF1 DAC 7", "IF1 DAC7" },
-        { "IB7 Mux", "IF2 DAC 7", "IF2 DAC7" },
+        { "IB7 Mux", "IF1 DAC 7", "IF1 DAC7 Mux" },
+        { "IB7 Mux", "IF2 DAC 7", "IF2 DAC7 Mux" },
         { "IB7 Mux", "SLB DAC 7", "SLB DAC7" },
         { "IB7 Mux", "STO4 ADC MIX R", "Stereo4 ADC MIXR" },
         { "IB7 Mux", "IF4 DAC R", "IF4 DAC R" },
@@ -3635,15 +3635,15 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "DAC1 FS", NULL, "DAC1 MIXL" },
         { "DAC1 FS", NULL, "DAC1 MIXR" },
 
-        { "DAC2 L Mux", "IF1 DAC 2", "IF1 DAC2" },
-        { "DAC2 L Mux", "IF2 DAC 2", "IF2 DAC2" },
+        { "DAC2 L Mux", "IF1 DAC 2", "IF1 DAC2 Mux" },
+        { "DAC2 L Mux", "IF2 DAC 2", "IF2 DAC2 Mux" },
         { "DAC2 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC2 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC2 L Mux", "SLB DAC 2", "SLB DAC2" },
         { "DAC2 L Mux", "OB 2", "OutBound2" },
 
-        { "DAC2 R Mux", "IF1 DAC 3", "IF1 DAC3" },
-        { "DAC2 R Mux", "IF2 DAC 3", "IF2 DAC3" },
+        { "DAC2 R Mux", "IF1 DAC 3", "IF1 DAC3 Mux" },
+        { "DAC2 R Mux", "IF2 DAC 3", "IF2 DAC3 Mux" },
         { "DAC2 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC2 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC2 R Mux", "SLB DAC 3", "SLB DAC3" },
@@ -3651,29 +3651,29 @@ static const struct snd_soc_dapm_route rt5677_dapm_routes[] = {
         { "DAC2 R Mux", "Haptic Generator", "Haptic Generator" },
         { "DAC2 R Mux", "VAD ADC", "VAD ADC Mux" },
 
-        { "DAC3 L Mux", "IF1 DAC 4", "IF1 DAC4" },
-        { "DAC3 L Mux", "IF2 DAC 4", "IF2 DAC4" },
+        { "DAC3 L Mux", "IF1 DAC 4", "IF1 DAC4 Mux" },
+        { "DAC3 L Mux", "IF2 DAC 4", "IF2 DAC4 Mux" },
         { "DAC3 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC3 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC3 L Mux", "SLB DAC 4", "SLB DAC4" },
         { "DAC3 L Mux", "OB 4", "OutBound4" },
 
-        { "DAC3 R Mux", "IF1 DAC 5", "IF1 DAC4" },
-        { "DAC3 R Mux", "IF2 DAC 5", "IF2 DAC4" },
+        { "DAC3 R Mux", "IF1 DAC 5", "IF1 DAC5 Mux" },
+        { "DAC3 R Mux", "IF2 DAC 5", "IF2 DAC5 Mux" },
         { "DAC3 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC3 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC3 R Mux", "SLB DAC 5", "SLB DAC5" },
         { "DAC3 R Mux", "OB 5", "OutBound5" },
 
-        { "DAC4 L Mux", "IF1 DAC 6", "IF1 DAC6" },
-        { "DAC4 L Mux", "IF2 DAC 6", "IF2 DAC6" },
+        { "DAC4 L Mux", "IF1 DAC 6", "IF1 DAC6 Mux" },
+        { "DAC4 L Mux", "IF2 DAC 6", "IF2 DAC6 Mux" },
         { "DAC4 L Mux", "IF3 DAC L", "IF3 DAC L" },
         { "DAC4 L Mux", "IF4 DAC L", "IF4 DAC L" },
         { "DAC4 L Mux", "SLB DAC 6", "SLB DAC6" },
         { "DAC4 L Mux", "OB 6", "OutBound6" },
 
-        { "DAC4 R Mux", "IF1 DAC 7", "IF1 DAC7" },
-        { "DAC4 R Mux", "IF2 DAC 7", "IF2 DAC7" },
+        { "DAC4 R Mux", "IF1 DAC 7", "IF1 DAC7 Mux" },
+        { "DAC4 R Mux", "IF2 DAC 7", "IF2 DAC7 Mux" },
         { "DAC4 R Mux", "IF3 DAC R", "IF3 DAC R" },
         { "DAC4 R Mux", "IF4 DAC R", "IF4 DAC R" },
         { "DAC4 R Mux", "SLB DAC 7", "SLB DAC7" },
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index 3a1343fa109b..007a0e3bc273 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -106,13 +106,11 @@ static const struct reg_default sta32x_regs[] = {
 };
 
 static const struct regmap_range sta32x_write_regs_range[] = {
-        regmap_reg_range(STA32X_CONFA,  STA32X_AUTO2),
-        regmap_reg_range(STA32X_C1CFG,  STA32X_FDRC2),
+        regmap_reg_range(STA32X_CONFA,  STA32X_FDRC2),
 };
 
 static const struct regmap_range sta32x_read_regs_range[] = {
-        regmap_reg_range(STA32X_CONFA,  STA32X_AUTO2),
-        regmap_reg_range(STA32X_C1CFG,  STA32X_FDRC2),
+        regmap_reg_range(STA32X_CONFA,  STA32X_FDRC2),
 };
 
 static const struct regmap_range sta32x_volatile_regs_range[] = {
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 2595611e8a6d..b9fabbf69db6 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -603,10 +603,6 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
         factor = (div2 + 1) * (7 * psr + 1) * 2;
 
         for (i = 0; i < 255; i++) {
-                /* The bclk rate must be smaller than 1/5 sysclk rate */
-                if (factor * (i + 1) < 5)
-                        continue;
-
                 tmprate = freq * factor * (i + 2);
 
                 if (baudclk_is_used)
@@ -614,6 +610,13 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
                 else
                         clkrate = clk_round_rate(ssi_private->baudclk, tmprate);
 
+                /*
+                 * Hardware limitation: The bclk rate must be
+                 * never greater than 1/5 IPG clock rate
+                 */
+                if (clkrate * 5 > clk_get_rate(ssi_private->clk))
+                        continue;
+
                 clkrate /= factor;
                 afreq = clkrate / (i + 1);
 
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index f7c6734bd5da..fb550b5869d2 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -372,6 +372,11 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
                             strlen(dai_link->cpu_dai_name)   +
                             strlen(dai_link->codec_dai_name) + 2,
                             GFP_KERNEL);
+        if (!name) {
+                ret = -ENOMEM;
+                goto dai_link_of_err;
+        }
+
         sprintf(name, "%s-%s", dai_link->cpu_dai_name,
                                 dai_link->codec_dai_name);
         dai_link->name = dai_link->stream_name = name;
diff --git a/sound/soc/intel/sst-atom-controls.h b/sound/soc/intel/sst-atom-controls.h
index dfebfdd5eb2a..daecc58f28af 100644
--- a/sound/soc/intel/sst-atom-controls.h
+++ b/sound/soc/intel/sst-atom-controls.h
@@ -150,7 +150,7 @@ enum sst_cmd_type {
 
 enum sst_task {
         SST_TASK_SBA = 1,
-        SST_TASK_MMX,
+        SST_TASK_MMX = 3,
 };
 
 enum sst_type {
diff --git a/sound/soc/intel/sst/sst.c b/sound/soc/intel/sst/sst.c
index 8a8d56a146e7..11c578651c1c 100644
--- a/sound/soc/intel/sst/sst.c
+++ b/sound/soc/intel/sst/sst.c
@@ -350,7 +350,9 @@ static inline void sst_save_shim64(struct intel_sst_drv *ctx,
 
         spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
 
-        shim_regs->imrx = sst_shim_read64(shim, SST_IMRX),
+        shim_regs->imrx = sst_shim_read64(shim, SST_IMRX);
+        shim_regs->csr = sst_shim_read64(shim, SST_CSR);
+
 
         spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
 }
@@ -367,6 +369,7 @@ static inline void sst_restore_shim64(struct intel_sst_drv *ctx,
          */
         spin_lock_irqsave(&ctx->ipc_spin_lock, irq_flags);
         sst_shim_write64(shim, SST_IMRX, shim_regs->imrx),
+        sst_shim_write64(shim, SST_CSR, shim_regs->csr),
         spin_unlock_irqrestore(&ctx->ipc_spin_lock, irq_flags);
 }
 
@@ -379,6 +382,10 @@ void sst_configure_runtime_pm(struct intel_sst_drv *ctx)
          * initially active. So change the state to active before
          * enabling the pm
          */
+
+        if (!acpi_disabled)
+                pm_runtime_set_active(ctx->dev);
+
         pm_runtime_enable(ctx->dev);
 
         if (acpi_disabled)
@@ -409,6 +416,7 @@ static int intel_sst_runtime_suspend(struct device *dev)
         synchronize_irq(ctx->irq_num);
         flush_workqueue(ctx->post_msg_wq);
 
+        ctx->ops->reset(ctx);
         /* save the shim registers because PMC doesn't save state */
         sst_save_shim64(ctx, ctx->shim, ctx->shim_regs64);
 
diff --git a/sound/soc/omap/omap-hdmi-audio.c b/sound/soc/omap/omap-hdmi-audio.c
index ccfb41c22e53..f7eb42aa3f38 100644
--- a/sound/soc/omap/omap-hdmi-audio.c
+++ b/sound/soc/omap/omap-hdmi-audio.c
@@ -352,6 +352,9 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev)
                 return ret;
 
         card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL);
+        if (!card)
+                return -ENOMEM;
+
         card->name = devm_kasprintf(dev, GFP_KERNEL,
                                     "HDMI %s", dev_name(ad->dssdev));
         card->owner = THIS_MODULE;
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index c7eb9dd67f60..fd99d89de6a8 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -530,8 +530,19 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
 
         case OMAP_MCBSP_SYSCLK_CLKX_EXT:
                 regs->srgr2     |= CLKSM;
+                regs->pcr0      |= SCLKME;
+                /*
+                 * If McBSP is master but yet the CLKX/CLKR pin drives the SRG,
+                 * disable output on those pins. This enables to inject the
+                 * reference clock through CLKX/CLKR. For this to work
+                 * set_dai_sysclk() _needs_ to be called after set_dai_fmt().
+                 */
+                regs->pcr0      &= ~CLKXM;
+                break;
         case OMAP_MCBSP_SYSCLK_CLKR_EXT:
                 regs->pcr0      |= SCLKME;
+                /* Disable ouput on CLKR pin in master mode */
+                regs->pcr0      &= ~CLKRM;
                 break;
         default:
                 err = -ENODEV;
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index f4b05bc23e4b..1343ecbf0bd5 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -201,7 +201,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
         struct snd_pcm *pcm = rtd->pcm;
         int ret;
 
-        ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(64));
+        ret = dma_coerce_mask_and_coherent(card->dev, DMA_BIT_MASK(32));
         if (ret)
                 return ret;
 
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index 3cebf6ca03df..0632a36852c8 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -174,7 +174,7 @@ config SND_SOC_SMDK_WM8994_PCM
 
 config SND_SOC_SPEYSIDE
         tristate "Audio support for Wolfson Speyside"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && I2C && SPI_MASTER
         select SND_SAMSUNG_I2S
         select SND_SOC_WM8996
         select SND_SOC_WM9081
@@ -189,7 +189,7 @@ config SND_SOC_TOBERMORY
 
 config SND_SOC_BELLS
         tristate "Audio support for Wolfson Bells"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && MFD_ARIZONA
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && MFD_ARIZONA && I2C && SPI_MASTER
         select SND_SAMSUNG_I2S
         select SND_SOC_WM5102
         select SND_SOC_WM5110
@@ -206,7 +206,7 @@ config SND_SOC_LOWLAND
 
 config SND_SOC_LITTLEMILL
         tristate "Audio support for Wolfson Littlemill"
-        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410
+        depends on SND_SOC_SAMSUNG && MACH_WLF_CRAGG_6410 && I2C
         select SND_SAMSUNG_I2S
         select MFD_WM8994
         select SND_SOC_WM8994
@@ -223,7 +223,7 @@ config SND_SOC_SNOW
 
 config SND_SOC_ODROIDX2
         tristate "Audio support for Odroid-X2 and Odroid-U3"
-        depends on SND_SOC_SAMSUNG
+        depends on SND_SOC_SAMSUNG && I2C
         select SND_SOC_MAX98090
         select SND_SAMSUNG_I2S
         help
@@ -231,6 +231,6 @@ config SND_SOC_ODROIDX2
 
 config SND_SOC_ARNDALE_RT5631_ALC5631
         tristate "Audio support for RT5631(ALC5631) on Arndale Board"
-        depends on SND_SOC_SAMSUNG
+        depends on SND_SOC_SAMSUNG && I2C
         select SND_SAMSUNG_I2S
         select SND_SOC_RT5631
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1b53605f7154..110577c52317 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1252,6 +1252,8 @@ static int rsnd_probe(struct platform_device *pdev)
                         goto exit_snd_probe;
         }
 
+        dev_set_drvdata(dev, priv);
+
         /*
          *      asoc register
          */
@@ -1268,8 +1270,6 @@ static int rsnd_probe(struct platform_device *pdev)
                 goto exit_snd_soc;
         }
 
-        dev_set_drvdata(dev, priv);
-
         pm_runtime_enable(dev);
 
         dev_info(dev, "probed\n");
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 05dee690f487..97ed593f6010 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -39,7 +39,7 @@ static void change_volume(struct urb *urb_out, int volume[],
                 for (; p < buf_end; ++p) {
                         short pv = le16_to_cpu(*p);
                         int val = (pv * volume[chn & 1]) >> 8;
-                        pv = clamp(val, 0x7fff, -0x8000);
+                        pv = clamp(val, -0x8000, 0x7fff);
                         *p = cpu_to_le16(pv);
                         ++chn;
                 }
@@ -54,7 +54,7 @@ static void change_volume(struct urb *urb_out, int volume[],
 
                         val = p[0] + (p[1] << 8) + ((signed char)p[2] << 16);
                         val = (val * volume[chn & 1]) >> 8;
-                        val = clamp(val, 0x7fffff, -0x800000);
+                        val = clamp(val, -0x800000, 0x7fffff);
                         p[0] = val;
                         p[1] = val >> 8;
                         p[2] = val >> 16;
@@ -126,7 +126,7 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,
                         short pov = le16_to_cpu(*po);
                         short piv = le16_to_cpu(*pi);
                         int val = pov + ((piv * volume) >> 8);
-                        pov = clamp(val, 0x7fff, -0x8000);
+                        pov = clamp(val, -0x8000, 0x7fff);
                         *po = cpu_to_le16(pov);
                 }
         }
diff --git a/tools/perf/bench/mem-memcpy.c b/tools/perf/bench/mem-memcpy.c
index 6c14afe8c1b1..db1d3a29d97f 100644
--- a/tools/perf/bench/mem-memcpy.c
+++ b/tools/perf/bench/mem-memcpy.c
@@ -289,7 +289,7 @@ static u64 do_memcpy_cycle(const struct routine *r, size_t len, bool prefault)
         memcpy_t fn = r->fn.memcpy;
         int i;
 
-        memcpy_alloc_mem(&src, &dst, len);
+        memcpy_alloc_mem(&dst, &src, len);
 
         if (prefault)
                 fn(dst, src, len);
@@ -312,7 +312,7 @@ static double do_memcpy_gettimeofday(const struct routine *r, size_t len,
         void *src = NULL, *dst = NULL;
         int i;
 
-        memcpy_alloc_mem(&src, &dst, len);
+        memcpy_alloc_mem(&dst, &src, len);
 
         if (prefault)
                 fn(dst, src, len);
diff --git a/tools/perf/config/Makefile.arch b/tools/perf/config/Makefile.arch
index ff95a68741d1..ac8721ffa6c8 100644
--- a/tools/perf/config/Makefile.arch
+++ b/tools/perf/config/Makefile.arch
@@ -21,6 +21,10 @@ ifeq ($(RAW_ARCH),x86_64)
   endif
 endif
 
+ifeq ($(RAW_ARCH),sparc64)
+  ARCH ?= sparc
+endif
+
 ARCH ?= $(RAW_ARCH)
 
 LP64 := $(shell echo __LP64__ | ${CC} ${CFLAGS} -E -x c - | tail -n 1)
diff --git a/tools/perf/config/feature-checks/Makefile b/tools/perf/config/feature-checks/Makefile
index 42ac05aaf8ac..b32ff3372514 100644
--- a/tools/perf/config/feature-checks/Makefile
+++ b/tools/perf/config/feature-checks/Makefile
@@ -49,7 +49,7 @@ test-hello.bin:
         $(BUILD)
 
 test-pthread-attr-setaffinity-np.bin:
-        $(BUILD) -Werror -lpthread
+        $(BUILD) -D_GNU_SOURCE -Werror -lpthread
 
 test-stackprotector-all.bin:
         $(BUILD) -Werror -fstack-protector-all
diff --git a/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
index 0a0d3ecb4e8a..2b81b72eca23 100644
--- a/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
+++ b/tools/perf/config/feature-checks/test-pthread-attr-setaffinity-np.c
@@ -5,10 +5,11 @@ int main(void)
 {
         int ret = 0;
         pthread_attr_t thread_attr;
+        cpu_set_t cs;
 
         pthread_attr_init(&thread_attr);
         /* don't care abt exact args, just the API itself in libpthread */
-        ret = pthread_attr_setaffinity_np(&thread_attr, 0, NULL);
+        ret = pthread_attr_setaffinity_np(&thread_attr, sizeof(cs), &cs);
 
         return ret;
 }
diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
index 47b78b3f0325..6da965bdbc2c 100644
--- a/tools/perf/util/cloexec.c
+++ b/tools/perf/util/cloexec.c
@@ -25,6 +25,10 @@ static int perf_flag_probe(void)
         if (cpu < 0)
                 cpu = 0;
 
+        /*
+         * Using -1 for the pid is a workaround to avoid gratuitous jump label
+         * changes.
+         */
         while (1) {
                 /* check cloexec flag */
                 fd = sys_perf_event_open(&attr, pid, cpu, -1,
@@ -47,16 +51,24 @@ static int perf_flag_probe(void)
                   err, strerror_r(err, sbuf, sizeof(sbuf)));
 
         /* not supported, confirm error related to PERF_FLAG_FD_CLOEXEC */
-        fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+        while (1) {
+                fd = sys_perf_event_open(&attr, pid, cpu, -1, 0);
+                if (fd < 0 && pid == -1 && errno == EACCES) {
+                        pid = 0;
+                        continue;
+                }
+                break;
+        }
         err = errno;
 
+        if (fd >= 0)
+                close(fd);
+
         if (WARN_ONCE(fd < 0 && err != EBUSY,
                       "perf_event_open(..., 0) failed unexpectedly with error %d (%s)\n",
                       err, strerror_r(err, sbuf, sizeof(sbuf))))
                 return -1;
 
-        close(fd);
-
         return 0;
 }
 
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index c94a9e03ecf1..e99a67632831 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -28,7 +28,7 @@ struct perf_mmap {
         int              mask;
         int              refcnt;
         unsigned int     prev;
-        char             event_copy[PERF_SAMPLE_MAX_SIZE];
+        char             event_copy[PERF_SAMPLE_MAX_SIZE] __attribute__((aligned(8)));
 };
 
 struct perf_evlist {
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index b24f9d8727a8..33b7a2aef713 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -11,6 +11,11 @@
 #include <symbol/kallsyms.h>
 #include "debug.h"
 
+#ifndef EM_AARCH64
+#define EM_AARCH64      183  /* ARM 64 bit */
+#endif
+
+
 #ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
 extern char *cplus_demangle(const char *, int);
 
diff --git a/tools/thermal/tmon/.gitignore b/tools/thermal/tmon/.gitignore
new file mode 100644
index 000000000000..06e96be65276
--- /dev/null
+++ b/tools/thermal/tmon/.gitignore
@@ -0,0 +1 @@
+/tmon
diff --git a/tools/thermal/tmon/Makefile b/tools/thermal/tmon/Makefile
index e775adcbd29f..0788621c8d76 100644
--- a/tools/thermal/tmon/Makefile
+++ b/tools/thermal/tmon/Makefile
@@ -2,8 +2,8 @@ VERSION = 1.0
 
 BINDIR=usr/bin
 WARNFLAGS=-Wall -Wshadow -W -Wformat -Wimplicit-function-declaration -Wimplicit-int
-CFLAGS= -O1 ${WARNFLAGS} -fstack-protector
-CC=gcc
+CFLAGS+= -O1 ${WARNFLAGS} -fstack-protector
+CC=$(CROSS_COMPILE)gcc
 
 CFLAGS+=-D VERSION=\"$(VERSION)\"
 LDFLAGS+=
@@ -16,12 +16,21 @@ INSTALL_CONFIGFILE=install -m 644 -p
 CONFIG_FILE=
 CONFIG_PATH=
 
+# Static builds might require -ltinfo, for instance
+ifneq ($(findstring -static, $(LDFLAGS)),)
+STATIC := --static
+endif
+
+TMON_LIBS=-lm -lpthread
+TMON_LIBS += $(shell pkg-config --libs $(STATIC) panelw ncursesw 2> /dev/null || \
+                     pkg-config --libs $(STATIC) panel ncurses 2> /dev/null || \
+                     echo -lpanel -lncurses)
 
 OBJS = tmon.o tui.o sysfs.o pid.o
 OBJS +=
 
 tmon: $(OBJS) Makefile tmon.h
-        $(CC) ${CFLAGS} $(LDFLAGS) $(OBJS)  -o $(TARGET) -lm -lpanel -lncursesw -ltinfo -lpthread
+        $(CC) $(CFLAGS) $(LDFLAGS) $(OBJS)  -o $(TARGET) $(TMON_LIBS)
 
 valgrind: tmon
          sudo valgrind -v --track-origins=yes --tool=memcheck --leak-check=yes --show-reachable=yes --num-callers=20 --track-fds=yes ./$(TARGET)  1> /dev/null
diff --git a/tools/thermal/tmon/tmon.8 b/tools/thermal/tmon/tmon.8
index 0be727cb9892..02d5179803aa 100644
--- a/tools/thermal/tmon/tmon.8
+++ b/tools/thermal/tmon/tmon.8
@@ -55,6 +55,8 @@ The \fB-l --log\fP option write data to /var/tmp/tmon.log
 .PP
 The \fB-t --time-interval\fP option sets the polling interval in seconds
 .PP
+The \fB-T --target-temp\fP option sets the initial target temperature
+.PP
 The \fB-v --version\fP option shows the version of \fBtmon \fP
 .PP
 The \fB-z --zone\fP option sets the target therma zone instance to be controlled
diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c
index 09b7c3218334..9aa19652e8e8 100644
--- a/tools/thermal/tmon/tmon.c
+++ b/tools/thermal/tmon/tmon.c
@@ -64,6 +64,7 @@ void usage()
         printf("  -h, --help            show this help message\n");
         printf("  -l, --log             log data to /var/tmp/tmon.log\n");
         printf("  -t, --time-interval   sampling time interval, > 1 sec.\n");
+        printf("  -T, --target-temp     initial target temperature\n");
         printf("  -v, --version         show version\n");
         printf("  -z, --zone            target thermal zone id\n");
 
@@ -219,6 +220,7 @@ static struct option opts[] = {
         { "control", 1, NULL, 'c' },
         { "daemon", 0, NULL, 'd' },
         { "time-interval", 1, NULL, 't' },
+        { "target-temp", 1, NULL, 'T' },
         { "log", 0, NULL, 'l' },
         { "help", 0, NULL, 'h' },
         { "version", 0, NULL, 'v' },
@@ -231,7 +233,7 @@ int main(int argc, char **argv)
 {
         int err = 0;
         int id2 = 0, c;
-        double yk = 0.0; /* controller output */
+        double yk = 0.0, temp; /* controller output */
         int target_tz_index;
 
         if (geteuid() != 0) {
@@ -239,7 +241,7 @@ int main(int argc, char **argv)
                 exit(EXIT_FAILURE);
         }
 
-        while ((c = getopt_long(argc, argv, "c:dlht:vgz:", opts, &id2)) != -1) {
+        while ((c = getopt_long(argc, argv, "c:dlht:T:vgz:", opts, &id2)) != -1) {
                 switch (c) {
                 case 'c':
                         no_control = 0;
@@ -254,6 +256,14 @@ int main(int argc, char **argv)
                         if (ticktime < 1)
                                 ticktime = 1;
                         break;
+                case 'T':
+                        temp = strtod(optarg, NULL);
+                        if (temp < 0) {
+                                fprintf(stderr, "error: temperature must be positive\n");
+                                return 1;
+                        }
+                        target_temp_user = temp;
+                        break;
                 case 'l':
                         printf("Logging data to /var/tmp/tmon.log\n");
                         logging = 1;
diff --git a/tools/thermal/tmon/tui.c b/tools/thermal/tmon/tui.c
index 89f8ef0e15c8..b5d1c6b22dd3 100644
--- a/tools/thermal/tmon/tui.c
+++ b/tools/thermal/tmon/tui.c
@@ -30,6 +30,18 @@
 
 #include "tmon.h"
 
+#define min(x, y) ({                            \
+        typeof(x) _min1 = (x);                  \
+        typeof(y) _min2 = (y);                  \
+        (void) (&_min1 == &_min2);              \
+        _min1 < _min2 ? _min1 : _min2; })
+
+#define max(x, y) ({                            \
+        typeof(x) _max1 = (x);                  \
+        typeof(y) _max2 = (y);                  \
+        (void) (&_max1 == &_max2);              \
+        _max1 > _max2 ? _max1 : _max2; })
+
 static PANEL *data_panel;
 static PANEL *dialogue_panel;
 static PANEL *top;
@@ -98,6 +110,18 @@ void write_status_bar(int x, char *line)
         wrefresh(status_bar_window);
 }
 
+/* wrap at 5 */
+#define DIAG_DEV_ROWS  5
+/*
+ * list cooling devices + "set temp" entry; wraps after 5 rows, if they fit
+ */
+static int diag_dev_rows(void)
+{
+        int entries = ptdata.nr_cooling_dev + 1;
+        int rows = max(DIAG_DEV_ROWS, (entries + 1) / 2);
+        return min(rows, entries);
+}
+
 void setup_windows(void)
 {
         int y_begin = 1;
@@ -122,7 +146,7 @@ void setup_windows(void)
          * dialogue window is a pop-up, when needed it lays on top of cdev win
          */
 
-        dialogue_window = subwin(stdscr, ptdata.nr_cooling_dev+5, maxx-50,
+        dialogue_window = subwin(stdscr, diag_dev_rows() + 5, maxx-50,
                                 DIAG_Y, DIAG_X);
 
         thermal_data_window = subwin(stdscr, ptdata.nr_tz_sensor *
@@ -258,21 +282,26 @@ void show_cooling_device(void)
 }
 
 const char DIAG_TITLE[] = "[ TUNABLES ]";
-#define DIAG_DEV_ROWS  5
 void show_dialogue(void)
 {
         int j, x = 0, y = 0;
+        int rows, cols;
         WINDOW *w = dialogue_window;
 
         if (tui_disabled || !w)
                 return;
 
+        getmaxyx(w, rows, cols);
+
+        /* Silence compiler 'unused' warnings */
+        (void)cols;
+
         werase(w);
         box(w, 0, 0);
         mvwprintw(w, 0, maxx/4, DIAG_TITLE);
         /* list all the available tunables */
         for (j = 0; j <= ptdata.nr_cooling_dev; j++) {
-                y = j % DIAG_DEV_ROWS;
+                y = j % diag_dev_rows();
                 if (y == 0 && j != 0)
                         x += 20;
                 if (j == ptdata.nr_cooling_dev)
@@ -283,12 +312,10 @@ void show_dialogue(void)
                                 ptdata.cdi[j].type, ptdata.cdi[j].instance);
         }
         wattron(w, A_BOLD);
-        mvwprintw(w, DIAG_DEV_ROWS+1, 1, "Enter Choice [A-Z]?");
+        mvwprintw(w, diag_dev_rows()+1, 1, "Enter Choice [A-Z]?");
         wattroff(w, A_BOLD);
-        /* y size of dialogue win is nr cdev + 5, so print legend
-         * at the bottom line
-         */
-        mvwprintw(w, ptdata.nr_cooling_dev+3, 1,
+        /* print legend at the bottom line */
+        mvwprintw(w, rows - 2, 1,
                 "Legend: A=Active, P=Passive, C=Critical");
 
         wrefresh(dialogue_window);
@@ -437,7 +464,7 @@ static void handle_input_choice(int ch)
                         snprintf(buf, sizeof(buf), "New Value for %.10s-%2d: ",
                                 ptdata.cdi[cdev_id].type,
                                 ptdata.cdi[cdev_id].instance);
-                write_dialogue_win(buf, DIAG_DEV_ROWS+2, 2);
+                write_dialogue_win(buf, diag_dev_rows() + 2, 2);
                 handle_input_val(cdev_id);
         } else {
                 snprintf(buf, sizeof(buf), "Invalid selection %d", ch);
diff --git a/virt/kvm/arm/vgic-v2.c b/virt/kvm/arm/vgic-v2.c
index a0a7b5d1a070..f9b9c7c51372 100644
--- a/virt/kvm/arm/vgic-v2.c
+++ b/virt/kvm/arm/vgic-v2.c
@@ -72,6 +72,8 @@ static void vgic_v2_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
         if (!(lr_desc.state & LR_STATE_MASK))
                 vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr |= (1ULL << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr &= ~(1ULL << lr);
 }
 
 static u64 vgic_v2_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -84,6 +86,11 @@ static u64 vgic_v2_get_eisr(const struct kvm_vcpu *vcpu)
         return vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr;
 }
 
+static void vgic_v2_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr = 0;
+}
+
 static u32 vgic_v2_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
         u32 misr = vcpu->arch.vgic_cpu.vgic_v2.vgic_misr;
@@ -148,6 +155,7 @@ static const struct vgic_ops vgic_v2_ops = {
         .sync_lr_elrsr          = vgic_v2_sync_lr_elrsr,
         .get_elrsr              = vgic_v2_get_elrsr,
         .get_eisr               = vgic_v2_get_eisr,
+        .clear_eisr             = vgic_v2_clear_eisr,
         .get_interrupt_status   = vgic_v2_get_interrupt_status,
         .enable_underflow       = vgic_v2_enable_underflow,
         .disable_underflow      = vgic_v2_disable_underflow,
diff --git a/virt/kvm/arm/vgic-v3.c b/virt/kvm/arm/vgic-v3.c
index 3a62d8a9a2c6..dff06021e748 100644
--- a/virt/kvm/arm/vgic-v3.c
+++ b/virt/kvm/arm/vgic-v3.c
@@ -104,6 +104,8 @@ static void vgic_v3_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
         if (!(lr_desc.state & LR_STATE_MASK))
                 vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr |= (1U << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr &= ~(1U << lr);
 }
 
 static u64 vgic_v3_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -116,6 +118,11 @@ static u64 vgic_v3_get_eisr(const struct kvm_vcpu *vcpu)
         return vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr;
 }
 
+static void vgic_v3_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr = 0;
+}
+
 static u32 vgic_v3_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
         u32 misr = vcpu->arch.vgic_cpu.vgic_v3.vgic_misr;
@@ -192,6 +199,7 @@ static const struct vgic_ops vgic_v3_ops = {
         .sync_lr_elrsr          = vgic_v3_sync_lr_elrsr,
         .get_elrsr              = vgic_v3_get_elrsr,
         .get_eisr               = vgic_v3_get_eisr,
+        .clear_eisr             = vgic_v3_clear_eisr,
         .get_interrupt_status   = vgic_v3_get_interrupt_status,
         .enable_underflow       = vgic_v3_enable_underflow,
         .disable_underflow      = vgic_v3_disable_underflow,
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index b70174e74868..8d550ff14700 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1029,6 +1029,11 @@ static inline u64 vgic_get_eisr(struct kvm_vcpu *vcpu)
         return vgic_ops->get_eisr(vcpu);
 }
 
+static inline void vgic_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vgic_ops->clear_eisr(vcpu);
+}
+
 static inline u32 vgic_get_interrupt_status(struct kvm_vcpu *vcpu)
 {
         return vgic_ops->get_interrupt_status(vcpu);
@@ -1068,6 +1073,7 @@ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu)
         vgic_set_lr(vcpu, lr_nr, vlr);
         clear_bit(lr_nr, vgic_cpu->lr_used);
         vgic_cpu->vgic_irq_lr_map[irq] = LR_EMPTY;
+        vgic_sync_lr_elrsr(vcpu, lr_nr, vlr);
 }
 
 /*
@@ -1112,6 +1118,7 @@ static void vgic_queue_irq_to_lr(struct kvm_vcpu *vcpu, int irq,
                 vlr.state |= LR_EOI_INT;
 
         vgic_set_lr(vcpu, lr_nr, vlr);
+        vgic_sync_lr_elrsr(vcpu, lr_nr, vlr);
 }
 
 /*
@@ -1323,6 +1330,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
         if (status & INT_STATUS_UNDERFLOW)
                 vgic_disable_underflow(vcpu);
 
+        /*
+         * In the next iterations of the vcpu loop, if we sync the vgic state
+         * after flushing it, but before entering the guest (this happens for
+         * pending signals and vmid rollovers), then make sure we don't pick
+         * up any old maintenance interrupts here.
+         */
+        vgic_clear_eisr(vcpu);
+
         return level_pending;
 }
 
@@ -1789,8 +1804,10 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
          * emulation. So check this here again. KVM_CREATE_DEVICE does
          * the proper checks already.
          */
-        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2)
-                return -ENODEV;
+        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2) {
+                ret = -ENODEV;
+                goto out;
+        }
 
         /*
          * Any time a vcpu is run, vcpu_load is called which tries to grab the
diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index 7f256f31df10..1d56a901e791 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -105,7 +105,7 @@ int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level,
         i = kvm_irq_map_gsi(kvm, irq_set, irq);
         srcu_read_unlock(&kvm->irq_srcu, idx);
 
-        while(i--) {
+        while (i--) {
                 int r;
                 r = irq_set[i].set(&irq_set[i], kvm, irq_source_id, level,
                                    line_status);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index c5460b645e75..efe59ae64dc3 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -66,13 +66,13 @@
 MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
 
-unsigned int halt_poll_ns = 0;
+static unsigned int halt_poll_ns;
 module_param(halt_poll_ns, uint, S_IRUGO | S_IWUSR);
 
 /*
  * Ordering of locks:
  *
- *              kvm->lock --> kvm->slots_lock --> kvm->irq_lock
+ *      kvm->lock --> kvm->slots_lock --> kvm->irq_lock
  */
 
 DEFINE_SPINLOCK(kvm_lock);
@@ -80,7 +80,7 @@ static DEFINE_RAW_SPINLOCK(kvm_count_lock);
 LIST_HEAD(vm_list);
 
 static cpumask_var_t cpus_hardware_enabled;
-static int kvm_usage_count = 0;
+static int kvm_usage_count;
 static atomic_t hardware_enable_failed;
 
 struct kmem_cache *kvm_vcpu_cache;
@@ -539,20 +539,12 @@ void *kvm_kvzalloc(unsigned long size)
                 return kzalloc(size, GFP_KERNEL);
 }
 
-void kvm_kvfree(const void *addr)
-{
-        if (is_vmalloc_addr(addr))
-                vfree(addr);
-        else
-                kfree(addr);
-}
-
 static void kvm_destroy_dirty_bitmap(struct kvm_memory_slot *memslot)
 {
         if (!memslot->dirty_bitmap)
                 return;
 
-        kvm_kvfree(memslot->dirty_bitmap);
+        kvfree(memslot->dirty_bitmap);
         memslot->dirty_bitmap = NULL;
 }
 
@@ -888,8 +880,8 @@ int __kvm_set_memory_region(struct kvm *kvm,
                  * or moved, memslot will be created.
                  *
                  * validation of sp->gfn happens in:
-                 *      - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
-                 *      - kvm_is_visible_gfn (mmu_check_roots)
+                 *      - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
+                 *      - kvm_is_visible_gfn (mmu_check_roots)
                  */
                 kvm_arch_flush_shadow_memslot(kvm, slot);
 
@@ -1061,9 +1053,11 @@ int kvm_get_dirty_log_protect(struct kvm *kvm,
                 mask = xchg(&dirty_bitmap[i], 0);
                 dirty_bitmap_buffer[i] = mask;
 
-                offset = i * BITS_PER_LONG;
-                kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot, offset,
-                                                                mask);
+                if (mask) {
+                        offset = i * BITS_PER_LONG;
+                        kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
+                                                                offset, mask);
+                }
         }
 
         spin_unlock(&kvm->mmu_lock);
@@ -1481,7 +1475,6 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
 
         return kvm_pfn_to_page(pfn);
 }
-
 EXPORT_SYMBOL_GPL(gfn_to_page);
 
 void kvm_release_page_clean(struct page *page)
@@ -1517,6 +1510,7 @@ void kvm_set_pfn_dirty(pfn_t pfn)
 {
         if (!kvm_is_reserved_pfn(pfn)) {
                 struct page *page = pfn_to_page(pfn);
+
                 if (!PageReserved(page))
                         SetPageDirty(page);
         }
@@ -1742,7 +1736,7 @@ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
         int offset = offset_in_page(gpa);
         int ret;
 
-        while ((seg = next_segment(len, offset)) != 0) {
+        while ((seg = next_segment(len, offset)) != 0) {
                 ret = kvm_clear_guest_page(kvm, gfn, offset, seg);
                 if (ret < 0)
                         return ret;
@@ -1800,6 +1794,7 @@ void kvm_vcpu_block(struct kvm_vcpu *vcpu)
         start = cur = ktime_get();
         if (halt_poll_ns) {
                 ktime_t stop = ktime_add_ns(ktime_get(), halt_poll_ns);
+
                 do {
                         /*
                          * This sets KVM_REQ_UNHALT if an interrupt
@@ -2135,6 +2130,7 @@ static long kvm_vcpu_ioctl(struct file *filp,
                         /* The thread running this VCPU changed. */
                         struct pid *oldpid = vcpu->pid;
                         struct pid *newpid = get_task_pid(current, PIDTYPE_PID);
+
                         rcu_assign_pointer(vcpu->pid, newpid);
                         if (oldpid)
                                 synchronize_rcu();
@@ -2205,7 +2201,7 @@ out_free1:
                 if (r)
                         goto out;
                 r = -EFAULT;
-                if (copy_to_user(argp, &mp_state, sizeof mp_state))
+                if (copy_to_user(argp, &mp_state, sizeof(mp_state)))
                         goto out;
                 r = 0;
                 break;
@@ -2214,7 +2210,7 @@ out_free1:
                 struct kvm_mp_state mp_state;
 
                 r = -EFAULT;
-                if (copy_from_user(&mp_state, argp, sizeof mp_state))
+                if (copy_from_user(&mp_state, argp, sizeof(mp_state)))
                         goto out;
                 r = kvm_arch_vcpu_ioctl_set_mpstate(vcpu, &mp_state);
                 break;
@@ -2223,13 +2219,13 @@ out_free1:
                 struct kvm_translation tr;
 
                 r = -EFAULT;
-                if (copy_from_user(&tr, argp, sizeof tr))
+                if (copy_from_user(&tr, argp, sizeof(tr)))
                         goto out;
                 r = kvm_arch_vcpu_ioctl_translate(vcpu, &tr);
                 if (r)
                         goto out;
                 r = -EFAULT;
-                if (copy_to_user(argp, &tr, sizeof tr))
+                if (copy_to_user(argp, &tr, sizeof(tr)))
                         goto out;
                 r = 0;
                 break;
@@ -2238,7 +2234,7 @@ out_free1:
                 struct kvm_guest_debug dbg;
 
                 r = -EFAULT;
-                if (copy_from_user(&dbg, argp, sizeof dbg))
+                if (copy_from_user(&dbg, argp, sizeof(dbg)))
                         goto out;
                 r = kvm_arch_vcpu_ioctl_set_guest_debug(vcpu, &dbg);
                 break;
@@ -2252,14 +2248,14 @@ out_free1:
                 if (argp) {
                         r = -EFAULT;
                         if (copy_from_user(&kvm_sigmask, argp,
-                                           sizeof kvm_sigmask))
+                                           sizeof(kvm_sigmask)))
                                 goto out;
                         r = -EINVAL;
-                        if (kvm_sigmask.len != sizeof sigset)
+                        if (kvm_sigmask.len != sizeof(sigset))
                                 goto out;
                         r = -EFAULT;
                         if (copy_from_user(&sigset, sigmask_arg->sigset,
-                                           sizeof sigset))
+                                           sizeof(sigset)))
                                 goto out;
                         p = &sigset;
                 }
@@ -2321,14 +2317,14 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
                 if (argp) {
                         r = -EFAULT;
                         if (copy_from_user(&kvm_sigmask, argp,
-                                           sizeof kvm_sigmask))
+                                           sizeof(kvm_sigmask)))
                                 goto out;
                         r = -EINVAL;
-                        if (kvm_sigmask.len != sizeof csigset)
+                        if (kvm_sigmask.len != sizeof(csigset))
                                 goto out;
                         r = -EFAULT;
                         if (copy_from_user(&csigset, sigmask_arg->sigset,
-                                           sizeof csigset))
+                                           sizeof(csigset)))
                                 goto out;
                         sigset_from_compat(&sigset, &csigset);
                         r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
@@ -2524,7 +2520,7 @@ static long kvm_vm_ioctl(struct file *filp,
 
                 r = -EFAULT;
                 if (copy_from_user(&kvm_userspace_mem, argp,
-                                                sizeof kvm_userspace_mem))
+                                                sizeof(kvm_userspace_mem)))
                         goto out;
 
                 r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem);
@@ -2534,7 +2530,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 struct kvm_dirty_log log;
 
                 r = -EFAULT;
-                if (copy_from_user(&log, argp, sizeof log))
+                if (copy_from_user(&log, argp, sizeof(log)))
                         goto out;
                 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
                 break;
@@ -2542,16 +2538,18 @@ static long kvm_vm_ioctl(struct file *filp,
 #ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
         case KVM_REGISTER_COALESCED_MMIO: {
                 struct kvm_coalesced_mmio_zone zone;
+
                 r = -EFAULT;
-                if (copy_from_user(&zone, argp, sizeof zone))
+                if (copy_from_user(&zone, argp, sizeof(zone)))
                         goto out;
                 r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
                 break;
         }
         case KVM_UNREGISTER_COALESCED_MMIO: {
                 struct kvm_coalesced_mmio_zone zone;
+
                 r = -EFAULT;
-                if (copy_from_user(&zone, argp, sizeof zone))
+                if (copy_from_user(&zone, argp, sizeof(zone)))
                         goto out;
                 r = kvm_vm_ioctl_unregister_coalesced_mmio(kvm, &zone);
                 break;
@@ -2561,7 +2559,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 struct kvm_irqfd data;
 
                 r = -EFAULT;
-                if (copy_from_user(&data, argp, sizeof data))
+                if (copy_from_user(&data, argp, sizeof(data)))
                         goto out;
                 r = kvm_irqfd(kvm, &data);
                 break;
@@ -2570,7 +2568,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 struct kvm_ioeventfd data;
 
                 r = -EFAULT;
-                if (copy_from_user(&data, argp, sizeof data))
+                if (copy_from_user(&data, argp, sizeof(data)))
                         goto out;
                 r = kvm_ioeventfd(kvm, &data);
                 break;
@@ -2591,7 +2589,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 struct kvm_msi msi;
 
                 r = -EFAULT;
-                if (copy_from_user(&msi, argp, sizeof msi))
+                if (copy_from_user(&msi, argp, sizeof(msi)))
                         goto out;
                 r = kvm_send_userspace_msi(kvm, &msi);
                 break;
@@ -2603,7 +2601,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 struct kvm_irq_level irq_event;
 
                 r = -EFAULT;
-                if (copy_from_user(&irq_event, argp, sizeof irq_event))
+                if (copy_from_user(&irq_event, argp, sizeof(irq_event)))
                         goto out;
 
                 r = kvm_vm_ioctl_irq_line(kvm, &irq_event,
@@ -2613,7 +2611,7 @@ static long kvm_vm_ioctl(struct file *filp,
 
                 r = -EFAULT;
                 if (ioctl == KVM_IRQ_LINE_STATUS) {
-                        if (copy_to_user(argp, &irq_event, sizeof irq_event))
+                        if (copy_to_user(argp, &irq_event, sizeof(irq_event)))
                                 goto out;
                 }
 
@@ -2646,7 +2644,7 @@ static long kvm_vm_ioctl(struct file *filp,
                         goto out_free_irq_routing;
                 r = kvm_set_irq_routing(kvm, entries, routing.nr,
                                         routing.flags);
-        out_free_irq_routing:
+out_free_irq_routing:
                 vfree(entries);
                 break;
         }
@@ -2821,8 +2819,7 @@ static void hardware_enable_nolock(void *junk)
         if (r) {
                 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
                 atomic_inc(&hardware_enable_failed);
-                printk(KERN_INFO "kvm: enabling virtualization on "
-                                 "CPU%d failed\n", cpu);
+                pr_info("kvm: enabling virtualization on CPU%d failed\n", cpu);
         }
 }
 
@@ -2898,12 +2895,12 @@ static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
         val &= ~CPU_TASKS_FROZEN;
         switch (val) {
         case CPU_DYING:
-                printk(KERN_INFO "kvm: disabling virtualization on CPU%d\n",
+                pr_info("kvm: disabling virtualization on CPU%d\n",
                        cpu);
                 hardware_disable();
                 break;
         case CPU_STARTING:
-                printk(KERN_INFO "kvm: enabling virtualization on CPU%d\n",
+                pr_info("kvm: enabling virtualization on CPU%d\n",
                        cpu);
                 hardware_enable();
                 break;
@@ -2920,7 +2917,7 @@ static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
          *
          * And Intel TXT required VMX off for all cpu when system shutdown.
          */
-        printk(KERN_INFO "kvm: exiting hardware virtualization\n");
+        pr_info("kvm: exiting hardware virtualization\n");
         kvm_rebooting = true;
         on_each_cpu(hardware_disable_nolock, NULL, 1);
         return NOTIFY_OK;
@@ -2944,7 +2941,7 @@ static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
 }
 
 static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
-                                 const struct kvm_io_range *r2)
+                                 const struct kvm_io_range *r2)
 {
         if (r1->addr < r2->addr)
                 return -1;
@@ -3268,6 +3265,7 @@ struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
 static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
 {
         struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
+
         if (vcpu->preempted)
                 vcpu->preempted = false;
 
@@ -3349,7 +3347,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
 
         r = misc_register(&kvm_dev);
         if (r) {
-                printk(KERN_ERR "kvm: misc device register failed\n");
+                pr_err("kvm: misc device register failed\n");
                 goto out_unreg;
         }
 
@@ -3360,7 +3358,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
 
         r = kvm_init_debug();
         if (r) {
-                printk(KERN_ERR "kvm: create debugfs files failed\n");
+                pr_err("kvm: create debugfs files failed\n");
                 goto out_undebugfs;
         }