533 files changed, 6876 insertions, 3510 deletions

diff --git a/Documentation/devicetree/bindings/dma/apm-xgene-dma.txt b/Documentation/devicetree/bindings/dma/apm-xgene-dma.txt
index d3058768b23d..c53e0b08032f 100644
--- a/Documentation/devicetree/bindings/dma/apm-xgene-dma.txt
+++ b/Documentation/devicetree/bindings/dma/apm-xgene-dma.txt
@@ -35,7 +35,7 @@ Example:
                         device_type = "dma";
                         reg = <0x0 0x1f270000 0x0 0x10000>,
                               <0x0 0x1f200000 0x0 0x10000>,
-                              <0x0 0x1b008000 0x0 0x2000>,
+                              <0x0 0x1b000000 0x0 0x400000>,
                               <0x0 0x1054a000 0x0 0x100>;
                         interrupts = <0x0 0x82 0x4>,
                                      <0x0 0xb8 0x4>,
diff --git a/Documentation/devicetree/bindings/phy/ti-phy.txt b/Documentation/devicetree/bindings/phy/ti-phy.txt
index 305e3df3d9b1..9cf9446eaf2e 100644
--- a/Documentation/devicetree/bindings/phy/ti-phy.txt
+++ b/Documentation/devicetree/bindings/phy/ti-phy.txt
@@ -82,6 +82,9 @@ Optional properties:
  - id: If there are multiple instance of the same type, in order to
    differentiate between each instance "id" can be used (e.g., multi-lane PCIe
    PHY). If "id" is not provided, it is set to default value of '1'.
+ - syscon-pllreset: Handle to system control region that contains the
+   CTRL_CORE_SMA_SW_0 register and register offset to the CTRL_CORE_SMA_SW_0
+   register that contains the SATA_PLL_SOFT_RESET bit. Only valid for sata_phy.
 
 This is usually a subnode of ocp2scp to which it is connected.
 
@@ -100,3 +103,16 @@ usb3phy@4a084400 {
                         "sysclk",
                         "refclk";
 };
+
+sata_phy: phy@4A096000 {
+        compatible = "ti,phy-pipe3-sata";
+        reg = <0x4A096000 0x80>, /* phy_rx */
+              <0x4A096400 0x64>, /* phy_tx */
+              <0x4A096800 0x40>; /* pll_ctrl */
+        reg-names = "phy_rx", "phy_tx", "pll_ctrl";
+        ctrl-module = <&omap_control_sata>;
+        clocks = <&sys_clkin1>, <&sata_ref_clk>;
+        clock-names = "sysclk", "refclk";
+        syscon-pllreset = <&scm_conf 0x3fc>;
+        #phy-cells = <0>;
+};
diff --git a/Documentation/devicetree/bindings/sound/mt8173-max98090.txt b/Documentation/devicetree/bindings/sound/mt8173-max98090.txt
index 829bd26d17f8..519e97c8f1b8 100644
--- a/Documentation/devicetree/bindings/sound/mt8173-max98090.txt
+++ b/Documentation/devicetree/bindings/sound/mt8173-max98090.txt
@@ -3,11 +3,13 @@ MT8173 with MAX98090 CODEC
 Required properties:
 - compatible : "mediatek,mt8173-max98090"
 - mediatek,audio-codec: the phandle of the MAX98090 audio codec
+- mediatek,platform: the phandle of MT8173 ASoC platform
 
 Example:
 
         sound {
                 compatible = "mediatek,mt8173-max98090";
                 mediatek,audio-codec = <&max98090>;
+                mediatek,platform = <&afe>;
         };
 
diff --git a/Documentation/devicetree/bindings/sound/mt8173-rt5650-rt5676.txt b/Documentation/devicetree/bindings/sound/mt8173-rt5650-rt5676.txt
index 61e98c976bd4..f205ce9e31dd 100644
--- a/Documentation/devicetree/bindings/sound/mt8173-rt5650-rt5676.txt
+++ b/Documentation/devicetree/bindings/sound/mt8173-rt5650-rt5676.txt
@@ -3,11 +3,13 @@ MT8173 with RT5650 RT5676 CODECS
 Required properties:
 - compatible : "mediatek,mt8173-rt5650-rt5676"
 - mediatek,audio-codec: the phandles of rt5650 and rt5676 codecs
+- mediatek,platform: the phandle of MT8173 ASoC platform
 
 Example:
 
         sound {
                 compatible = "mediatek,mt8173-rt5650-rt5676";
                 mediatek,audio-codec = <&rt5650 &rt5676>;
+                mediatek,platform = <&afe>;
         };
 
diff --git a/Documentation/devicetree/bindings/spi/spi-ath79.txt b/Documentation/devicetree/bindings/spi/spi-ath79.txt
index f1ad9c367532..9c696fa66f81 100644
--- a/Documentation/devicetree/bindings/spi/spi-ath79.txt
+++ b/Documentation/devicetree/bindings/spi/spi-ath79.txt
@@ -3,7 +3,7 @@ Binding for Qualcomm Atheros AR7xxx/AR9xxx SPI controller
 Required properties:
 - compatible: has to be "qca,<soc-type>-spi", "qca,ar7100-spi" as fallback.
 - reg: Base address and size of the controllers memory area
-- clocks: phandle to the AHB clock.
+- clocks: phandle of the AHB clock.
 - clock-names: has to be "ahb".
 - #address-cells: <1>, as required by generic SPI binding.
 - #size-cells: <0>, also as required by generic SPI binding.
@@ -12,9 +12,9 @@ Child nodes as per the generic SPI binding.
 
 Example:
 
-        spi@1F000000 {
+        spi@1f000000 {
                 compatible = "qca,ar9132-spi", "qca,ar7100-spi";
-                reg = <0x1F000000 0x10>;
+                reg = <0x1f000000 0x10>;
 
                 clocks = <&pll 2>;
                 clock-names = "ahb";
diff --git a/Documentation/hwmon/nct7904 b/Documentation/hwmon/nct7904
index 014f112e2a14..57fffe33ebfc 100644
--- a/Documentation/hwmon/nct7904
+++ b/Documentation/hwmon/nct7904
@@ -35,11 +35,11 @@ temp1_input		Local temperature (1/1000 degree,
 temp[2-9]_input         CPU temperatures (1/1000 degree,
                         0.125 degree resolution)
 
-fan[1-4]_mode           R/W, 0/1 for manual or SmartFan mode
+pwm[1-4]_enable         R/W, 1/2 for manual or SmartFan mode
                         Setting SmartFan mode is supported only if it has been
                         previously configured by BIOS (or configuration EEPROM)
 
-fan[1-4]_pwm            R/O in SmartFan mode, R/W in manual control mode
+pwm[1-4]                R/O in SmartFan mode, R/W in manual control mode
 
 The driver checks sensor control registers and does not export the sensors
 that are not enabled. Anyway, a sensor that is enabled may actually be not
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index c86f2f1ae4f6..1fec1135791d 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -119,8 +119,10 @@ ALPS Absolute Mode - Protocol Version 2
  byte 5:  0   z6   z5   z4   z3   z2   z1   z0
 
 Protocol Version 2 DualPoint devices send standard PS/2 mouse packets for
-the DualPoint Stick. For non interleaved dualpoint devices the pointingstick
-buttons get reported separately in the PSM, PSR and PSL bits.
+the DualPoint Stick. The M, R and L bits signal the combined status of both
+the pointingstick and touchpad buttons, except for Dell dualpoint devices
+where the pointingstick buttons get reported separately in the PSM, PSR
+and PSL bits.
 
 Dualpoint device -- interleaved packet format
 ---------------------------------------------
diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py
index 949de191fcdc..cda56df9b8a7 100755
--- a/Documentation/target/tcm_mod_builder.py
+++ b/Documentation/target/tcm_mod_builder.py
@@ -199,7 +199,8 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
         buf += "#include <linux/string.h>\n"
         buf += "#include <linux/configfs.h>\n"
         buf += "#include <linux/ctype.h>\n"
-        buf += "#include <asm/unaligned.h>\n\n"
+        buf += "#include <asm/unaligned.h>\n"
+        buf += "#include <scsi/scsi_proto.h>\n\n"
         buf += "#include <target/target_core_base.h>\n"
         buf += "#include <target/target_core_fabric.h>\n"
         buf += "#include <target/target_core_fabric_configfs.h>\n"
@@ -230,8 +231,14 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
         buf += "        }\n"
         buf += "        tpg->" + fabric_mod_port + " = " + fabric_mod_port + ";\n"
         buf += "        tpg->" + fabric_mod_port + "_tpgt = tpgt;\n\n"
-        buf += "        ret = core_tpg_register(&" + fabric_mod_name + "_ops, wwn,\n"
-        buf += "                                &tpg->se_tpg, SCSI_PROTOCOL_SAS);\n"
+
+        if proto_ident == "FC":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_FCP);\n"
+        elif proto_ident == "SAS":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);\n"
+        elif proto_ident == "iSCSI":
+                buf += "        ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_ISCSI);\n"
+
         buf += "        if (ret < 0) {\n"
         buf += "                kfree(tpg);\n"
         buf += "                return NULL;\n"
@@ -292,7 +299,7 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
 
         buf += "static const struct target_core_fabric_ops " + fabric_mod_name + "_ops = {\n"
         buf += "        .module                         = THIS_MODULE,\n"
-        buf += "        .name                           = " + fabric_mod_name + ",\n"
+        buf += "        .name                           = \"" + fabric_mod_name + "\",\n"
         buf += "        .get_fabric_name                = " + fabric_mod_name + "_get_fabric_name,\n"
         buf += "        .tpg_get_wwn                    = " + fabric_mod_name + "_get_fabric_wwn,\n"
         buf += "        .tpg_get_tag                    = " + fabric_mod_name + "_get_tag,\n"
@@ -322,17 +329,17 @@ def tcm_mod_build_configfs(proto_ident, fabric_mod_dir_var, fabric_mod_name):
         buf += "        .fabric_make_tpg                = " + fabric_mod_name + "_make_tpg,\n"
         buf += "        .fabric_drop_tpg                = " + fabric_mod_name + "_drop_tpg,\n"
         buf += "\n"
-        buf += "        .tfc_wwn_attrs                  = " + fabric_mod_name + "_wwn_attrs;\n"
+        buf += "        .tfc_wwn_attrs                  = " + fabric_mod_name + "_wwn_attrs,\n"
         buf += "};\n\n"
 
         buf += "static int __init " + fabric_mod_name + "_init(void)\n"
         buf += "{\n"
-        buf += "        return target_register_template(" + fabric_mod_name + "_ops);\n"
+        buf += "        return target_register_template(&" + fabric_mod_name + "_ops);\n"
         buf += "};\n\n"
 
         buf += "static void __exit " + fabric_mod_name + "_exit(void)\n"
         buf += "{\n"
-        buf += "        target_unregister_template(" + fabric_mod_name + "_ops);\n"
+        buf += "        target_unregister_template(&" + fabric_mod_name + "_ops);\n"
         buf += "};\n\n"
 
         buf += "MODULE_DESCRIPTION(\"" + fabric_mod_name.upper() + " series fabric driver\");\n"
diff --git a/MAINTAINERS b/MAINTAINERS
index 9289ecb57b68..a9ae6c105520 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5600,6 +5600,7 @@ F:	kernel/irq/
 IRQCHIP DRIVERS
 M:      Thomas Gleixner <tglx@linutronix.de>
 M:      Jason Cooper <jason@lakedaemon.net>
+M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
@@ -5608,11 +5609,14 @@ F:	Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
 
 IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
-M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
+M:      Jiang Liu <jiang.liu@linux.intel.com>
+M:      Marc Zyngier <marc.zyngier@arm.com>
 S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
 F:      Documentation/IRQ-domain.txt
 F:      include/linux/irqdomain.h
 F:      kernel/irq/irqdomain.c
+F:      kernel/irq/msi.c
 
 ISAPNP
 M:      Jaroslav Kysela <perex@perex.cz>
diff --git a/Makefile b/Makefile
index afabc44a349b..35b4c196c171 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
@@ -597,6 +597,11 @@ endif # $(dot-config)
 # Defaults to vmlinux, but the arch makefile usually adds further targets
 all: vmlinux
 
+# The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default
+# values of the respective KBUILD_* variables
+ARCH_CPPFLAGS :=
+ARCH_AFLAGS :=
+ARCH_CFLAGS :=
 include arch/$(SRCARCH)/Makefile
 
 KBUILD_CFLAGS   += $(call cc-option,-fno-delete-null-pointer-checks,)
@@ -848,10 +853,10 @@ export mod_strip_cmd
 mod_compress_cmd = true
 ifdef CONFIG_MODULE_COMPRESS
   ifdef CONFIG_MODULE_COMPRESS_GZIP
-    mod_compress_cmd = gzip -n
+    mod_compress_cmd = gzip -n -f
   endif # CONFIG_MODULE_COMPRESS_GZIP
   ifdef CONFIG_MODULE_COMPRESS_XZ
-    mod_compress_cmd = xz
+    mod_compress_cmd = xz -f
   endif # CONFIG_MODULE_COMPRESS_XZ
 endif # CONFIG_MODULE_COMPRESS
 export mod_compress_cmd
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 91cf4055acab..bd4670d1b89b 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -313,11 +313,11 @@ config ARC_PAGE_SIZE_8K
 
 config ARC_PAGE_SIZE_16K
         bool "16KB"
-        depends on ARC_MMU_V3
+        depends on ARC_MMU_V3 || ARC_MMU_V4
 
 config ARC_PAGE_SIZE_4K
         bool "4KB"
-        depends on ARC_MMU_V3
+        depends on ARC_MMU_V3 || ARC_MMU_V4
 
 endchoice
 
@@ -365,6 +365,11 @@ config ARC_HAS_LLSC
         default y
         depends on !ARC_CANT_LLSC
 
+config ARC_STAR_9000923308
+        bool "Workaround for llock/scond livelock"
+        default y
+        depends on ISA_ARCV2 && SMP && ARC_HAS_LLSC
+
 config ARC_HAS_SWAPE
         bool "Insn: SWAPE (endian-swap)"
         default y
@@ -379,6 +384,10 @@ config ARC_HAS_LL64
           dest operands with 2 possible source operands.
         default y
 
+config ARC_HAS_DIV_REM
+        bool "Insn: div, divu, rem, remu"
+        default y
+
 config ARC_HAS_RTC
         bool "Local 64-bit r/o cycle counter"
         default n
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 46d87310220d..8a27a48304a4 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -36,8 +36,16 @@ cflags-$(atleast_gcc44)			+= -fsection-anchors
 cflags-$(CONFIG_ARC_HAS_LLSC)           += -mlock
 cflags-$(CONFIG_ARC_HAS_SWAPE)          += -mswape
 
+ifdef CONFIG_ISA_ARCV2
+
 ifndef CONFIG_ARC_HAS_LL64
-cflags-$(CONFIG_ISA_ARCV2)              += -mno-ll64
+cflags-y                                += -mno-ll64
+endif
+
+ifndef CONFIG_ARC_HAS_DIV_REM
+cflags-y                                += -mno-div-rem
+endif
+
 endif
 
 cflags-$(CONFIG_ARC_DW2_UNWIND)         += -fasynchronous-unwind-tables
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 070f58827a5c..c8f57b8449dc 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -89,11 +89,10 @@
 #define ECR_C_BIT_DTLB_LD_MISS          8
 #define ECR_C_BIT_DTLB_ST_MISS          9
 
-
 /* Auxiliary registers */
 #define AUX_IDENTITY            4
 #define AUX_INTR_VEC_BASE       0x25
-
+#define AUX_NON_VOL             0x5e
 
 /*
  * Floating Pt Registers
@@ -240,9 +239,9 @@ struct bcr_extn_xymem {
 
 struct bcr_perip {
 #ifdef CONFIG_CPU_BIG_ENDIAN
-        unsigned int start:8, pad2:8, sz:8, pad:8;
+        unsigned int start:8, pad2:8, sz:8, ver:8;
 #else
-        unsigned int pad:8, sz:8, pad2:8, start:8;
+        unsigned int ver:8, sz:8, pad2:8, start:8;
 #endif
 };
 
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 03484cb4d16d..87d18ae53115 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -23,33 +23,60 @@
 
 #define atomic_set(v, i) (((v)->counter) = (i))
 
-#ifdef CONFIG_ISA_ARCV2
-#define PREFETCHW       "       prefetchw   [%1]        \n"
-#else
-#define PREFETCHW
+#ifdef CONFIG_ARC_STAR_9000923308
+
+#define SCOND_FAIL_RETRY_VAR_DEF                                                \
+        unsigned int delay = 1, tmp;                                            \
+
+#define SCOND_FAIL_RETRY_ASM                                                    \
+        "       bz      4f                      \n"                             \
+        "   ; --- scond fail delay ---          \n"                             \
+        "       mov     %[tmp], %[delay]        \n"     /* tmp = delay */       \
+        "2:     brne.d  %[tmp], 0, 2b           \n"     /* while (tmp != 0) */  \
+        "       sub     %[tmp], %[tmp], 1       \n"     /* tmp-- */             \
+        "       rol     %[delay], %[delay]      \n"     /* delay *= 2 */        \
+        "       b       1b                      \n"     /* start over */        \
+        "4: ; --- success ---                   \n"                             \
+
+#define SCOND_FAIL_RETRY_VARS                                                   \
+          ,[delay] "+&r" (delay),[tmp] "=&r"    (tmp)                           \
+
+#else   /* !CONFIG_ARC_STAR_9000923308 */
+
+#define SCOND_FAIL_RETRY_VAR_DEF
+
+#define SCOND_FAIL_RETRY_ASM                                                    \
+        "       bnz     1b                      \n"                             \
+
+#define SCOND_FAIL_RETRY_VARS
+
 #endif
 
 #define ATOMIC_OP(op, c_op, asm_op)                                     \
 static inline void atomic_##op(int i, atomic_t *v)                      \
 {                                                                       \
-        unsigned int temp;                                              \
+        unsigned int val;                                               \
+        SCOND_FAIL_RETRY_VAR_DEF                                        \
                                                                         \
         __asm__ __volatile__(                                           \
-        "1:                             \n"                             \
-        PREFETCHW                                                       \
-        "       llock   %0, [%1]        \n"                             \
-        "       " #asm_op " %0, %0, %2  \n"                             \
-        "       scond   %0, [%1]        \n"                             \
-        "       bnz     1b              \n"                             \
-        : "=&r"(temp)   /* Early clobber, to prevent reg reuse */       \
-        : "r"(&v->counter), "ir"(i)                                     \
+        "1:     llock   %[val], [%[ctr]]                \n"             \
+        "       " #asm_op " %[val], %[val], %[i]        \n"             \
+        "       scond   %[val], [%[ctr]]                \n"             \
+        "                                               \n"             \
+        SCOND_FAIL_RETRY_ASM                                            \
+                                                                        \
+        : [val] "=&r"   (val) /* Early clobber to prevent reg reuse */  \
+          SCOND_FAIL_RETRY_VARS                                         \
+        : [ctr] "r"     (&v->counter), /* Not "m": llock only supports reg direct addr mode */  \
+          [i]   "ir"    (i)                                             \
         : "cc");                                                        \
 }                                                                       \
 
 #define ATOMIC_OP_RETURN(op, c_op, asm_op)                              \
 static inline int atomic_##op##_return(int i, atomic_t *v)              \
 {                                                                       \
-        unsigned int temp;                                              \
+        unsigned int val;                                               \
+        SCOND_FAIL_RETRY_VAR_DEF                                        \
                                                                         \
         /*                                                              \
          * Explicit full memory barrier needed before/after as          \
@@ -58,19 +85,21 @@ static inline int atomic_##op##_return(int i, atomic_t *v)		\
         smp_mb();                                                       \
                                                                         \
         __asm__ __volatile__(                                           \
-        "1:                             \n"                             \
-        PREFETCHW                                                       \
-        "       llock   %0, [%1]        \n"                             \
-        "       " #asm_op " %0, %0, %2  \n"                             \
-        "       scond   %0, [%1]        \n"                             \
-        "       bnz     1b              \n"                             \
-        : "=&r"(temp)                                                   \
-        : "r"(&v->counter), "ir"(i)                                     \
+        "1:     llock   %[val], [%[ctr]]                \n"             \
+        "       " #asm_op " %[val], %[val], %[i]        \n"             \
+        "       scond   %[val], [%[ctr]]                \n"             \
+        "                                               \n"             \
+        SCOND_FAIL_RETRY_ASM                                            \
+                                                                        \
+        : [val] "=&r"   (val)                                           \
+          SCOND_FAIL_RETRY_VARS                                         \
+        : [ctr] "r"     (&v->counter),                                  \
+          [i]   "ir"    (i)                                             \
         : "cc");                                                        \
                                                                         \
         smp_mb();                                                       \
                                                                         \
-        return temp;                                                    \
+        return val;                                                     \
 }
 
 #else   /* !CONFIG_ARC_HAS_LLSC */
@@ -150,6 +179,9 @@ ATOMIC_OP(and, &=, and)
 #undef ATOMIC_OPS
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
+#undef SCOND_FAIL_RETRY_VAR_DEF
+#undef SCOND_FAIL_RETRY_ASM
+#undef SCOND_FAIL_RETRY_VARS
 
 /**
  * __atomic_add_unless - add unless the number is a given value
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 91694ec1ce95..69095da1fcfd 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -20,20 +20,20 @@
 struct pt_regs {
 
         /* Real registers */
-        long bta;       /* bta_l1, bta_l2, erbta */
+        unsigned long bta;      /* bta_l1, bta_l2, erbta */
 
-        long lp_start, lp_end, lp_count;
+        unsigned long lp_start, lp_end, lp_count;
 
-        long status32;  /* status32_l1, status32_l2, erstatus */
-        long ret;       /* ilink1, ilink2 or eret */
-        long blink;
-        long fp;
-        long r26;       /* gp */
+        unsigned long status32; /* status32_l1, status32_l2, erstatus */
+        unsigned long ret;      /* ilink1, ilink2 or eret */
+        unsigned long blink;
+        unsigned long fp;
+        unsigned long r26;      /* gp */
 
-        long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
+        unsigned long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
 
-        long sp;        /* user/kernel sp depending on where we came from  */
-        long orig_r0;
+        unsigned long sp;       /* User/Kernel depending on where we came from */
+        unsigned long orig_r0;
 
         /*
          * To distinguish bet excp, syscall, irq
@@ -55,13 +55,13 @@ struct pt_regs {
                 unsigned long event;
         };
 
-        long user_r25;
+        unsigned long user_r25;
 };
 #else
 
 struct pt_regs {
 
-        long orig_r0;
+        unsigned long orig_r0;
 
         union {
                 struct {
@@ -76,26 +76,26 @@ struct pt_regs {
                 unsigned long event;
         };
 
-        long bta;       /* bta_l1, bta_l2, erbta */
+        unsigned long bta;      /* bta_l1, bta_l2, erbta */
 
-        long user_r25;
+        unsigned long user_r25;
 
-        long r26;       /* gp */
-        long fp;
-        long sp;        /* user/kernel sp depending on where we came from  */
+        unsigned long r26;      /* gp */
+        unsigned long fp;
+        unsigned long sp;       /* user/kernel sp depending on where we came from  */
 
-        long r12;
+        unsigned long r12;
 
         /*------- Below list auto saved by h/w -----------*/
-        long r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11;
+        unsigned long r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11;
 
-        long blink;
-        long lp_end, lp_start, lp_count;
+        unsigned long blink;
+        unsigned long lp_end, lp_start, lp_count;
 
-        long ei, ldi, jli;
+        unsigned long ei, ldi, jli;
 
-        long ret;
-        long status32;
+        unsigned long ret;
+        unsigned long status32;
 };
 
 #endif
@@ -103,10 +103,10 @@ struct pt_regs {
 /* Callee saved registers - need to be saved only when you are scheduled out */
 
 struct callee_regs {
-        long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+        unsigned long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
 };
 
-#define instruction_pointer(regs)       (unsigned long)((regs)->ret)
+#define instruction_pointer(regs)       ((regs)->ret)
 #define profile_pc(regs)                instruction_pointer(regs)
 
 /* return 1 if user mode or 0 if kernel mode */
@@ -142,7 +142,7 @@ struct callee_regs {
 
 static inline long regs_return_value(struct pt_regs *regs)
 {
-        return regs->r0;
+        return (long)regs->r0;
 }
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index e1651df6a93d..db8c59d1eaeb 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -18,9 +18,518 @@
 #define arch_spin_unlock_wait(x) \
         do { while (arch_spin_is_locked(x)) cpu_relax(); } while (0)
 
+#ifdef CONFIG_ARC_HAS_LLSC
+
+/*
+ * A normal LLOCK/SCOND based system, w/o need for livelock workaround
+ */
+#ifndef CONFIG_ARC_STAR_9000923308
+
 static inline void arch_spin_lock(arch_spinlock_t *lock)
 {
-        unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+        unsigned int val;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[slock]]      \n"
+        "       breq    %[val], %[LOCKED], 1b   \n"     /* spin while LOCKED */
+        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [slock]       "r"     (&(lock->slock)),
+          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_spin_trylock(arch_spinlock_t *lock)
+{
+        unsigned int val, got_it = 0;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[slock]]      \n"
+        "       breq    %[val], %[LOCKED], 4f   \n"     /* already LOCKED, just bail */
+        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
+        "       bnz     1b                      \n"
+        "       mov     %[got_it], 1            \n"
+        "4:                                     \n"
+        "                                       \n"
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+        : [slock]       "r"     (&(lock->slock)),
+          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_spin_unlock(arch_spinlock_t *lock)
+{
+        smp_mb();
+
+        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
+
+        smp_mb();
+}
+
+/*
+ * Read-write spinlocks, allowing multiple readers but only one writer.
+ * Unfair locking as Writers could be starved indefinitely by Reader(s)
+ */
+
+static inline void arch_read_lock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+
+        smp_mb();
+
+        /*
+         * zero means writer holds the lock exclusively, deny Reader.
+         * Otherwise grant lock to first/subseq reader
+         *
+         *      if (rw->counter > 0) {
+         *              rw->counter--;
+         *              ret = 1;
+         *      }
+         */
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brls    %[val], %[WR_LOCKED], 1b\n"     /* <= 0: spin while write locked */
+        "       sub     %[val], %[val], 1       \n"     /* reader lock */
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [rwlock]      "r"     (&(rw->counter)),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_read_trylock(arch_rwlock_t *rw)
+{
+        unsigned int val, got_it = 0;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brls    %[val], %[WR_LOCKED], 4f\n"     /* <= 0: already write locked, bail */
+        "       sub     %[val], %[val], 1       \n"     /* counter-- */
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"     /* retry if collided with someone */
+        "       mov     %[got_it], 1            \n"
+        "                                       \n"
+        "4: ; --- done ---                      \n"
+
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+        : [rwlock]      "r"     (&(rw->counter)),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_write_lock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+
+        smp_mb();
+
+        /*
+         * If reader(s) hold lock (lock < __ARCH_RW_LOCK_UNLOCKED__),
+         * deny writer. Otherwise if unlocked grant to writer
+         * Hence the claim that Linux rwlocks are unfair to writers.
+         * (can be starved for an indefinite time by readers).
+         *
+         *      if (rw->counter == __ARCH_RW_LOCK_UNLOCKED__) {
+         *              rw->counter = 0;
+         *              ret = 1;
+         *      }
+         */
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brne    %[val], %[UNLOCKED], 1b \n"     /* while !UNLOCKED spin */
+        "       mov     %[val], %[WR_LOCKED]    \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [rwlock]      "r"     (&(rw->counter)),
+          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_write_trylock(arch_rwlock_t *rw)
+{
+        unsigned int val, got_it = 0;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brne    %[val], %[UNLOCKED], 4f \n"     /* !UNLOCKED, bail */
+        "       mov     %[val], %[WR_LOCKED]    \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"     /* retry if collided with someone */
+        "       mov     %[got_it], 1            \n"
+        "                                       \n"
+        "4: ; --- done ---                      \n"
+
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+        : [rwlock]      "r"     (&(rw->counter)),
+          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_read_unlock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+
+        smp_mb();
+
+        /*
+         * rw->counter++;
+         */
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       add     %[val], %[val], 1       \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [rwlock]      "r"     (&(rw->counter))
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+static inline void arch_write_unlock(arch_rwlock_t *rw)
+{
+        smp_mb();
+
+        rw->counter = __ARCH_RW_LOCK_UNLOCKED__;
+
+        smp_mb();
+}
+
+#else   /* CONFIG_ARC_STAR_9000923308 */
+
+/*
+ * HS38x4 could get into a LLOCK/SCOND livelock in case of multiple overlapping
+ * coherency transactions in the SCU. The exclusive line state keeps rotating
+ * among contenting cores leading to a never ending cycle. So break the cycle
+ * by deferring the retry of failed exclusive access (SCOND). The actual delay
+ * needed is function of number of contending cores as well as the unrelated
+ * coherency traffic from other cores. To keep the code simple, start off with
+ * small delay of 1 which would suffice most cases and in case of contention
+ * double the delay. Eventually the delay is sufficient such that the coherency
+ * pipeline is drained, thus a subsequent exclusive access would succeed.
+ */
+
+#define SCOND_FAIL_RETRY_VAR_DEF                                                \
+        unsigned int delay, tmp;                                                \
+
+#define SCOND_FAIL_RETRY_ASM                                                    \
+        "   ; --- scond fail delay ---          \n"                             \
+        "       mov     %[tmp], %[delay]        \n"     /* tmp = delay */       \
+        "2:     brne.d  %[tmp], 0, 2b           \n"     /* while (tmp != 0) */  \
+        "       sub     %[tmp], %[tmp], 1       \n"     /* tmp-- */             \
+        "       rol     %[delay], %[delay]      \n"     /* delay *= 2 */        \
+        "       b       1b                      \n"     /* start over */        \
+        "                                       \n"                             \
+        "4: ; --- done ---                      \n"                             \
+
+#define SCOND_FAIL_RETRY_VARS                                                   \
+          ,[delay] "=&r" (delay), [tmp] "=&r"   (tmp)                           \
+
+static inline void arch_spin_lock(arch_spinlock_t *lock)
+{
+        unsigned int val;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[slock]]      \n"
+        "       breq    %[val], %[LOCKED], 0b   \n"     /* spin while LOCKED */
+        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
+        "       bz      4f                      \n"     /* done */
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val)
+          SCOND_FAIL_RETRY_VARS
+        : [slock]       "r"     (&(lock->slock)),
+          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_spin_trylock(arch_spinlock_t *lock)
+{
+        unsigned int val, got_it = 0;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[slock]]      \n"
+        "       breq    %[val], %[LOCKED], 4f   \n"     /* already LOCKED, just bail */
+        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
+        "       bz.d    4f                      \n"
+        "       mov.z   %[got_it], 1            \n"     /* got it */
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+          SCOND_FAIL_RETRY_VARS
+        : [slock]       "r"     (&(lock->slock)),
+          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_spin_unlock(arch_spinlock_t *lock)
+{
+        smp_mb();
+
+        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
+
+        smp_mb();
+}
+
+/*
+ * Read-write spinlocks, allowing multiple readers but only one writer.
+ * Unfair locking as Writers could be starved indefinitely by Reader(s)
+ */
+
+static inline void arch_read_lock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        /*
+         * zero means writer holds the lock exclusively, deny Reader.
+         * Otherwise grant lock to first/subseq reader
+         *
+         *      if (rw->counter > 0) {
+         *              rw->counter--;
+         *              ret = 1;
+         *      }
+         */
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brls    %[val], %[WR_LOCKED], 0b\n"     /* <= 0: spin while write locked */
+        "       sub     %[val], %[val], 1       \n"     /* reader lock */
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bz      4f                      \n"     /* done */
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val)
+          SCOND_FAIL_RETRY_VARS
+        : [rwlock]      "r"     (&(rw->counter)),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_read_trylock(arch_rwlock_t *rw)
+{
+        unsigned int val, got_it = 0;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brls    %[val], %[WR_LOCKED], 4f\n"     /* <= 0: already write locked, bail */
+        "       sub     %[val], %[val], 1       \n"     /* counter-- */
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bz.d    4f                      \n"
+        "       mov.z   %[got_it], 1            \n"     /* got it */
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+          SCOND_FAIL_RETRY_VARS
+        : [rwlock]      "r"     (&(rw->counter)),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_write_lock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        /*
+         * If reader(s) hold lock (lock < __ARCH_RW_LOCK_UNLOCKED__),
+         * deny writer. Otherwise if unlocked grant to writer
+         * Hence the claim that Linux rwlocks are unfair to writers.
+         * (can be starved for an indefinite time by readers).
+         *
+         *      if (rw->counter == __ARCH_RW_LOCK_UNLOCKED__) {
+         *              rw->counter = 0;
+         *              ret = 1;
+         *      }
+         */
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brne    %[val], %[UNLOCKED], 0b \n"     /* while !UNLOCKED spin */
+        "       mov     %[val], %[WR_LOCKED]    \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bz      4f                      \n"
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val)
+          SCOND_FAIL_RETRY_VARS
+        : [rwlock]      "r"     (&(rw->counter)),
+          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+/* 1 - lock taken successfully */
+static inline int arch_write_trylock(arch_rwlock_t *rw)
+{
+        unsigned int val, got_it = 0;
+        SCOND_FAIL_RETRY_VAR_DEF;
+
+        smp_mb();
+
+        __asm__ __volatile__(
+        "0:     mov     %[delay], 1             \n"
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       brne    %[val], %[UNLOCKED], 4f \n"     /* !UNLOCKED, bail */
+        "       mov     %[val], %[WR_LOCKED]    \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bz.d    4f                      \n"
+        "       mov.z   %[got_it], 1            \n"     /* got it */
+        "                                       \n"
+        SCOND_FAIL_RETRY_ASM
+
+        : [val]         "=&r"   (val),
+          [got_it]      "+&r"   (got_it)
+          SCOND_FAIL_RETRY_VARS
+        : [rwlock]      "r"     (&(rw->counter)),
+          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
+          [WR_LOCKED]   "ir"    (0)
+        : "memory", "cc");
+
+        smp_mb();
+
+        return got_it;
+}
+
+static inline void arch_read_unlock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+
+        smp_mb();
+
+        /*
+         * rw->counter++;
+         */
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       add     %[val], %[val], 1       \n"
+        "       scond   %[val], [%[rwlock]]     \n"
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [rwlock]      "r"     (&(rw->counter))
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+static inline void arch_write_unlock(arch_rwlock_t *rw)
+{
+        unsigned int val;
+
+        smp_mb();
+
+        /*
+         * rw->counter = __ARCH_RW_LOCK_UNLOCKED__;
+         */
+        __asm__ __volatile__(
+        "1:     llock   %[val], [%[rwlock]]     \n"
+        "       scond   %[UNLOCKED], [%[rwlock]]\n"
+        "       bnz     1b                      \n"
+        "                                       \n"
+        : [val]         "=&r"   (val)
+        : [rwlock]      "r"     (&(rw->counter)),
+          [UNLOCKED]    "r"     (__ARCH_RW_LOCK_UNLOCKED__)
+        : "memory", "cc");
+
+        smp_mb();
+}
+
+#undef SCOND_FAIL_RETRY_VAR_DEF
+#undef SCOND_FAIL_RETRY_ASM
+#undef SCOND_FAIL_RETRY_VARS
+
+#endif  /* CONFIG_ARC_STAR_9000923308 */
+
+#else   /* !CONFIG_ARC_HAS_LLSC */
+
+static inline void arch_spin_lock(arch_spinlock_t *lock)
+{
+        unsigned int val = __ARCH_SPIN_LOCK_LOCKED__;
 
         /*
          * This smp_mb() is technically superfluous, we only need the one
@@ -33,7 +542,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
         __asm__ __volatile__(
         "1:     ex  %0, [%1]            \n"
         "       breq  %0, %2, 1b        \n"
-        : "+&r" (tmp)
+        : "+&r" (val)
         : "r"(&(lock->slock)), "ir"(__ARCH_SPIN_LOCK_LOCKED__)
         : "memory");
 
@@ -48,26 +557,27 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
         smp_mb();
 }
 
+/* 1 - lock taken successfully */
 static inline int arch_spin_trylock(arch_spinlock_t *lock)
 {
-        unsigned int tmp = __ARCH_SPIN_LOCK_LOCKED__;
+        unsigned int val = __ARCH_SPIN_LOCK_LOCKED__;
 
         smp_mb();
 
         __asm__ __volatile__(
         "1:     ex  %0, [%1]            \n"
-        : "+r" (tmp)
+        : "+r" (val)
         : "r"(&(lock->slock))
         : "memory");
 
         smp_mb();
 
-        return (tmp == __ARCH_SPIN_LOCK_UNLOCKED__);
+        return (val == __ARCH_SPIN_LOCK_UNLOCKED__);
 }
 
 static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
-        unsigned int tmp = __ARCH_SPIN_LOCK_UNLOCKED__;
+        unsigned int val = __ARCH_SPIN_LOCK_UNLOCKED__;
 
         /*
          * RELEASE barrier: given the instructions avail on ARCv2, full barrier
@@ -77,7 +587,7 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
 
         __asm__ __volatile__(
         "       ex  %0, [%1]            \n"
-        : "+r" (tmp)
+        : "+r" (val)
         : "r"(&(lock->slock))
         : "memory");
 
@@ -90,19 +600,12 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
 
 /*
  * Read-write spinlocks, allowing multiple readers but only one writer.
+ * Unfair locking as Writers could be starved indefinitely by Reader(s)
  *
  * The spinlock itself is contained in @counter and access to it is
  * serialized with @lock_mutex.
- *
- * Unfair locking as Writers could be starved indefinitely by Reader(s)
  */
 
-/* Would read_trylock() succeed? */
-#define arch_read_can_lock(x)   ((x)->counter > 0)
-
-/* Would write_trylock() succeed? */
-#define arch_write_can_lock(x)  ((x)->counter == __ARCH_RW_LOCK_UNLOCKED__)
-
 /* 1 - lock taken successfully */
 static inline int arch_read_trylock(arch_rwlock_t *rw)
 {
@@ -173,6 +676,11 @@ static inline void arch_write_unlock(arch_rwlock_t *rw)
         arch_spin_unlock(&(rw->lock_mutex));
 }
 
+#endif
+
+#define arch_read_can_lock(x)   ((x)->counter > 0)
+#define arch_write_can_lock(x)  ((x)->counter == __ARCH_RW_LOCK_UNLOCKED__)
+
 #define arch_read_lock_flags(lock, flags)       arch_read_lock(lock)
 #define arch_write_lock_flags(lock, flags)      arch_write_lock(lock)
 
diff --git a/arch/arc/include/asm/spinlock_types.h b/arch/arc/include/asm/spinlock_types.h
index 662627ced4f2..4e1ef5f650c6 100644
--- a/arch/arc/include/asm/spinlock_types.h
+++ b/arch/arc/include/asm/spinlock_types.h
@@ -26,7 +26,9 @@ typedef struct {
  */
 typedef struct {
         volatile unsigned int   counter;
+#ifndef CONFIG_ARC_HAS_LLSC
         arch_spinlock_t         lock_mutex;
+#endif
 } arch_rwlock_t;
 
 #define __ARCH_RW_LOCK_UNLOCKED__       0x01000000
diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h
index 76a7739aab1c..0b3ef63d4a03 100644
--- a/arch/arc/include/uapi/asm/ptrace.h
+++ b/arch/arc/include/uapi/asm/ptrace.h
@@ -32,20 +32,20 @@
 */
 struct user_regs_struct {
 
-        long pad;
+        unsigned long pad;
         struct {
-                long bta, lp_start, lp_end, lp_count;
-                long status32, ret, blink, fp, gp;
-                long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
-                long sp;
+                unsigned long bta, lp_start, lp_end, lp_count;
+                unsigned long status32, ret, blink, fp, gp;
+                unsigned long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
+                unsigned long sp;
         } scratch;
-        long pad2;
+        unsigned long pad2;
         struct {
-                long r25, r24, r23, r22, r21, r20;
-                long r19, r18, r17, r16, r15, r14, r13;
+                unsigned long r25, r24, r23, r22, r21, r20;
+                unsigned long r19, r18, r17, r16, r15, r14, r13;
         } callee;
-        long efa;       /* break pt addr, for break points in delay slots */
-        long stop_pc;   /* give dbg stop_pc after ensuring brkpt trap */
+        unsigned long efa;      /* break pt addr, for break points in delay slots */
+        unsigned long stop_pc;  /* give dbg stop_pc after ensuring brkpt trap */
 };
 #endif /* !__ASSEMBLY__ */
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 18cc01591c96..cabde9dc0696 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -47,6 +47,7 @@ static void read_arc_build_cfg_regs(void)
         struct bcr_perip uncached_space;
         struct bcr_generic bcr;
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
+        unsigned long perip_space;
         FIX_PTR(cpu);
 
         READ_BCR(AUX_IDENTITY, cpu->core);
@@ -56,7 +57,12 @@ static void read_arc_build_cfg_regs(void)
         cpu->vec_base = read_aux_reg(AUX_INTR_VEC_BASE);
 
         READ_BCR(ARC_REG_D_UNCACH_BCR, uncached_space);
-        BUG_ON((uncached_space.start << 24) != ARC_UNCACHED_ADDR_SPACE);
+        if (uncached_space.ver < 3)
+                perip_space = uncached_space.start << 24;
+        else
+                perip_space = read_aux_reg(AUX_NON_VOL) & 0xF0000000;
+
+        BUG_ON(perip_space != ARC_UNCACHED_ADDR_SPACE);
 
         READ_BCR(ARC_REG_MUL_BCR, cpu->extn_mpy);
 
@@ -330,6 +336,10 @@ static void arc_chk_core_config(void)
                 pr_warn("CONFIG_ARC_FPU_SAVE_RESTORE needed for working apps\n");
         else if (!cpu->extn.fpu_dp && fpu_enabled)
                 panic("FPU non-existent, disable CONFIG_ARC_FPU_SAVE_RESTORE\n");
+
+        if (is_isa_arcv2() && IS_ENABLED(CONFIG_SMP) && cpu->isa.atomic &&
+            !IS_ENABLED(CONFIG_ARC_STAR_9000923308))
+                panic("llock/scond livelock workaround missing\n");
 }
 
 /*
diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c
index 3364d2bbc515..4294761a2b3e 100644
--- a/arch/arc/kernel/time.c
+++ b/arch/arc/kernel/time.c
@@ -203,34 +203,24 @@ static int arc_clkevent_set_next_event(unsigned long delta,
         return 0;
 }
 
-static void arc_clkevent_set_mode(enum clock_event_mode mode,
-                                  struct clock_event_device *dev)
+static int arc_clkevent_set_periodic(struct clock_event_device *dev)
 {
-        switch (mode) {
-        case CLOCK_EVT_MODE_PERIODIC:
-                /*
-                 * At X Hz, 1 sec = 1000ms -> X cycles;
-                 *                    10ms -> X / 100 cycles
-                 */
-                arc_timer_event_setup(arc_get_core_freq() / HZ);
-                break;
-        case CLOCK_EVT_MODE_ONESHOT:
-                break;
-        default:
-                break;
-        }
-
-        return;
+        /*
+         * At X Hz, 1 sec = 1000ms -> X cycles;
+         *                    10ms -> X / 100 cycles
+         */
+        arc_timer_event_setup(arc_get_core_freq() / HZ);
+        return 0;
 }
 
 static DEFINE_PER_CPU(struct clock_event_device, arc_clockevent_device) = {
-        .name           = "ARC Timer0",
-        .features       = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
-        .mode           = CLOCK_EVT_MODE_UNUSED,
-        .rating         = 300,
-        .irq            = TIMER0_IRQ,   /* hardwired, no need for resources */
-        .set_next_event = arc_clkevent_set_next_event,
-        .set_mode       = arc_clkevent_set_mode,
+        .name                   = "ARC Timer0",
+        .features               = CLOCK_EVT_FEAT_ONESHOT |
+                                  CLOCK_EVT_FEAT_PERIODIC,
+        .rating                 = 300,
+        .irq                    = TIMER0_IRQ,   /* hardwired, no need for resources */
+        .set_next_event         = arc_clkevent_set_next_event,
+        .set_state_periodic     = arc_clkevent_set_periodic,
 };
 
 static irqreturn_t timer_irq_handler(int irq, void *dev_id)
@@ -240,7 +230,7 @@ static irqreturn_t timer_irq_handler(int irq, void *dev_id)
          * irq_set_chip_and_handler() asked for handle_percpu_devid_irq()
          */
         struct clock_event_device *evt = this_cpu_ptr(&arc_clockevent_device);
-        int irq_reenable = evt->mode == CLOCK_EVT_MODE_PERIODIC;
+        int irq_reenable = clockevent_state_periodic(evt);
 
         /*
          * Any write to CTRL reg ACks the interrupt, we rewrite the
diff --git a/arch/arc/lib/memcpy-archs.S b/arch/arc/lib/memcpy-archs.S
index 1b2b3acfed52..0cab0b8a57c5 100644
--- a/arch/arc/lib/memcpy-archs.S
+++ b/arch/arc/lib/memcpy-archs.S
@@ -206,7 +206,7 @@ unalignedOffby3:
         ld.ab   r6, [r1, 4]
         prefetch [r1, 28]       ;Prefetch the next read location
         ld.ab   r8, [r1,4]
-        prefetch [r3, 32]       ;Prefetch the next write location
+        prefetchw [r3, 32]      ;Prefetch the next write location
 
         SHIFT_1 (r7, r6, 8)
         or      r7, r7, r5
diff --git a/arch/arc/lib/memset-archs.S b/arch/arc/lib/memset-archs.S
index 92d573c734b5..365b18364815 100644
--- a/arch/arc/lib/memset-archs.S
+++ b/arch/arc/lib/memset-archs.S
@@ -10,12 +10,6 @@
 
 #undef PREALLOC_NOT_AVAIL
 
-#ifdef PREALLOC_NOT_AVAIL
-#define PREWRITE(A,B)   prefetchw [(A),(B)]
-#else
-#define PREWRITE(A,B)   prealloc [(A),(B)]
-#endif
-
 ENTRY(memset)
         prefetchw [r0]          ; Prefetch the write location
         mov.f   0, r2
@@ -51,9 +45,15 @@ ENTRY(memset)
 
 ;;; Convert len to Dwords, unfold x8
         lsr.f   lp_count, lp_count, 6
+
         lpnz    @.Lset64bytes
         ;; LOOP START
-        PREWRITE(r3, 64)        ;Prefetch the next write location
+#ifdef PREALLOC_NOT_AVAIL
+        prefetchw [r3, 64]      ;Prefetch the next write location
+#else
+        prealloc  [r3, 64]
+#endif
+#ifdef CONFIG_ARC_HAS_LL64
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
@@ -62,16 +62,45 @@ ENTRY(memset)
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
+#else
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+#endif
 .Lset64bytes:
 
         lsr.f   lp_count, r2, 5 ;Last remaining  max 124 bytes
         lpnz    .Lset32bytes
         ;; LOOP START
         prefetchw   [r3, 32]    ;Prefetch the next write location
+#ifdef CONFIG_ARC_HAS_LL64
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
+#else
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+        st.ab   r4, [r3, 4]
+#endif
 .Lset32bytes:
 
         and.f   lp_count, r2, 0x1F ;Last remaining 31 bytes
diff --git a/arch/arc/plat-axs10x/axs10x.c b/arch/arc/plat-axs10x/axs10x.c
index 99f7da513a48..e7769c3ab5f2 100644
--- a/arch/arc/plat-axs10x/axs10x.c
+++ b/arch/arc/plat-axs10x/axs10x.c
@@ -389,6 +389,21 @@ axs103_set_freq(unsigned int id, unsigned int fd, unsigned int od)
 
 static void __init axs103_early_init(void)
 {
+        /*
+         * AXS103 configurations for SMP/QUAD configurations share device tree
+         * which defaults to 90 MHz. However recent failures of Quad config
+         * revealed P&R timing violations so clamp it down to safe 50 MHz
+         * Instead of duplicating defconfig/DT for SMP/QUAD, add a small hack
+         *
+         * This hack is really hacky as of now. Fix it properly by getting the
+         * number of cores as return value of platform's early SMP callback
+         */
+#ifdef CONFIG_ARC_MCIP
+        unsigned int num_cores = (read_aux_reg(ARC_REG_MCIP_BCR) >> 16) & 0x3F;
+        if (num_cores > 2)
+                arc_set_core_freq(50 * 1000000);
+#endif
+
         switch (arc_get_core_freq()/1000000) {
         case 33:
                 axs103_set_freq(1, 1, 1);
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 8f1e25bcecbd..4a0718ccf68e 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1140,6 +1140,7 @@
                                 ctrl-module = <&omap_control_sata>;
                                 clocks = <&sys_clkin1>, <&sata_ref_clk>;
                                 clock-names = "sysclk", "refclk";
+                                syscon-pllreset = <&scm_conf 0x3fc>;
                                 #phy-cells = <0>;
                         };
 
diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
index d7201333e3bc..2db99433e17f 100644
--- a/arch/arm/boot/dts/exynos3250.dtsi
+++ b/arch/arm/boot/dts/exynos3250.dtsi
@@ -138,8 +138,8 @@
 
                 mipi_phy: video-phy@10020710 {
                         compatible = "samsung,s5pv210-mipi-video-phy";
-                        reg = <0x10020710 8>;
                         #phy-cells = <1>;
+                        syscon = <&pmu_system_controller>;
                 };
 
                 pd_cam: cam-power-domain@10023C00 {
diff --git a/arch/arm/boot/dts/exynos4210-origen.dts b/arch/arm/boot/dts/exynos4210-origen.dts
index e0abfc3324d1..e050d85cdacd 100644
--- a/arch/arm/boot/dts/exynos4210-origen.dts
+++ b/arch/arm/boot/dts/exynos4210-origen.dts
@@ -127,6 +127,10 @@
         };
 };
 
+&cpu0 {
+        cpu0-supply = <&buck1_reg>;
+};
+
 &fimd {
         pinctrl-0 = <&lcd_en &lcd_clk &lcd_data24 &pwm0_out>;
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 98f3ce65cb9a..ba34886f8b65 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -188,6 +188,10 @@
         };
 };
 
+&cpu0 {
+        cpu0-supply = <&varm_breg>;
+};
+
 &dsi_0 {
         vddcore-supply = <&vusb_reg>;
         vddio-supply = <&vmipi_reg>;
diff --git a/arch/arm/boot/dts/exynos4210-universal_c210.dts b/arch/arm/boot/dts/exynos4210-universal_c210.dts
index d4f2b11319dd..775892b2cc6a 100644
--- a/arch/arm/boot/dts/exynos4210-universal_c210.dts
+++ b/arch/arm/boot/dts/exynos4210-universal_c210.dts
@@ -548,6 +548,10 @@
         };
 };
 
+&cpu0 {
+        cpu0-supply = <&vdd_arm_reg>;
+};
+
 &pinctrl_1 {
         hdmi_hpd: hdmi-hpd {
                 samsung,pins = "gpx3-7";
diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
index 10d3c173396e..3e5ba665d200 100644
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -40,6 +40,18 @@
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0x900>;
+                        clocks = <&clock CLK_ARM_CLK>;
+                        clock-names = "cpu";
+                        clock-latency = <160000>;
+
+                        operating-points = <
+                                1200000 1250000
+                                1000000 1150000
+                                800000  1075000
+                                500000  975000
+                                400000  975000
+                                200000  950000
+                        >;
                         cooling-min-level = <4>;
                         cooling-max-level = <2>;
                         #cooling-cells = <2>; /* min followed by max */
diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
index b6478e97d6a7..e6540b5cfa4c 100644
--- a/arch/arm/boot/dts/imx35.dtsi
+++ b/arch/arm/boot/dts/imx35.dtsi
@@ -286,8 +286,8 @@
                         can1: can@53fe4000 {
                                 compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan";
                                 reg = <0x53fe4000 0x1000>;
-                                clocks = <&clks 33>;
-                                clock-names = "ipg";
+                                clocks = <&clks 33>, <&clks 33>;
+                                clock-names = "ipg", "per";
                                 interrupts = <43>;
                                 status = "disabled";
                         };
@@ -295,8 +295,8 @@
                         can2: can@53fe8000 {
                                 compatible = "fsl,imx35-flexcan", "fsl,p1010-flexcan";
                                 reg = <0x53fe8000 0x1000>;
-                                clocks = <&clks 34>;
-                                clock-names = "ipg";
+                                clocks = <&clks 34>, <&clks 34>;
+                                clock-names = "ipg", "per";
                                 interrupts = <44>;
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/k2e-clocks.dtsi b/arch/arm/boot/dts/k2e-clocks.dtsi
index 4773d6af66a0..d56d68fe7ffc 100644
--- a/arch/arm/boot/dts/k2e-clocks.dtsi
+++ b/arch/arm/boot/dts/k2e-clocks.dtsi
@@ -13,9 +13,8 @@ clocks {
                 #clock-cells = <0>;
                 compatible = "ti,keystone,main-pll-clock";
                 clocks = <&refclksys>;
-                reg = <0x02620350 4>, <0x02310110 4>;
-                reg-names = "control", "multiplier";
-                fixed-postdiv = <2>;
+                reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
+                reg-names = "control", "multiplier", "post-divider";
         };
 
         papllclk: papllclk@2620358 {
diff --git a/arch/arm/boot/dts/k2hk-clocks.dtsi b/arch/arm/boot/dts/k2hk-clocks.dtsi
index d5adee3c0067..af9b7190533a 100644
--- a/arch/arm/boot/dts/k2hk-clocks.dtsi
+++ b/arch/arm/boot/dts/k2hk-clocks.dtsi
@@ -22,9 +22,8 @@ clocks {
                 #clock-cells = <0>;
                 compatible = "ti,keystone,main-pll-clock";
                 clocks = <&refclksys>;
-                reg = <0x02620350 4>, <0x02310110 4>;
-                reg-names = "control", "multiplier";
-                fixed-postdiv = <2>;
+                reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
+                reg-names = "control", "multiplier", "post-divider";
         };
 
         papllclk: papllclk@2620358 {
diff --git a/arch/arm/boot/dts/k2l-clocks.dtsi b/arch/arm/boot/dts/k2l-clocks.dtsi
index eb1e3e29f073..ef8464bb11ff 100644
--- a/arch/arm/boot/dts/k2l-clocks.dtsi
+++ b/arch/arm/boot/dts/k2l-clocks.dtsi
@@ -22,9 +22,8 @@ clocks {
                 #clock-cells = <0>;
                 compatible = "ti,keystone,main-pll-clock";
                 clocks = <&refclksys>;
-                reg = <0x02620350 4>, <0x02310110 4>;
-                reg-names = "control", "multiplier";
-                fixed-postdiv = <2>;
+                reg = <0x02620350 4>, <0x02310110 4>, <0x02310108 4>;
+                reg-names = "control", "multiplier", "post-divider";
         };
 
         papllclk: papllclk@2620358 {
diff --git a/arch/arm/boot/dts/ste-nomadik-nhk15.dts b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
index 3d0b8755caee..3d25dba143a5 100644
--- a/arch/arm/boot/dts/ste-nomadik-nhk15.dts
+++ b/arch/arm/boot/dts/ste-nomadik-nhk15.dts
@@ -17,6 +17,7 @@
         };
 
         aliases {
+                serial1 = &uart1;
                 stmpe-i2c0 = &stmpe0;
                 stmpe-i2c1 = &stmpe1;
         };
diff --git a/arch/arm/boot/dts/ste-nomadik-s8815.dts b/arch/arm/boot/dts/ste-nomadik-s8815.dts
index 85d3b95dfdba..3c140d05f796 100644
--- a/arch/arm/boot/dts/ste-nomadik-s8815.dts
+++ b/arch/arm/boot/dts/ste-nomadik-s8815.dts
@@ -15,6 +15,10 @@
                 bootargs = "root=/dev/ram0 console=ttyAMA1,115200n8 earlyprintk";
         };
 
+        aliases {
+                serial1 = &uart1;
+        };
+
         src@101e0000 {
                 /* These chrystal drivers are not used on this board */
                 disable-sxtalo;
diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
index 9a5f2ba139b7..ef794a33b4dc 100644
--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
@@ -757,6 +757,7 @@
                         clock-names = "uartclk", "apb_pclk";
                         pinctrl-names = "default";
                         pinctrl-0 = <&uart0_default_mux>;
+                        status = "disabled";
                 };
 
                 uart1: uart@101fb000 {
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index d78c12e7cb5e..486cc4ded190 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2373,6 +2373,9 @@ static int of_dev_hwmod_lookup(struct device_node *np,
  * registers.  This address is needed early so the OCP registers that
  * are part of the device's address space can be ioremapped properly.
  *
+ * If SYSC access is not needed, the registers will not be remapped
+ * and non-availability of MPU access is not treated as an error.
+ *
  * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and
  * -ENXIO on absent or invalid register target address space.
  */
@@ -2387,6 +2390,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
 
         _save_mpu_port_index(oh);
 
+        /* if we don't need sysc access we don't need to ioremap */
+        if (!oh->class->sysc)
+                return 0;
+
+        /* we can't continue without MPU PORT if we need sysc access */
         if (oh->_int_flags & _HWMOD_NO_MPU_PORT)
                 return -ENXIO;
 
@@ -2396,8 +2404,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
                          oh->name);
 
                 /* Extract the IO space from device tree blob */
-                if (!np)
+                if (!np) {
+                        pr_err("omap_hwmod: %s: no dt node\n", oh->name);
                         return -ENXIO;
+                }
 
                 va_start = of_iomap(np, index + oh->mpu_rt_idx);
         } else {
@@ -2456,13 +2466,11 @@ static int __init _init(struct omap_hwmod *oh, void *data)
                                 oh->name, np->name);
         }
 
-        if (oh->class->sysc) {
-                r = _init_mpu_rt_base(oh, NULL, index, np);
-                if (r < 0) {
-                        WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
-                             oh->name);
-                        return 0;
-                }
+        r = _init_mpu_rt_base(oh, NULL, index, np);
+        if (r < 0) {
+                WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
+                     oh->name);
+                return 0;
         }
 
         r = _init_clocks(oh, NULL);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 2606c6608bd8..562247bced49 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -827,8 +827,7 @@ static struct omap_hwmod_class_sysconfig dra7xx_gpmc_sysc = {
         .syss_offs      = 0x0014,
         .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_SIDLEMODE |
                            SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
-        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
-                           SIDLE_SMART_WKUP),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
         .sysc_fields    = &omap_hwmod_sysc_type1,
 };
 
@@ -844,7 +843,7 @@ static struct omap_hwmod dra7xx_gpmc_hwmod = {
         .class          = &dra7xx_gpmc_hwmod_class,
         .clkdm_name     = "l3main1_clkdm",
         /* Skip reset for CONFIG_OMAP_GPMC_DEBUG for bootloader timings */
-        .flags          = HWMOD_SWSUP_SIDLE | DEBUG_OMAP_GPMC_HWMOD_FLAGS,
+        .flags          = DEBUG_OMAP_GPMC_HWMOD_FLAGS,
         .main_clk       = "l3_iclk_div",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index 0689c3fb56e3..58093edeea2e 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -823,7 +823,7 @@
                         device_type = "dma";
                         reg = <0x0 0x1f270000 0x0 0x10000>,
                               <0x0 0x1f200000 0x0 0x10000>,
-                              <0x0 0x1b008000 0x0 0x2000>,
+                              <0x0 0x1b000000 0x0 0x400000>,
                               <0x0 0x1054a000 0x0 0x100>;
                         interrupts = <0x0 0x82 0x4>,
                                      <0x0 0xb8 0x4>,
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 9d4aa18f2a82..e8ca6eaedd02 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -122,12 +122,12 @@ static int __init uefi_init(void)
 
         /* Show what we know for posterity */
         c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
-                             sizeof(vendor));
+                             sizeof(vendor) * sizeof(efi_char16_t));
         if (c16) {
                 for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
                         vendor[i] = c16[i];
                 vendor[i] = '\0';
-                early_memunmap(c16, sizeof(vendor));
+                early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
         }
 
         pr_info("EFI v%u.%.02u by %s\n",
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index 1670f15ef69e..948f0ad2de23 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -168,7 +168,8 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
                  * Other callers might not initialize the si_lsb field,
                  * so check explicitely for the right codes here.
                  */
-                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
+                if (from->si_signo == SIGBUS &&
+                    (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO))
                         err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
 #endif
                 break;
@@ -201,8 +202,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 {
-        memset(to, 0, sizeof *to);
-
         if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) ||
             copy_from_user(to->_sifields._pad,
                            from->_sifields._pad, SI_PAD_SIZE))
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index ec37ab3f524f..97bc68f4c689 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -199,16 +199,15 @@ up_fail:
  */
 void update_vsyscall(struct timekeeper *tk)
 {
-        struct timespec xtime_coarse;
         u32 use_syscall = strcmp(tk->tkr_mono.clock->name, "arch_sys_counter");
 
         ++vdso_data->tb_seq_count;
         smp_wmb();
 
-        xtime_coarse = __current_kernel_time();
         vdso_data->use_syscall                  = use_syscall;
-        vdso_data->xtime_coarse_sec             = xtime_coarse.tv_sec;
-        vdso_data->xtime_coarse_nsec            = xtime_coarse.tv_nsec;
+        vdso_data->xtime_coarse_sec             = tk->xtime_sec;
+        vdso_data->xtime_coarse_nsec            = tk->tkr_mono.xtime_nsec >>
+                                                        tk->tkr_mono.shift;
         vdso_data->wtm_clock_sec                = tk->wall_to_monotonic.tv_sec;
         vdso_data->wtm_clock_nsec               = tk->wall_to_monotonic.tv_nsec;
 
diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
index 23b1a97fae7a..52c179bec0cc 100644
--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
 {
         unsigned long flags;
 
+        if (!clk)
+                return 0;
+
         spin_lock_irqsave(&clk_lock, flags);
         __clk_enable(clk);
         spin_unlock_irqrestore(&clk_lock, flags);
@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
 {
         unsigned long flags;
 
+        if (IS_ERR_OR_NULL(clk))
+                return;
+
         spin_lock_irqsave(&clk_lock, flags);
         __clk_disable(clk);
         spin_unlock_irqrestore(&clk_lock, flags);
@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
         unsigned long flags;
         unsigned long rate;
 
+        if (!clk)
+                return 0;
+
         spin_lock_irqsave(&clk_lock, flags);
         rate = clk->get_rate(clk);
         spin_unlock_irqrestore(&clk_lock, flags);
@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
 {
         unsigned long flags, actual_rate;
 
+        if (!clk)
+                return 0;
+
         if (!clk->set_rate)
                 return -ENOSYS;
 
@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
         unsigned long flags;
         long ret;
 
+        if (!clk)
+                return 0;
+
         if (!clk->set_rate)
                 return -ENOSYS;
 
@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
         unsigned long flags;
         int ret;
 
+        if (!clk)
+                return 0;
+
         if (!clk->set_parent)
                 return -ENOSYS;
 
@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
 
 struct clk *clk_get_parent(struct clk *clk)
 {
-        return clk->parent;
+        return !clk ? NULL : clk->parent;
 }
 EXPORT_SYMBOL(clk_get_parent);
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index cee5f93e5712..199a8357838c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -151,7 +151,6 @@ config BMIPS_GENERIC
         select BCM7120_L2_IRQ
         select BRCMSTB_L2_IRQ
         select IRQ_MIPS_CPU
-        select RAW_IRQ_ACCESSORS
         select DMA_NONCOHERENT
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
index 01a644f174dd..1ba21204ebe0 100644
--- a/arch/mips/ath79/setup.c
+++ b/arch/mips/ath79/setup.c
@@ -190,6 +190,7 @@ int get_c0_perfcount_int(void)
 {
         return ATH79_MISC_IRQ(5);
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 unsigned int get_c0_compare_int(void)
 {
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index 56f5d080ef9d..b7fa9ae28c36 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -42,7 +42,7 @@ static irqreturn_t mailbox_interrupt(int irq, void *dev_id)
         cvmx_write_csr(CVMX_CIU_MBOX_CLRX(coreid), action);
 
         if (action & SMP_CALL_FUNCTION)
-                smp_call_function_interrupt();
+                generic_smp_call_function_interrupt();
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
 
diff --git a/arch/mips/include/asm/mach-bcm63xx/dma-coherence.h b/arch/mips/include/asm/mach-bcm63xx/dma-coherence.h
deleted file mode 100644
index 11d3b572b1b3..000000000000
--- a/arch/mips/include/asm/mach-bcm63xx/dma-coherence.h
+++ /dev/null
@@ -1,10 +0,0 @@
-#ifndef __ASM_MACH_BCM63XX_DMA_COHERENCE_H
-#define __ASM_MACH_BCM63XX_DMA_COHERENCE_H
-
-#include <asm/bmips.h>
-
-#define plat_post_dma_flush     bmips_post_dma_flush
-
-#include <asm/mach-generic/dma-coherence.h>
-
-#endif /* __ASM_MACH_BCM63XX_DMA_COHERENCE_H */
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index 9d8106758142..ae8569475264 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -182,8 +182,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
                  * Make sure the buddy is global too (if it's !none,
                  * it better already be global)
                  */
+#ifdef CONFIG_SMP
+                /*
+                 * For SMP, multiple CPUs can race, so we need to do
+                 * this atomically.
+                 */
+#ifdef CONFIG_64BIT
+#define LL_INSN "lld"
+#define SC_INSN "scd"
+#else /* CONFIG_32BIT */
+#define LL_INSN "ll"
+#define SC_INSN "sc"
+#endif
+                unsigned long page_global = _PAGE_GLOBAL;
+                unsigned long tmp;
+
+                __asm__ __volatile__ (
+                        "       .set    push\n"
+                        "       .set    noreorder\n"
+                        "1:     " LL_INSN "     %[tmp], %[buddy]\n"
+                        "       bnez    %[tmp], 2f\n"
+                        "        or     %[tmp], %[tmp], %[global]\n"
+                        "       " SC_INSN "     %[tmp], %[buddy]\n"
+                        "       beqz    %[tmp], 1b\n"
+                        "        nop\n"
+                        "2:\n"
+                        "       .set pop"
+                        : [buddy] "+m" (buddy->pte),
+                          [tmp] "=&r" (tmp)
+                        : [global] "r" (page_global));
+#else /* !CONFIG_SMP */
                 if (pte_none(*buddy))
                         pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL;
+#endif /* CONFIG_SMP */
         }
 #endif
 }
diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h
index 16f1ea9ab191..03722d4326a1 100644
--- a/arch/mips/include/asm/smp.h
+++ b/arch/mips/include/asm/smp.h
@@ -83,8 +83,6 @@ static inline void __cpu_die(unsigned int cpu)
 extern void play_dead(void);
 #endif
 
-extern asmlinkage void smp_call_function_interrupt(void);
-
 static inline void arch_send_call_function_single_ipi(int cpu)
 {
         extern struct plat_smp_ops *mp_ops;     /* private */
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index 28d6d9364bd1..a71da576883c 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -152,6 +152,31 @@
                 .set    noreorder
                 bltz    k0, 8f
                  move   k1, sp
+#ifdef CONFIG_EVA
+                /*
+                 * Flush interAptiv's Return Prediction Stack (RPS) by writing
+                 * EntryHi. Toggling Config7.RPS is slower and less portable.
+                 *
+                 * The RPS isn't automatically flushed when exceptions are
+                 * taken, which can result in kernel mode speculative accesses
+                 * to user addresses if the RPS mispredicts. That's harmless
+                 * when user and kernel share the same address space, but with
+                 * EVA the same user segments may be unmapped to kernel mode,
+                 * even containing sensitive MMIO regions or invalid memory.
+                 *
+                 * This can happen when the kernel sets the return address to
+                 * ret_from_* and jr's to the exception handler, which looks
+                 * more like a tail call than a function call. If nested calls
+                 * don't evict the last user address in the RPS, it will
+                 * mispredict the return and fetch from a user controlled
+                 * address into the icache.
+                 *
+                 * More recent EVA-capable cores with MAAR to restrict
+                 * speculative accesses aren't affected.
+                 */
+                MFC0    k0, CP0_ENTRYHI
+                MTC0    k0, CP0_ENTRYHI
+#endif
                 .set    reorder
                 /* Called from user mode, new stack. */
                 get_saved_sp
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index 3e4491aa6d6b..789d7bf4fef3 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
                                       unsigned long __user *user_mask_ptr)
 {
         unsigned int real_len;
-        cpumask_t mask;
+        cpumask_t allowed, mask;
         int retval;
         struct task_struct *p;
 
@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
         if (retval)
                 goto out_unlock;
 
-        cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask);
+        cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed);
+        cpumask_and(&mask, &allowed, cpu_active_mask);
 
 out_unlock:
         read_unlock(&tasklist_lock);
diff --git a/arch/mips/kernel/prom.c b/arch/mips/kernel/prom.c
index b130033838ba..5fcec3032f38 100644
--- a/arch/mips/kernel/prom.c
+++ b/arch/mips/kernel/prom.c
@@ -38,7 +38,7 @@ char *mips_get_machine_name(void)
         return mips_machine_name;
 }
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 void __init early_init_dt_add_memory_arch(u64 base, u64 size)
 {
         return add_memory_region(base, size, BOOT_MEM_RAM);
diff --git a/arch/mips/kernel/relocate_kernel.S b/arch/mips/kernel/relocate_kernel.S
index 74bab9ddd0e1..c6bbf2165051 100644
--- a/arch/mips/kernel/relocate_kernel.S
+++ b/arch/mips/kernel/relocate_kernel.S
@@ -24,7 +24,7 @@ LEAF(relocate_new_kernel)
 
 process_entry:
         PTR_L           s2, (s0)
-        PTR_ADD         s0, s0, SZREG
+        PTR_ADDIU       s0, s0, SZREG
 
         /*
          * In case of a kdump/crash kernel, the indirection page is not
@@ -61,9 +61,9 @@ copy_word:
         /* copy page word by word */
         REG_L           s5, (s2)
         REG_S           s5, (s4)
-        PTR_ADD         s4, s4, SZREG
-        PTR_ADD         s2, s2, SZREG
-        LONG_SUB        s6, s6, 1
+        PTR_ADDIU       s4, s4, SZREG
+        PTR_ADDIU       s2, s2, SZREG
+        LONG_ADDIU      s6, s6, -1
         beq             s6, zero, process_entry
         b               copy_word
         b               process_entry
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 19a7705f2a01..5d7f2634996f 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -409,8 +409,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 {
-        memset(to, 0, sizeof *to);
-
         if (copy_from_user(to, from, 3*sizeof(int)) ||
             copy_from_user(to->_sifields._pad,
                            from->_sifields._pad, SI_PAD_SIZE32))
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 336708ae5c5b..78cf8c2f1de0 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -284,7 +284,7 @@ static irqreturn_t bmips5000_ipi_interrupt(int irq, void *dev_id)
         if (action == 0)
                 scheduler_ipi();
         else
-                smp_call_function_interrupt();
+                generic_smp_call_function_interrupt();
 
         return IRQ_HANDLED;
 }
@@ -336,7 +336,7 @@ static irqreturn_t bmips43xx_ipi_interrupt(int irq, void *dev_id)
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
         if (action & SMP_CALL_FUNCTION)
-                smp_call_function_interrupt();
+                generic_smp_call_function_interrupt();
 
         return IRQ_HANDLED;
 }
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index d0744cc77ea7..a31896c33716 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -192,16 +192,6 @@ asmlinkage void start_secondary(void)
         cpu_startup_entry(CPUHP_ONLINE);
 }
 
-/*
- * Call into both interrupt handlers, as we share the IPI for them
- */
-void __irq_entry smp_call_function_interrupt(void)
-{
-        irq_enter();
-        generic_smp_call_function_interrupt();
-        irq_exit();
-}
-
 static void stop_this_cpu(void *dummy)
 {
         /*
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index e207a43b5f8f..8ea28e6ab37d 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -192,6 +192,7 @@ static void show_stacktrace(struct task_struct *task,
 void show_stack(struct task_struct *task, unsigned long *sp)
 {
         struct pt_regs regs;
+        mm_segment_t old_fs = get_fs();
         if (sp) {
                 regs.regs[29] = (unsigned long)sp;
                 regs.regs[31] = 0;
@@ -210,7 +211,13 @@ void show_stack(struct task_struct *task, unsigned long *sp)
                         prepare_frametrace(&regs);
                 }
         }
+        /*
+         * show_stack() deals exclusively with kernel mode, so be sure to access
+         * the stack in the kernel (not user) address space.
+         */
+        set_fs(KERNEL_DS);
         show_stacktrace(task, &regs);
+        set_fs(old_fs);
 }
 
 static void show_code(unsigned int __user *pc)
@@ -1519,6 +1526,7 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
         const int field = 2 * sizeof(unsigned long);
         int multi_match = regs->cp0_status & ST0_TS;
         enum ctx_state prev_state;
+        mm_segment_t old_fs = get_fs();
 
         prev_state = exception_enter();
         show_regs(regs);
@@ -1540,8 +1548,13 @@ asmlinkage void do_mcheck(struct pt_regs *regs)
                 dump_tlb_all();
         }
 
+        if (!user_mode(regs))
+                set_fs(KERNEL_DS);
+
         show_code((unsigned int __user *) regs->cp0_epc);
 
+        set_fs(old_fs);
+
         /*
          * Some chips may have other causes of machine check (e.g. SB1
          * graduation timer)
diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c
index af84bef0c90d..eb3efd137fd1 100644
--- a/arch/mips/kernel/unaligned.c
+++ b/arch/mips/kernel/unaligned.c
@@ -438,7 +438,7 @@ do {                                                        \
                 : "memory");                                \
 } while(0)
 
-#define     StoreDW(addr, value, res) \
+#define     _StoreDW(addr, value, res) \
 do {                                                        \
                 __asm__ __volatile__ (                      \
                         ".set\tpush\n\t"                    \
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index 6ab10573490d..2c218c3bbca5 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -293,7 +293,7 @@ static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 
 static irqreturn_t ipi_call_interrupt(int irq, void *dev_id)
 {
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
         return IRQ_HANDLED;
 }
 
@@ -466,6 +466,7 @@ int get_c0_perfcount_int(void)
 {
         return ltq_perfcount_irq;
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 unsigned int get_c0_compare_int(void)
 {
diff --git a/arch/mips/loongson64/loongson-3/smp.c b/arch/mips/loongson64/loongson-3/smp.c
index 509877c6e9d9..1a4738a8f2d3 100644
--- a/arch/mips/loongson64/loongson-3/smp.c
+++ b/arch/mips/loongson64/loongson-3/smp.c
@@ -266,8 +266,11 @@ void loongson3_ipi_interrupt(struct pt_regs *regs)
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
 
-        if (action & SMP_CALL_FUNCTION)
-                smp_call_function_interrupt();
+        if (action & SMP_CALL_FUNCTION) {
+                irq_enter();
+                generic_smp_call_function_interrupt();
+                irq_exit();
+        }
 
         if (action & SMP_ASK_C0COUNT) {
                 BUG_ON(cpu != 0);
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index 77d96db8253c..aab218c36e0d 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -160,18 +160,18 @@ static inline void setup_protection_map(void)
                 protection_map[1]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC);
                 protection_map[2]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC | _PAGE_NO_READ);
                 protection_map[3]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC);
-                protection_map[4]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_READ);
+                protection_map[4]  = __pgprot(_page_cachable_default | _PAGE_PRESENT);
                 protection_map[5]  = __pgprot(_page_cachable_default | _PAGE_PRESENT);
-                protection_map[6]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_READ);
+                protection_map[6]  = __pgprot(_page_cachable_default | _PAGE_PRESENT);
                 protection_map[7]  = __pgprot(_page_cachable_default | _PAGE_PRESENT);
 
                 protection_map[8]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC | _PAGE_NO_READ);
                 protection_map[9]  = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC);
                 protection_map[10] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC | _PAGE_WRITE | _PAGE_NO_READ);
                 protection_map[11] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_EXEC | _PAGE_WRITE);
-                protection_map[12] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_NO_READ);
+                protection_map[12] = __pgprot(_page_cachable_default | _PAGE_PRESENT);
                 protection_map[13] = __pgprot(_page_cachable_default | _PAGE_PRESENT);
-                protection_map[14] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_WRITE  | _PAGE_NO_READ);
+                protection_map[14] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_WRITE);
                 protection_map[15] = __pgprot(_page_cachable_default | _PAGE_PRESENT | _PAGE_WRITE);
 
         } else {
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 36c0f26fac6b..852a41c6da45 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -133,7 +133,8 @@ good_area:
 #endif
                                 goto bad_area;
                         }
-                        if (!(vma->vm_flags & VM_READ)) {
+                        if (!(vma->vm_flags & VM_READ) &&
+                            exception_epc(regs) != address) {
 #if 0
                                 pr_notice("Cpu%d[%s:%d:%0*lx:%ld:%0*lx] RI violation\n",
                                           raw_smp_processor_id(),
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index d1392f8f5811..fa8f591f3713 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -222,7 +222,7 @@ static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 
 static irqreturn_t ipi_call_interrupt(int irq, void *dev_id)
 {
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
 
         return IRQ_HANDLED;
 }
diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c
index 5625b190edc0..b7bf721eabf5 100644
--- a/arch/mips/mti-malta/malta-time.c
+++ b/arch/mips/mti-malta/malta-time.c
@@ -154,6 +154,7 @@ int get_c0_perfcount_int(void)
 
         return mips_cpu_perf_irq;
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 unsigned int get_c0_compare_int(void)
 {
@@ -171,14 +172,17 @@ unsigned int get_c0_compare_int(void)
 
 static void __init init_rtc(void)
 {
-        /* stop the clock whilst setting it up */
-        CMOS_WRITE(RTC_SET | RTC_24H, RTC_CONTROL);
+        unsigned char freq, ctrl;
 
-        /* 32KHz time base */
-        CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT);
+        /* Set 32KHz time base if not already set */
+        freq = CMOS_READ(RTC_FREQ_SELECT);
+        if ((freq & RTC_DIV_CTL) != RTC_REF_CLCK_32KHZ)
+                CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT);
 
-        /* start the clock */
-        CMOS_WRITE(RTC_24H, RTC_CONTROL);
+        /* Ensure SET bit is clear so RTC can run */
+        ctrl = CMOS_READ(RTC_CONTROL);
+        if (ctrl & RTC_SET)
+                CMOS_WRITE(ctrl & ~RTC_SET, RTC_CONTROL);
 }
 
 void __init plat_time_init(void)
diff --git a/arch/mips/mti-sead3/sead3-time.c b/arch/mips/mti-sead3/sead3-time.c
index e1d69895fb1d..a120b7a5a8fe 100644
--- a/arch/mips/mti-sead3/sead3-time.c
+++ b/arch/mips/mti-sead3/sead3-time.c
@@ -77,6 +77,7 @@ int get_c0_perfcount_int(void)
                 return MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
         return -1;
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 unsigned int get_c0_compare_int(void)
 {
diff --git a/arch/mips/netlogic/common/smp.c b/arch/mips/netlogic/common/smp.c
index dc3e327fbbac..f5fff228b347 100644
--- a/arch/mips/netlogic/common/smp.c
+++ b/arch/mips/netlogic/common/smp.c
@@ -86,7 +86,7 @@ void nlm_smp_function_ipi_handler(unsigned int irq, struct irq_desc *desc)
 {
         clear_c0_eimr(irq);
         ack_c0_eirr(irq);
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
         set_c0_eimr(irq);
 }
 
diff --git a/arch/mips/paravirt/paravirt-smp.c b/arch/mips/paravirt/paravirt-smp.c
index 42181c7105df..f8d3e081b2eb 100644
--- a/arch/mips/paravirt/paravirt-smp.c
+++ b/arch/mips/paravirt/paravirt-smp.c
@@ -114,7 +114,7 @@ static irqreturn_t paravirt_reched_interrupt(int irq, void *dev_id)
 
 static irqreturn_t paravirt_function_interrupt(int irq, void *dev_id)
 {
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
         return IRQ_HANDLED;
 }
 
diff --git a/arch/mips/pistachio/time.c b/arch/mips/pistachio/time.c
index 7c73fcb92a10..8a377346f0ca 100644
--- a/arch/mips/pistachio/time.c
+++ b/arch/mips/pistachio/time.c
@@ -26,6 +26,7 @@ int get_c0_perfcount_int(void)
 {
         return gic_get_c0_perfcount_int();
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 int get_c0_fdc_int(void)
 {
diff --git a/arch/mips/pmcs-msp71xx/msp_smp.c b/arch/mips/pmcs-msp71xx/msp_smp.c
index 10170580a2de..ffa0f7101a97 100644
--- a/arch/mips/pmcs-msp71xx/msp_smp.c
+++ b/arch/mips/pmcs-msp71xx/msp_smp.c
@@ -44,7 +44,7 @@ static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 
 static irqreturn_t ipi_call_interrupt(int irq, void *dev_id)
 {
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
 
         return IRQ_HANDLED;
 }
diff --git a/arch/mips/ralink/irq.c b/arch/mips/ralink/irq.c
index 53707aacc0f8..8c624a8b9ea2 100644
--- a/arch/mips/ralink/irq.c
+++ b/arch/mips/ralink/irq.c
@@ -89,6 +89,7 @@ int get_c0_perfcount_int(void)
 {
         return rt_perfcount_irq;
 }
+EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 
 unsigned int get_c0_compare_int(void)
 {
diff --git a/arch/mips/sgi-ip27/ip27-irq.c b/arch/mips/sgi-ip27/ip27-irq.c
index 3fbaef97a1b8..16ec4e12daa3 100644
--- a/arch/mips/sgi-ip27/ip27-irq.c
+++ b/arch/mips/sgi-ip27/ip27-irq.c
@@ -107,10 +107,14 @@ static void ip27_do_irq_mask0(void)
                 scheduler_ipi();
         } else if (pend0 & (1UL << CPU_CALL_A_IRQ)) {
                 LOCAL_HUB_CLR_INTR(CPU_CALL_A_IRQ);
-                smp_call_function_interrupt();
+                irq_enter();
+                generic_smp_call_function_interrupt();
+                irq_exit();
         } else if (pend0 & (1UL << CPU_CALL_B_IRQ)) {
                 LOCAL_HUB_CLR_INTR(CPU_CALL_B_IRQ);
-                smp_call_function_interrupt();
+                irq_enter();
+                generic_smp_call_function_interrupt();
+                irq_exit();
         } else
 #endif
         {
diff --git a/arch/mips/sibyte/bcm1480/smp.c b/arch/mips/sibyte/bcm1480/smp.c
index af7d44edd9a8..4c71aea25663 100644
--- a/arch/mips/sibyte/bcm1480/smp.c
+++ b/arch/mips/sibyte/bcm1480/smp.c
@@ -29,8 +29,6 @@
 #include <asm/sibyte/bcm1480_regs.h>
 #include <asm/sibyte/bcm1480_int.h>
 
-extern void smp_call_function_interrupt(void);
-
 /*
  * These are routines for dealing with the bcm1480 smp capabilities
  * independent of board/firmware
@@ -184,6 +182,9 @@ void bcm1480_mailbox_interrupt(void)
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
 
-        if (action & SMP_CALL_FUNCTION)
-                smp_call_function_interrupt();
+        if (action & SMP_CALL_FUNCTION) {
+                irq_enter();
+                generic_smp_call_function_interrupt();
+                irq_exit();
+        }
 }
diff --git a/arch/mips/sibyte/sb1250/smp.c b/arch/mips/sibyte/sb1250/smp.c
index c0c4b3f88a08..1cf66f5ff23d 100644
--- a/arch/mips/sibyte/sb1250/smp.c
+++ b/arch/mips/sibyte/sb1250/smp.c
@@ -172,6 +172,9 @@ void sb1250_mailbox_interrupt(void)
         if (action & SMP_RESCHEDULE_YOURSELF)
                 scheduler_ipi();
 
-        if (action & SMP_CALL_FUNCTION)
-                smp_call_function_interrupt();
+        if (action & SMP_CALL_FUNCTION) {
+                irq_enter();
+                generic_smp_call_function_interrupt();
+                irq_exit();
+        }
 }
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index d3a831ac0f92..da50e0c9c57e 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -966,8 +966,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s)
 
 int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)
 {
-        memset(to, 0, sizeof *to);
-
         if (copy_from_user(to, from, 3*sizeof(int)) ||
             copy_from_user(to->_sifields._pad,
                            from->_sifields._pad, SI_PAD_SIZE32))
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
index 5cf5e6ea213b..7cf0df859d05 100644
--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -1478,7 +1478,7 @@ static int pnv_eeh_next_error(struct eeh_pe **pe)
         }
 
         /* Unmask the event */
-        if (eeh_enabled())
+        if (ret == EEH_NEXT_ERR_NONE && eeh_enabled())
                 enable_irq(eeh_event_irq);
 
         return ret;
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 5738d315248b..85cbc96eff6c 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2220,7 +2220,7 @@ static void pnv_pci_ioda_setup_opal_tce_kill(struct pnv_phb *phb)
 
 static __be64 *pnv_pci_ioda2_table_do_alloc_pages(int nid, unsigned shift,
                 unsigned levels, unsigned long limit,
-                unsigned long *current_offset)
+                unsigned long *current_offset, unsigned long *total_allocated)
 {
         struct page *tce_mem = NULL;
         __be64 *addr, *tmp;
@@ -2236,6 +2236,7 @@ static __be64 *pnv_pci_ioda2_table_do_alloc_pages(int nid, unsigned shift,
         }
         addr = page_address(tce_mem);
         memset(addr, 0, allocated);
+        *total_allocated += allocated;
 
         --levels;
         if (!levels) {
@@ -2245,7 +2246,7 @@ static __be64 *pnv_pci_ioda2_table_do_alloc_pages(int nid, unsigned shift,
 
         for (i = 0; i < entries; ++i) {
                 tmp = pnv_pci_ioda2_table_do_alloc_pages(nid, shift,
-                                levels, limit, current_offset);
+                                levels, limit, current_offset, total_allocated);
                 if (!tmp)
                         break;
 
@@ -2267,7 +2268,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
                 struct iommu_table *tbl)
 {
         void *addr;
-        unsigned long offset = 0, level_shift;
+        unsigned long offset = 0, level_shift, total_allocated = 0;
         const unsigned window_shift = ilog2(window_size);
         unsigned entries_shift = window_shift - page_shift;
         unsigned table_shift = max_t(unsigned, entries_shift + 3, PAGE_SHIFT);
@@ -2286,7 +2287,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
 
         /* Allocate TCE table */
         addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
-                        levels, tce_table_size, &offset);
+                        levels, tce_table_size, &offset, &total_allocated);
 
         /* addr==NULL means that the first level allocation failed */
         if (!addr)
@@ -2308,7 +2309,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
                         page_shift);
         tbl->it_level_size = 1ULL << (level_shift - 3);
         tbl->it_indirect_levels = levels - 1;
-        tbl->it_allocated_size = offset;
+        tbl->it_allocated_size = total_allocated;
 
         pr_devel("Created TCE table: ws=%08llx ts=%lx @%08llx\n",
                         window_size, tce_table_size, bus_offset);
diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
index bff5e3b6d822..8ba32436effe 100644
--- a/arch/s390/kernel/cache.c
+++ b/arch/s390/kernel/cache.c
@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
         union cache_topology ct;
         enum cache_type ctype;
 
+        if (!test_facility(34))
+                return -EOPNOTSUPP;
         if (!this_cpu_ci)
                 return -EINVAL;
         ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 2078f92d15ac..f32f843a3631 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1742,10 +1742,10 @@ static bool ibs_enabled(struct kvm_vcpu *vcpu)
 
 static int kvm_s390_handle_requests(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->requests)
-                return 0;
 retry:
         kvm_s390_vcpu_request_handled(vcpu);
+        if (!vcpu->requests)
+                return 0;
         /*
          * We use MMU_RELOAD just to re-arm the ipte notifier for the
          * guest prefix page. gmap_ipte_notify will wait on the ptl lock.
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index fee782acc2ee..8d2e5165865f 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -448,13 +448,13 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
                 EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
                               BPF_REG_1, offsetof(struct sk_buff, data));
         }
-        /* BPF compatibility: clear A (%b7) and X (%b8) registers */
-        if (REG_SEEN(BPF_REG_7))
-                /* lghi %b7,0 */
-                EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
-        if (REG_SEEN(BPF_REG_8))
-                /* lghi %b8,0 */
-                EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
+        /* BPF compatibility: clear A (%b0) and X (%b7) registers */
+        if (REG_SEEN(BPF_REG_A))
+                /* lghi %ba,0 */
+                EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
+        if (REG_SEEN(BPF_REG_X))
+                /* lghi %bx,0 */
+                EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
 }
 
 /*
diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
index 1f0aa2024e94..6424249d5f78 100644
--- a/arch/sparc/include/asm/visasm.h
+++ b/arch/sparc/include/asm/visasm.h
@@ -28,16 +28,10 @@
  * Must preserve %o5 between VISEntryHalf and VISExitHalf */
 
 #define VISEntryHalf                                    \
-        rd              %fprs, %o5;                     \
-        andcc           %o5, FPRS_FEF, %g0;             \
-        be,pt           %icc, 297f;                     \
-         sethi          %hi(298f), %g7;                 \
-        sethi           %hi(VISenterhalf), %g1;         \
-        jmpl            %g1 + %lo(VISenterhalf), %g0;   \
-         or             %g7, %lo(298f), %g7;            \
-        clr             %o5;                            \
-297:    wr              %o5, FPRS_FEF, %fprs;           \
-298:
+        VISEntry
+
+#define VISExitHalf                                     \
+        VISExit
 
 #define VISEntryHalfFast(fail_label)                    \
         rd              %fprs, %o5;                     \
@@ -47,7 +41,7 @@
         ba,a,pt         %xcc, fail_label;               \
 297:    wr              %o5, FPRS_FEF, %fprs;
 
-#define VISExitHalf                                     \
+#define VISExitHalfFast                                 \
         wr              %o5, 0, %fprs;
 
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 140527a20e7d..83aeeb1dffdb 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -240,8 +240,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         add             %o0, 0x40, %o0
         bne,pt          %icc, 1b
          LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
+#ifdef NON_USER_COPY
+        VISExitHalfFast
+#else
         VISExitHalf
-
+#endif
         brz,pn          %o2, .Lexit
          cmp            %o2, 19
         ble,pn          %icc, .Lsmall_unaligned
diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
index b320ae9e2e2e..a063d84336d6 100644
--- a/arch/sparc/lib/VISsave.S
+++ b/arch/sparc/lib/VISsave.S
@@ -44,9 +44,8 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
 
          stx            %g3, [%g6 + TI_GSR]
 2:      add             %g6, %g1, %g3
-        cmp             %o5, FPRS_DU
-        be,pn           %icc, 6f
-         sll            %g1, 3, %g1
+        mov             FPRS_DU | FPRS_DL | FPRS_FEF, %o5
+        sll             %g1, 3, %g1
         stb             %o5, [%g3 + TI_FPSAVED]
         rd              %gsr, %g2
         add             %g6, %g1, %g3
@@ -80,65 +79,3 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
         .align          32
 80:     jmpl            %g7 + %g0, %g0
          nop
-
-6:      ldub            [%g3 + TI_FPSAVED], %o5
-        or              %o5, FPRS_DU, %o5
-        add             %g6, TI_FPREGS+0x80, %g2
-        stb             %o5, [%g3 + TI_FPSAVED]
-
-        sll             %g1, 5, %g1
-        add             %g6, TI_FPREGS+0xc0, %g3
-        wr              %g0, FPRS_FEF, %fprs
-        membar          #Sync
-        stda            %f32, [%g2 + %g1] ASI_BLK_P
-        stda            %f48, [%g3 + %g1] ASI_BLK_P
-        membar          #Sync
-        ba,pt           %xcc, 80f
-         nop
-
-        .align          32
-80:     jmpl            %g7 + %g0, %g0
-         nop
-
-        .align          32
-VISenterhalf:
-        ldub            [%g6 + TI_FPDEPTH], %g1
-        brnz,a,pn       %g1, 1f
-         cmp            %g1, 1
-        stb             %g0, [%g6 + TI_FPSAVED]
-        stx             %fsr, [%g6 + TI_XFSR]
-        clr             %o5
-        jmpl            %g7 + %g0, %g0
-         wr             %g0, FPRS_FEF, %fprs
-
-1:      bne,pn          %icc, 2f
-         srl            %g1, 1, %g1
-        ba,pt           %xcc, vis1
-         sub            %g7, 8, %g7
-2:      addcc           %g6, %g1, %g3
-        sll             %g1, 3, %g1
-        andn            %o5, FPRS_DU, %g2
-        stb             %g2, [%g3 + TI_FPSAVED]
-
-        rd              %gsr, %g2
-        add             %g6, %g1, %g3
-        stx             %g2, [%g3 + TI_GSR]
-        add             %g6, %g1, %g2
-        stx             %fsr, [%g2 + TI_XFSR]
-        sll             %g1, 5, %g1
-3:      andcc           %o5, FPRS_DL, %g0
-        be,pn           %icc, 4f
-         add            %g6, TI_FPREGS, %g2
-
-        add             %g6, TI_FPREGS+0x40, %g3
-        membar          #Sync
-        stda            %f0, [%g2 + %g1] ASI_BLK_P
-        stda            %f16, [%g3 + %g1] ASI_BLK_P
-        membar          #Sync
-        ba,pt           %xcc, 4f
-         nop
-
-        .align          32
-4:      and             %o5, FPRS_DU, %o5
-        jmpl            %g7 + %g0, %g0
-         wr             %o5, FPRS_FEF, %fprs
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
index 1d649a95660c..8069ce12f20b 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -135,10 +135,6 @@ EXPORT_SYMBOL(copy_user_page);
 void VISenter(void);
 EXPORT_SYMBOL(VISenter);
 
-/* CRYPTO code needs this */
-void VISenterhalf(void);
-EXPORT_SYMBOL(VISenterhalf);
-
 extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
 extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
                 unsigned long *);
diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
index e8c2c04143cd..c667e104a0c2 100644
--- a/arch/tile/kernel/compat_signal.c
+++ b/arch/tile/kernel/compat_signal.c
@@ -113,8 +113,6 @@ int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)
         if (!access_ok(VERIFY_READ, from, sizeof(struct compat_siginfo)))
                 return -EFAULT;
 
-        memset(to, 0, sizeof(*to));
-
         err = __get_user(to->si_signo, &from->si_signo);
         err |= __get_user(to->si_errno, &from->si_errno);
         err |= __get_user(to->si_code, &from->si_code);
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index 2c82bd150d43..7d69afd8b6fa 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
                 unsigned int e820_type = 0;
                 unsigned long m = efi->efi_memmap;
 
+#ifdef CONFIG_X86_64
+                m |= (u64)efi->efi_memmap_hi << 32;
+#endif
+
                 d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
                 switch (d->type) {
                 case EFI_RESERVED_TYPE:
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index a0bf89fd2647..4e10d73cf018 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -280,21 +280,6 @@ static inline void clear_LDT(void)
         set_ldt(NULL, 0);
 }
 
-/*
- * load one particular LDT into the current CPU
- */
-static inline void load_LDT_nolock(mm_context_t *pc)
-{
-        set_ldt(pc->ldt, pc->size);
-}
-
-static inline void load_LDT(mm_context_t *pc)
-{
-        preempt_disable();
-        load_LDT_nolock(pc);
-        preempt_enable();
-}
-
 static inline unsigned long get_desc_base(const struct desc_struct *desc)
 {
         return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
index 09b9620a73b4..364d27481a52 100644
--- a/arch/x86/include/asm/mmu.h
+++ b/arch/x86/include/asm/mmu.h
@@ -9,8 +9,7 @@
  * we put the segment information here.
  */
 typedef struct {
-        void *ldt;
-        int size;
+        struct ldt_struct *ldt;
 
 #ifdef CONFIG_X86_64
         /* True if mm supports a task running in 32 bit compatibility mode. */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 804a3a6030ca..984abfe47edc 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -34,6 +34,50 @@ static inline void load_mm_cr4(struct mm_struct *mm) {}
 #endif
 
 /*
+ * ldt_structs can be allocated, used, and freed, but they are never
+ * modified while live.
+ */
+struct ldt_struct {
+        /*
+         * Xen requires page-aligned LDTs with special permissions.  This is
+         * needed to prevent us from installing evil descriptors such as
+         * call gates.  On native, we could merge the ldt_struct and LDT
+         * allocations, but it's not worth trying to optimize.
+         */
+        struct desc_struct *entries;
+        int size;
+};
+
+static inline void load_mm_ldt(struct mm_struct *mm)
+{
+        struct ldt_struct *ldt;
+
+        /* lockless_dereference synchronizes with smp_store_release */
+        ldt = lockless_dereference(mm->context.ldt);
+
+        /*
+         * Any change to mm->context.ldt is followed by an IPI to all
+         * CPUs with the mm active.  The LDT will not be freed until
+         * after the IPI is handled by all such CPUs.  This means that,
+         * if the ldt_struct changes before we return, the values we see
+         * will be safe, and the new values will be loaded before we run
+         * any user code.
+         *
+         * NB: don't try to convert this to use RCU without extreme care.
+         * We would still need IRQs off, because we don't want to change
+         * the local LDT after an IPI loaded a newer value than the one
+         * that we can see.
+         */
+
+        if (unlikely(ldt))
+                set_ldt(ldt->entries, ldt->size);
+        else
+                clear_LDT();
+
+        DEBUG_LOCKS_WARN_ON(preemptible());
+}
+
+/*
  * Used for LDT copy/destruction.
  */
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
@@ -78,12 +122,12 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                  * was called and then modify_ldt changed
                  * prev->context.ldt but suppressed an IPI to this CPU.
                  * In this case, prev->context.ldt != NULL, because we
-                 * never free an LDT while the mm still exists.  That
-                 * means that next->context.ldt != prev->context.ldt,
-                 * because mms never share an LDT.
+                 * never set context.ldt to NULL while the mm still
+                 * exists.  That means that next->context.ldt !=
+                 * prev->context.ldt, because mms never share an LDT.
                  */
                 if (unlikely(prev->context.ldt != next->context.ldt))
-                        load_LDT_nolock(&next->context);
+                        load_mm_ldt(next);
         }
 #ifdef CONFIG_SMP
           else {
@@ -106,7 +150,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                         load_cr3(next->pgd);
                         trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
                         load_mm_cr4(next);
-                        load_LDT_nolock(&next->context);
+                        load_mm_ldt(next);
                 }
         }
 #endif
diff --git a/arch/x86/include/asm/sigcontext.h b/arch/x86/include/asm/sigcontext.h
index 6fe6b182c998..9dfce4e0417d 100644
--- a/arch/x86/include/asm/sigcontext.h
+++ b/arch/x86/include/asm/sigcontext.h
@@ -57,9 +57,9 @@ struct sigcontext {
         unsigned long ip;
         unsigned long flags;
         unsigned short cs;
-        unsigned short __pad2;  /* Was called gs, but was always zero. */
-        unsigned short __pad1;  /* Was called fs, but was always zero. */
-        unsigned short ss;
+        unsigned short gs;
+        unsigned short fs;
+        unsigned short __pad0;
         unsigned long err;
         unsigned long trapno;
         unsigned long oldmask;
diff --git a/arch/x86/include/uapi/asm/sigcontext.h b/arch/x86/include/uapi/asm/sigcontext.h
index 0e8a973de9ee..40836a9a7250 100644
--- a/arch/x86/include/uapi/asm/sigcontext.h
+++ b/arch/x86/include/uapi/asm/sigcontext.h
@@ -177,24 +177,9 @@ struct sigcontext {
         __u64 rip;
         __u64 eflags;           /* RFLAGS */
         __u16 cs;
-
-        /*
-         * Prior to 2.5.64 ("[PATCH] x86-64 updates for 2.5.64-bk3"),
-         * Linux saved and restored fs and gs in these slots.  This
-         * was counterproductive, as fsbase and gsbase were never
-         * saved, so arch_prctl was presumably unreliable.
-         *
-         * If these slots are ever needed for any other purpose, there
-         * is some risk that very old 64-bit binaries could get
-         * confused.  I doubt that many such binaries still work,
-         * though, since the same patch in 2.5.64 also removed the
-         * 64-bit set_thread_area syscall, so it appears that there is
-         * no TLS API that works in both pre- and post-2.5.64 kernels.
-         */
-        __u16 __pad2;           /* Was gs. */
-        __u16 __pad1;           /* Was fs. */
-
-        __u16 ss;
+        __u16 gs;
+        __u16 fs;
+        __u16 __pad0;
         __u64 err;
         __u64 trapno;
         __u64 oldmask;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 845dc0df2002..206052e55517 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -943,7 +943,7 @@ static bool mp_check_pin_attr(int irq, struct irq_alloc_info *info)
          */
         if (irq < nr_legacy_irqs() && data->count == 1) {
                 if (info->ioapic_trigger != data->trigger)
-                        mp_register_handler(irq, data->trigger);
+                        mp_register_handler(irq, info->ioapic_trigger);
                 data->entry.trigger = data->trigger = info->ioapic_trigger;
                 data->entry.polarity = data->polarity = info->ioapic_polarity;
         }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 922c5e0cea4c..cb9e5df42dd2 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1410,7 +1410,7 @@ void cpu_init(void)
         load_sp0(t, &current->thread);
         set_tss_desc(cpu, t);
         load_TR_desc();
-        load_LDT(&init_mm.context);
+        load_mm_ldt(&init_mm);
 
         clear_all_debug_regs();
         dbg_restore_debug_regs();
@@ -1459,7 +1459,7 @@ void cpu_init(void)
         load_sp0(t, thread);
         set_tss_desc(cpu, t);
         load_TR_desc();
-        load_LDT(&init_mm.context);
+        load_mm_ldt(&init_mm);
 
         t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 3658de47900f..9469dfa55607 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -2179,21 +2179,25 @@ static unsigned long get_segment_base(unsigned int segment)
         int idx = segment >> 3;
 
         if ((segment & SEGMENT_TI_MASK) == SEGMENT_LDT) {
+                struct ldt_struct *ldt;
+
                 if (idx > LDT_ENTRIES)
                         return 0;
 
-                if (idx > current->active_mm->context.size)
+                /* IRQs are off, so this synchronizes with smp_store_release */
+                ldt = lockless_dereference(current->active_mm->context.ldt);
+                if (!ldt || idx > ldt->size)
                         return 0;
 
-                desc = current->active_mm->context.ldt;
+                desc = &ldt->entries[idx];
         } else {
                 if (idx > GDT_ENTRIES)
                         return 0;
 
-                desc = raw_cpu_ptr(gdt_page.gdt);
+                desc = raw_cpu_ptr(gdt_page.gdt) + idx;
         }
 
-        return get_desc_base(desc + idx);
+        return get_desc_base(desc);
 }
 
 #ifdef CONFIG_COMPAT
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index c37886d759cc..2bcc0525f1c1 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -12,6 +12,7 @@
 #include <linux/string.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/uaccess.h>
 
@@ -20,82 +21,82 @@
 #include <asm/mmu_context.h>
 #include <asm/syscalls.h>
 
-#ifdef CONFIG_SMP
+/* context.lock is held for us, so we don't need any locking. */
 static void flush_ldt(void *current_mm)
 {
-        if (current->active_mm == current_mm)
-                load_LDT(&current->active_mm->context);
+        mm_context_t *pc;
+
+        if (current->active_mm != current_mm)
+                return;
+
+        pc = &current->active_mm->context;
+        set_ldt(pc->ldt->entries, pc->ldt->size);
 }
-#endif
 
-static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
+/* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */
+static struct ldt_struct *alloc_ldt_struct(int size)
 {
-        void *oldldt, *newldt;
-        int oldsize;
-
-        if (mincount <= pc->size)
-                return 0;
-        oldsize = pc->size;
-        mincount = (mincount + (PAGE_SIZE / LDT_ENTRY_SIZE - 1)) &
-                        (~(PAGE_SIZE / LDT_ENTRY_SIZE - 1));
-        if (mincount * LDT_ENTRY_SIZE > PAGE_SIZE)
-                newldt = vmalloc(mincount * LDT_ENTRY_SIZE);
+        struct ldt_struct *new_ldt;
+        int alloc_size;
+
+        if (size > LDT_ENTRIES)
+                return NULL;
+
+        new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL);
+        if (!new_ldt)
+                return NULL;
+
+        BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct));
+        alloc_size = size * LDT_ENTRY_SIZE;
+
+        /*
+         * Xen is very picky: it requires a page-aligned LDT that has no
+         * trailing nonzero bytes in any page that contains LDT descriptors.
+         * Keep it simple: zero the whole allocation and never allocate less
+         * than PAGE_SIZE.
+         */
+        if (alloc_size > PAGE_SIZE)
+                new_ldt->entries = vzalloc(alloc_size);
         else
-                newldt = (void *)__get_free_page(GFP_KERNEL);
-
-        if (!newldt)
-                return -ENOMEM;
+                new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
 
-        if (oldsize)
-                memcpy(newldt, pc->ldt, oldsize * LDT_ENTRY_SIZE);
-        oldldt = pc->ldt;
-        memset(newldt + oldsize * LDT_ENTRY_SIZE, 0,
-               (mincount - oldsize) * LDT_ENTRY_SIZE);
+        if (!new_ldt->entries) {
+                kfree(new_ldt);
+                return NULL;
+        }
 
-        paravirt_alloc_ldt(newldt, mincount);
+        new_ldt->size = size;
+        return new_ldt;
+}
 
-#ifdef CONFIG_X86_64
-        /* CHECKME: Do we really need this ? */
-        wmb();
-#endif
-        pc->ldt = newldt;
-        wmb();
-        pc->size = mincount;
-        wmb();
-
-        if (reload) {
-#ifdef CONFIG_SMP
-                preempt_disable();
-                load_LDT(pc);
-                if (!cpumask_equal(mm_cpumask(current->mm),
-                                   cpumask_of(smp_processor_id())))
-                        smp_call_function(flush_ldt, current->mm, 1);
-                preempt_enable();
-#else
-                load_LDT(pc);
-#endif
-        }
-        if (oldsize) {
-                paravirt_free_ldt(oldldt, oldsize);
-                if (oldsize * LDT_ENTRY_SIZE > PAGE_SIZE)
-                        vfree(oldldt);
-                else
-                        put_page(virt_to_page(oldldt));
-        }
-        return 0;
+/* After calling this, the LDT is immutable. */
+static void finalize_ldt_struct(struct ldt_struct *ldt)
+{
+        paravirt_alloc_ldt(ldt->entries, ldt->size);
 }
 
-static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+/* context.lock is held */
+static void install_ldt(struct mm_struct *current_mm,
+                        struct ldt_struct *ldt)
 {
-        int err = alloc_ldt(new, old->size, 0);
-        int i;
+        /* Synchronizes with lockless_dereference in load_mm_ldt. */
+        smp_store_release(&current_mm->context.ldt, ldt);
+
+        /* Activate the LDT for all CPUs using current_mm. */
+        on_each_cpu_mask(mm_cpumask(current_mm), flush_ldt, current_mm, true);
+}
 
-        if (err < 0)
-                return err;
+static void free_ldt_struct(struct ldt_struct *ldt)
+{
+        if (likely(!ldt))
+                return;
 
-        for (i = 0; i < old->size; i++)
-                write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-        return 0;
+        paravirt_free_ldt(ldt->entries, ldt->size);
+        if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
+                vfree(ldt->entries);
+        else
+                kfree(ldt->entries);
+        kfree(ldt);
 }
 
 /*
@@ -104,17 +105,37 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
  */
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
 {
+        struct ldt_struct *new_ldt;
         struct mm_struct *old_mm;
         int retval = 0;
 
         mutex_init(&mm->context.lock);
-        mm->context.size = 0;
         old_mm = current->mm;
-        if (old_mm && old_mm->context.size > 0) {
-                mutex_lock(&old_mm->context.lock);
-                retval = copy_ldt(&mm->context, &old_mm->context);
-                mutex_unlock(&old_mm->context.lock);
+        if (!old_mm) {
+                mm->context.ldt = NULL;
+                return 0;
         }
+
+        mutex_lock(&old_mm->context.lock);
+        if (!old_mm->context.ldt) {
+                mm->context.ldt = NULL;
+                goto out_unlock;
+        }
+
+        new_ldt = alloc_ldt_struct(old_mm->context.ldt->size);
+        if (!new_ldt) {
+                retval = -ENOMEM;
+                goto out_unlock;
+        }
+
+        memcpy(new_ldt->entries, old_mm->context.ldt->entries,
+               new_ldt->size * LDT_ENTRY_SIZE);
+        finalize_ldt_struct(new_ldt);
+
+        mm->context.ldt = new_ldt;
+
+out_unlock:
+        mutex_unlock(&old_mm->context.lock);
         return retval;
 }
 
@@ -125,53 +146,47 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
  */
 void destroy_context(struct mm_struct *mm)
 {
-        if (mm->context.size) {
-#ifdef CONFIG_X86_32
-                /* CHECKME: Can this ever happen ? */
-                if (mm == current->active_mm)
-                        clear_LDT();
-#endif
-                paravirt_free_ldt(mm->context.ldt, mm->context.size);
-                if (mm->context.size * LDT_ENTRY_SIZE > PAGE_SIZE)
-                        vfree(mm->context.ldt);
-                else
-                        put_page(virt_to_page(mm->context.ldt));
-                mm->context.size = 0;
-        }
+        free_ldt_struct(mm->context.ldt);
+        mm->context.ldt = NULL;
 }
 
 static int read_ldt(void __user *ptr, unsigned long bytecount)
 {
-        int err;
+        int retval;
         unsigned long size;
         struct mm_struct *mm = current->mm;
 
-        if (!mm->context.size)
-                return 0;
+        mutex_lock(&mm->context.lock);
+
+        if (!mm->context.ldt) {
+                retval = 0;
+                goto out_unlock;
+        }
+
         if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES)
                 bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES;
 
-        mutex_lock(&mm->context.lock);
-        size = mm->context.size * LDT_ENTRY_SIZE;
+        size = mm->context.ldt->size * LDT_ENTRY_SIZE;
         if (size > bytecount)
                 size = bytecount;
 
-        err = 0;
-        if (copy_to_user(ptr, mm->context.ldt, size))
-                err = -EFAULT;
-        mutex_unlock(&mm->context.lock);
-        if (err < 0)
-                goto error_return;
+        if (copy_to_user(ptr, mm->context.ldt->entries, size)) {
+                retval = -EFAULT;
+                goto out_unlock;
+        }
+
         if (size != bytecount) {
-                /* zero-fill the rest */
-                if (clear_user(ptr + size, bytecount - size) != 0) {
-                        err = -EFAULT;
-                        goto error_return;
+                /* Zero-fill the rest and pretend we read bytecount bytes. */
+                if (clear_user(ptr + size, bytecount - size)) {
+                        retval = -EFAULT;
+                        goto out_unlock;
                 }
         }
-        return bytecount;
-error_return:
-        return err;
+        retval = bytecount;
+
+out_unlock:
+        mutex_unlock(&mm->context.lock);
+        return retval;
 }
 
 static int read_default_ldt(void __user *ptr, unsigned long bytecount)
@@ -195,6 +210,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
         struct desc_struct ldt;
         int error;
         struct user_desc ldt_info;
+        int oldsize, newsize;
+        struct ldt_struct *new_ldt, *old_ldt;
 
         error = -EINVAL;
         if (bytecount != sizeof(ldt_info))
@@ -213,34 +230,39 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
                         goto out;
         }
 
-        mutex_lock(&mm->context.lock);
-        if (ldt_info.entry_number >= mm->context.size) {
-                error = alloc_ldt(&current->mm->context,
-                                  ldt_info.entry_number + 1, 1);
-                if (error < 0)
-                        goto out_unlock;
-        }
-
-        /* Allow LDTs to be cleared by the user. */
-        if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
-                if (oldmode || LDT_empty(&ldt_info)) {
-                        memset(&ldt, 0, sizeof(ldt));
-                        goto install;
+        if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
+            LDT_empty(&ldt_info)) {
+                /* The user wants to clear the entry. */
+                memset(&ldt, 0, sizeof(ldt));
+        } else {
+                if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+                        error = -EINVAL;
+                        goto out;
                 }
+
+                fill_ldt(&ldt, &ldt_info);
+                if (oldmode)
+                        ldt.avl = 0;
         }
 
-        if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
-                error = -EINVAL;
+        mutex_lock(&mm->context.lock);
+
+        old_ldt = mm->context.ldt;
+        oldsize = old_ldt ? old_ldt->size : 0;
+        newsize = max((int)(ldt_info.entry_number + 1), oldsize);
+
+        error = -ENOMEM;
+        new_ldt = alloc_ldt_struct(newsize);
+        if (!new_ldt)
                 goto out_unlock;
-        }
 
-        fill_ldt(&ldt, &ldt_info);
-        if (oldmode)
-                ldt.avl = 0;
+        if (old_ldt)
+                memcpy(new_ldt->entries, old_ldt->entries, oldsize * LDT_ENTRY_SIZE);
+        new_ldt->entries[ldt_info.entry_number] = ldt;
+        finalize_ldt_struct(new_ldt);
 
-        /* Install the new entry ...  */
-install:
-        write_ldt_entry(mm->context.ldt, ldt_info.entry_number, &ldt);
+        install_ldt(mm, new_ldt);
+        free_ldt_struct(old_ldt);
         error = 0;
 
 out_unlock:
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 71d7849a07f7..f6b916387590 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -121,11 +121,11 @@ void __show_regs(struct pt_regs *regs, int all)
 void release_thread(struct task_struct *dead_task)
 {
         if (dead_task->mm) {
-                if (dead_task->mm->context.size) {
+                if (dead_task->mm->context.ldt) {
                         pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n",
                                 dead_task->comm,
                                 dead_task->mm->context.ldt,
-                                dead_task->mm->context.size);
+                                dead_task->mm->context.ldt->size);
                         BUG();
                 }
         }
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 206996c1669d..71820c42b6ce 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -93,8 +93,15 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 COPY(r15);
 #endif /* CONFIG_X86_64 */
 
+#ifdef CONFIG_X86_32
                 COPY_SEG_CPL3(cs);
                 COPY_SEG_CPL3(ss);
+#else /* !CONFIG_X86_32 */
+                /* Kernel saves and restores only the CS segment register on signals,
+                 * which is the bare minimum needed to allow mixed 32/64-bit code.
+                 * App's signal handler can save/restore other segments if needed. */
+                COPY_SEG_CPL3(cs);
+#endif /* CONFIG_X86_32 */
 
                 get_user_ex(tmpflags, &sc->flags);
                 regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
@@ -154,9 +161,8 @@ int setup_sigcontext(struct sigcontext __user *sc, void __user *fpstate,
 #else /* !CONFIG_X86_32 */
                 put_user_ex(regs->flags, &sc->flags);
                 put_user_ex(regs->cs, &sc->cs);
-                put_user_ex(0, &sc->__pad2);
-                put_user_ex(0, &sc->__pad1);
-                put_user_ex(regs->ss, &sc->ss);
+                put_user_ex(0, &sc->gs);
+                put_user_ex(0, &sc->fs);
 #endif /* CONFIG_X86_32 */
 
                 put_user_ex(fpstate, &sc->fpstate);
@@ -451,19 +457,9 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
 
         regs->sp = (unsigned long)frame;
 
-        /*
-         * Set up the CS and SS registers to run signal handlers in
-         * 64-bit mode, even if the handler happens to be interrupting
-         * 32-bit or 16-bit code.
-         *
-         * SS is subtle.  In 64-bit mode, we don't need any particular
-         * SS descriptor, but we do need SS to be valid.  It's possible
-         * that the old SS is entirely bogus -- this can happen if the
-         * signal we're trying to deliver is #GP or #SS caused by a bad
-         * SS value.
-         */
+        /* Set up the CS register to run signal handlers in 64-bit mode,
+           even if the handler happens to be interrupting 32-bit code. */
         regs->cs = __USER_CS;
-        regs->ss = __USER_DS;
 
         return 0;
 }
diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
index 9b4d51d0c0d0..6273324186ac 100644
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -5,6 +5,7 @@
 #include <linux/mm.h>
 #include <linux/ptrace.h>
 #include <asm/desc.h>
+#include <asm/mmu_context.h>
 
 unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
 {
@@ -30,10 +31,11 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
                 seg &= ~7UL;
 
                 mutex_lock(&child->mm->context.lock);
-                if (unlikely((seg >> 3) >= child->mm->context.size))
+                if (unlikely(!child->mm->context.ldt ||
+                             (seg >> 3) >= child->mm->context.ldt->size))
                         addr = -1L; /* bogus selector, access would fault */
                 else {
-                        desc = child->mm->context.ldt + seg;
+                        desc = &child->mm->context.ldt->entries[seg];
                         base = get_desc_base(desc);
 
                         /* 16-bit code segment? */
diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
index dc0a84a6f309..9e8bf13572e6 100644
--- a/arch/x86/kvm/mtrr.c
+++ b/arch/x86/kvm/mtrr.c
@@ -672,16 +672,16 @@ u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
         if (iter.mtrr_disabled)
                 return mtrr_disabled_type();
 
+        /* not contained in any MTRRs. */
+        if (type == -1)
+                return mtrr_default_type(mtrr_state);
+
         /*
          * We just check one page, partially covered by MTRRs is
          * impossible.
          */
         WARN_ON(iter.partial_map);
 
-        /* not contained in any MTRRs. */
-        if (type == -1)
-                return mtrr_default_type(mtrr_state);
-
         return type;
 }
 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 579a8fd74be0..be2e7a2b10d7 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -269,7 +269,7 @@ static void emit_bpf_tail_call(u8 **pprog)
         EMIT4(0x48, 0x8B, 0x46,                   /* mov rax, qword ptr [rsi + 16] */
               offsetof(struct bpf_array, map.max_entries));
         EMIT3(0x48, 0x39, 0xD0);                  /* cmp rax, rdx */
-#define OFFSET1 44 /* number of bytes to jump */
+#define OFFSET1 47 /* number of bytes to jump */
         EMIT2(X86_JBE, OFFSET1);                  /* jbe out */
         label1 = cnt;
 
@@ -278,15 +278,15 @@ static void emit_bpf_tail_call(u8 **pprog)
          */
         EMIT2_off32(0x8B, 0x85, -STACKSIZE + 36); /* mov eax, dword ptr [rbp - 516] */
         EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT);     /* cmp eax, MAX_TAIL_CALL_CNT */
-#define OFFSET2 33
+#define OFFSET2 36
         EMIT2(X86_JA, OFFSET2);                   /* ja out */
         label2 = cnt;
         EMIT3(0x83, 0xC0, 0x01);                  /* add eax, 1 */
         EMIT2_off32(0x89, 0x85, -STACKSIZE + 36); /* mov dword ptr [rbp - 516], eax */
 
         /* prog = array->prog[index]; */
-        EMIT4(0x48, 0x8D, 0x44, 0xD6);            /* lea rax, [rsi + rdx * 8 + 0x50] */
-        EMIT1(offsetof(struct bpf_array, prog));
+        EMIT4_off32(0x48, 0x8D, 0x84, 0xD6,       /* lea rax, [rsi + rdx * 8 + offsetof(...)] */
+                    offsetof(struct bpf_array, prog));
         EMIT3(0x48, 0x8B, 0x00);                  /* mov rax, qword ptr [rax] */
 
         /* if (prog == NULL)
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index cfba30f27392..e4308fe6afe8 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -972,6 +972,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
 
 static int __init arch_parse_efi_cmdline(char *str)
 {
+        if (!str) {
+                pr_warn("need at least one option\n");
+                return -EINVAL;
+        }
+
         if (parse_option_str(str, "old_map"))
                 set_bit(EFI_OLD_MEMMAP, &efi.flags);
         if (parse_option_str(str, "debug"))
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 0d7dd1f5ac36..9ab52791fed5 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -22,6 +22,7 @@
 #include <asm/fpu/internal.h>
 #include <asm/debugreg.h>
 #include <asm/cpu.h>
+#include <asm/mmu_context.h>
 
 #ifdef CONFIG_X86_32
 __visible unsigned long saved_context_ebx;
@@ -153,7 +154,7 @@ static void fix_processor_context(void)
         syscall_init();                         /* This sets MSR_*STAR and related */
 #endif
         load_TR_desc();                         /* This does ltr */
-        load_LDT(&current->active_mm->context); /* This does lldt */
+        load_mm_ldt(current->active_mm);        /* This does lldt */
 
         fpu__resume_cpu();
 }
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 7322755f337a..4b6e29ac0968 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -13,13 +13,13 @@ CFLAGS_mmu.o			:= $(nostackp)
 obj-y           := enlighten.o setup.o multicalls.o mmu.o irq.o \
                         time.o xen-asm.o xen-asm_$(BITS).o \
                         grant-table.o suspend.o platform-pci-unplug.o \
-                        p2m.o
+                        p2m.o apic.o
 
 obj-$(CONFIG_EVENT_TRACING) += trace.o
 
 obj-$(CONFIG_SMP)               += smp.o
 obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
 obj-$(CONFIG_XEN_DEBUG_FS)      += debugfs.o
-obj-$(CONFIG_XEN_DOM0)          += apic.o vga.o
+obj-$(CONFIG_XEN_DOM0)          += vga.o
 obj-$(CONFIG_SWIOTLB_XEN)       += pci-swiotlb-xen.o
 obj-$(CONFIG_XEN_EFI)           += efi.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0b95c9b8283f..11d6fb4e8483 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -483,6 +483,7 @@ static void set_aliased_prot(void *v, pgprot_t prot)
         pte_t pte;
         unsigned long pfn;
         struct page *page;
+        unsigned char dummy;
 
         ptep = lookup_address((unsigned long)v, &level);
         BUG_ON(ptep == NULL);
@@ -492,6 +493,32 @@ static void set_aliased_prot(void *v, pgprot_t prot)
 
         pte = pfn_pte(pfn, prot);
 
+        /*
+         * Careful: update_va_mapping() will fail if the virtual address
+         * we're poking isn't populated in the page tables.  We don't
+         * need to worry about the direct map (that's always in the page
+         * tables), but we need to be careful about vmap space.  In
+         * particular, the top level page table can lazily propagate
+         * entries between processes, so if we've switched mms since we
+         * vmapped the target in the first place, we might not have the
+         * top-level page table entry populated.
+         *
+         * We disable preemption because we want the same mm active when
+         * we probe the target and when we issue the hypercall.  We'll
+         * have the same nominal mm, but if we're a kernel thread, lazy
+         * mm dropping could change our pgd.
+         *
+         * Out of an abundance of caution, this uses __get_user() to fault
+         * in the target address just in case there's some obscure case
+         * in which the target address isn't readable.
+         */
+
+        preempt_disable();
+
+        pagefault_disable();    /* Avoid warnings due to being atomic. */
+        __get_user(dummy, (unsigned char __user __force *)v);
+        pagefault_enable();
+
         if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0))
                 BUG();
 
@@ -503,6 +530,8 @@ static void set_aliased_prot(void *v, pgprot_t prot)
                                 BUG();
         } else
                 kmap_flush_unused();
+
+        preempt_enable();
 }
 
 static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
@@ -510,6 +539,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
         const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE;
         int i;
 
+        /*
+         * We need to mark the all aliases of the LDT pages RO.  We
+         * don't need to call vm_flush_aliases(), though, since that's
+         * only responsible for flushing aliases out the TLBs, not the
+         * page tables, and Xen will flush the TLB for us if needed.
+         *
+         * To avoid confusing future readers: none of this is necessary
+         * to load the LDT.  The hypervisor only checks this when the
+         * LDT is faulted in due to subsequent descriptor access.
+         */
+
         for(i = 0; i < entries; i += entries_per_page)
                 set_aliased_prot(ldt + i, PAGE_KERNEL_RO);
 }
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index c20fe29e65f4..2292721b1d10 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -101,17 +101,15 @@ struct dom0_vga_console_info;
 
 #ifdef CONFIG_XEN_DOM0
 void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size);
-void __init xen_init_apic(void);
 #else
 static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
                                        size_t size)
 {
 }
-static inline void __init xen_init_apic(void)
-{
-}
 #endif
 
+void __init xen_init_apic(void);
+
 #ifdef CONFIG_XEN_EFI
 extern void xen_efi_init(void);
 #else
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 717afcdb5f4a..88dbbb115285 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -231,7 +231,7 @@ int acpi_device_set_power(struct acpi_device *device, int state)
                 dev_warn(&device->dev, "Failed to change power state to %s\n",
                          acpi_power_state_string(state));
         } else {
-                device->power.state = state;
+                device->power.state = target_state;
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Device [%s] transitioned to %s\n",
                                   device->pnp.bus_id,
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index 81751a49d8bf..56486d92c4e7 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -296,11 +296,20 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
         if (!blk)
                 return -ENOMEM;
 
-        present = krealloc(rbnode->cache_present,
-                    BITS_TO_LONGS(blklen) * sizeof(*present), GFP_KERNEL);
-        if (!present) {
-                kfree(blk);
-                return -ENOMEM;
+        if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
+                present = krealloc(rbnode->cache_present,
+                                   BITS_TO_LONGS(blklen) * sizeof(*present),
+                                   GFP_KERNEL);
+                if (!present) {
+                        kfree(blk);
+                        return -ENOMEM;
+                }
+
+                memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
+                       (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
+                       * sizeof(*present));
+        } else {
+                present = rbnode->cache_present;
         }
 
         /* insert the register value in the correct place in the rbnode block */
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index d94529d5c8e9..bc67a93aa4f4 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -523,6 +523,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...)
 #  define rbd_assert(expr)      ((void) 0)
 #endif /* !RBD_DEBUG */
 
+static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request);
 static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request);
 static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
@@ -1818,6 +1819,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request)
         obj_request_done_set(obj_request);
 }
 
+static void rbd_osd_call_callback(struct rbd_obj_request *obj_request)
+{
+        dout("%s: obj %p\n", __func__, obj_request);
+
+        if (obj_request_img_data_test(obj_request))
+                rbd_osd_copyup_callback(obj_request);
+        else
+                obj_request_done_set(obj_request);
+}
+
 static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
                                 struct ceph_msg *msg)
 {
@@ -1866,6 +1877,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
                 rbd_osd_discard_callback(obj_request);
                 break;
         case CEPH_OSD_OP_CALL:
+                rbd_osd_call_callback(obj_request);
+                break;
         case CEPH_OSD_OP_NOTIFY_ACK:
         case CEPH_OSD_OP_WATCH:
                 rbd_osd_trivial_callback(obj_request);
@@ -2530,13 +2543,15 @@ out_unwind:
 }
 
 static void
-rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
+rbd_osd_copyup_callback(struct rbd_obj_request *obj_request)
 {
         struct rbd_img_request *img_request;
         struct rbd_device *rbd_dev;
         struct page **pages;
         u32 page_count;
 
+        dout("%s: obj %p\n", __func__, obj_request);
+
         rbd_assert(obj_request->type == OBJ_REQUEST_BIO ||
                 obj_request->type == OBJ_REQUEST_NODATA);
         rbd_assert(obj_request_img_data_test(obj_request));
@@ -2563,9 +2578,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
         if (!obj_request->result)
                 obj_request->xferred = obj_request->length;
 
-        /* Finish up with the normal image object callback */
-
-        rbd_img_obj_callback(obj_request);
+        obj_request_done_set(obj_request);
 }
 
 static void
@@ -2650,7 +2663,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
 
         /* All set, send it off. */
 
-        orig_request->callback = rbd_img_obj_copyup_callback;
         osdc = &rbd_dev->rbd_client->client->osdc;
         img_result = rbd_obj_request_submit(osdc, orig_request);
         if (!img_result)
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index da8faf78536a..5643b65cee20 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -429,7 +429,7 @@ static int hwrng_fillfn(void *unused)
 static void start_khwrngd(void)
 {
         hwrng_fill = kthread_run(hwrng_fillfn, NULL, "hwrng");
-        if (hwrng_fill == ERR_PTR(-ENOMEM)) {
+        if (IS_ERR(hwrng_fill)) {
                 pr_err("hwrng_fill thread creation failed");
                 hwrng_fill = NULL;
         }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 26063afb3eba..7a3c30c4336f 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1002,7 +1002,7 @@ static int cpufreq_add_dev_symlink(struct cpufreq_policy *policy)
         int ret = 0;
 
         /* Some related CPUs might not be present (physically hotplugged) */
-        for_each_cpu_and(j, policy->related_cpus, cpu_present_mask) {
+        for_each_cpu(j, policy->real_cpus) {
                 if (j == policy->kobj_cpu)
                         continue;
 
@@ -1019,7 +1019,7 @@ static void cpufreq_remove_dev_symlink(struct cpufreq_policy *policy)
         unsigned int j;
 
         /* Some related CPUs might not be present (physically hotplugged) */
-        for_each_cpu_and(j, policy->related_cpus, cpu_present_mask) {
+        for_each_cpu(j, policy->real_cpus) {
                 if (j == policy->kobj_cpu)
                         continue;
 
@@ -1163,11 +1163,14 @@ static struct cpufreq_policy *cpufreq_policy_alloc(struct device *dev)
         if (!zalloc_cpumask_var(&policy->related_cpus, GFP_KERNEL))
                 goto err_free_cpumask;
 
+        if (!zalloc_cpumask_var(&policy->real_cpus, GFP_KERNEL))
+                goto err_free_rcpumask;
+
         ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &dev->kobj,
                                    "cpufreq");
         if (ret) {
                 pr_err("%s: failed to init policy->kobj: %d\n", __func__, ret);
-                goto err_free_rcpumask;
+                goto err_free_real_cpus;
         }
 
         INIT_LIST_HEAD(&policy->policy_list);
@@ -1184,6 +1187,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(struct device *dev)
 
         return policy;
 
+err_free_real_cpus:
+        free_cpumask_var(policy->real_cpus);
 err_free_rcpumask:
         free_cpumask_var(policy->related_cpus);
 err_free_cpumask:
@@ -1234,6 +1239,7 @@ static void cpufreq_policy_free(struct cpufreq_policy *policy, bool notify)
         write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
         cpufreq_policy_put_kobj(policy, notify);
+        free_cpumask_var(policy->real_cpus);
         free_cpumask_var(policy->related_cpus);
         free_cpumask_var(policy->cpus);
         kfree(policy);
@@ -1258,14 +1264,17 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 
         pr_debug("adding CPU %u\n", cpu);
 
-        /*
-         * Only possible if 'cpu' wasn't physically present earlier and we are
-         * here from subsys_interface add callback. A hotplug notifier will
-         * follow and we will handle it like logical CPU hotplug then. For now,
-         * just create the sysfs link.
-         */
-        if (cpu_is_offline(cpu))
-                return add_cpu_dev_symlink(per_cpu(cpufreq_cpu_data, cpu), cpu);
+        if (cpu_is_offline(cpu)) {
+                /*
+                 * Only possible if we are here from the subsys_interface add
+                 * callback.  A hotplug notifier will follow and we will handle
+                 * it as CPU online then.  For now, just create the sysfs link,
+                 * unless there is no policy or the link is already present.
+                 */
+                policy = per_cpu(cpufreq_cpu_data, cpu);
+                return policy && !cpumask_test_and_set_cpu(cpu, policy->real_cpus)
+                        ? add_cpu_dev_symlink(policy, cpu) : 0;
+        }
 
         if (!down_read_trylock(&cpufreq_rwsem))
                 return 0;
@@ -1307,6 +1316,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
         /* related cpus should atleast have policy->cpus */
         cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
 
+        /* Remember which CPUs have been present at the policy creation time. */
+        if (!recover_policy)
+                cpumask_and(policy->real_cpus, policy->cpus, cpu_present_mask);
+
         /*
          * affected cpus must always be the one, which are online. We aren't
          * managing offline cpus here.
@@ -1420,8 +1433,7 @@ nomem_out:
         return ret;
 }
 
-static int __cpufreq_remove_dev_prepare(struct device *dev,
-                                        struct subsys_interface *sif)
+static int __cpufreq_remove_dev_prepare(struct device *dev)
 {
         unsigned int cpu = dev->id;
         int ret = 0;
@@ -1437,10 +1449,8 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
 
         if (has_target()) {
                 ret = __cpufreq_governor(policy, CPUFREQ_GOV_STOP);
-                if (ret) {
+                if (ret)
                         pr_err("%s: Failed to stop governor\n", __func__);
-                        return ret;
-                }
         }
 
         down_write(&policy->rwsem);
@@ -1473,8 +1483,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
         return ret;
 }
 
-static int __cpufreq_remove_dev_finish(struct device *dev,
-                                       struct subsys_interface *sif)
+static int __cpufreq_remove_dev_finish(struct device *dev)
 {
         unsigned int cpu = dev->id;
         int ret;
@@ -1492,10 +1501,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
         /* If cpu is last user of policy, free policy */
         if (has_target()) {
                 ret = __cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
-                if (ret) {
+                if (ret)
                         pr_err("%s: Failed to exit governor\n", __func__);
-                        return ret;
-                }
         }
 
         /*
@@ -1506,10 +1513,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
 
-        /* Free the policy only if the driver is getting removed. */
-        if (sif)
-                cpufreq_policy_free(policy, true);
-
         return 0;
 }
 
@@ -1521,42 +1524,41 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
 static int cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)
 {
         unsigned int cpu = dev->id;
-        int ret;
-
-        /*
-         * Only possible if 'cpu' is getting physically removed now. A hotplug
-         * notifier should have already been called and we just need to remove
-         * link or free policy here.
-         */
-        if (cpu_is_offline(cpu)) {
-                struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
-                struct cpumask mask;
+        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
 
-                if (!policy)
-                        return 0;
+        if (!policy)
+                return 0;
 
-                cpumask_copy(&mask, policy->related_cpus);
-                cpumask_clear_cpu(cpu, &mask);
+        if (cpu_online(cpu)) {
+                __cpufreq_remove_dev_prepare(dev);
+                __cpufreq_remove_dev_finish(dev);
+        }
 
-                /*
-                 * Free policy only if all policy->related_cpus are removed
-                 * physically.
-                 */
-                if (cpumask_intersects(&mask, cpu_present_mask)) {
-                        remove_cpu_dev_symlink(policy, cpu);
-                        return 0;
-                }
+        cpumask_clear_cpu(cpu, policy->real_cpus);
 
+        if (cpumask_empty(policy->real_cpus)) {
                 cpufreq_policy_free(policy, true);
                 return 0;
         }
 
-        ret = __cpufreq_remove_dev_prepare(dev, sif);
+        if (cpu != policy->kobj_cpu) {
+                remove_cpu_dev_symlink(policy, cpu);
+        } else {
+                /*
+                 * The CPU owning the policy object is going away.  Move it to
+                 * another suitable CPU.
+                 */
+                unsigned int new_cpu = cpumask_first(policy->real_cpus);
+                struct device *new_dev = get_cpu_device(new_cpu);
+
+                dev_dbg(dev, "%s: Moving policy object to CPU%u\n", __func__, new_cpu);
 
-        if (!ret)
-                ret = __cpufreq_remove_dev_finish(dev, sif);
+                sysfs_remove_link(&new_dev->kobj, "cpufreq");
+                policy->kobj_cpu = new_cpu;
+                WARN_ON(kobject_move(&policy->kobj, &new_dev->kobj));
+        }
 
-        return ret;
+        return 0;
 }
 
 static void handle_update(struct work_struct *work)
@@ -2395,11 +2397,11 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
                         break;
 
                 case CPU_DOWN_PREPARE:
-                        __cpufreq_remove_dev_prepare(dev, NULL);
+                        __cpufreq_remove_dev_prepare(dev);
                         break;
 
                 case CPU_POST_DEAD:
-                        __cpufreq_remove_dev_finish(dev, NULL);
+                        __cpufreq_remove_dev_finish(dev);
                         break;
 
                 case CPU_DOWN_FAILED:
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 15ada47bb720..fcb929ec5304 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -681,6 +681,7 @@ static struct cpu_defaults knl_params = {
                 .get_max = core_get_max_pstate,
                 .get_min = core_get_min_pstate,
                 .get_turbo = knl_get_turbo_pstate,
+                .get_scaling = core_get_scaling,
                 .set = core_set_pstate,
         },
 };
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index e362860c2b50..cd593c1f66dc 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -20,7 +20,7 @@
 #include <asm/clock.h>
 #include <asm/idle.h>
 
-#include <asm/mach-loongson/loongson.h>
+#include <asm/mach-loongson64/loongson.h>
 
 static uint nowait;
 
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 7ba495f75370..402631a19a11 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -905,7 +905,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
                 crypt->mode |= NPE_OP_NOT_IN_PLACE;
                 /* This was never tested by Intel
                  * for more than one dst buffer, I think. */
-                BUG_ON(req->dst->length < nbytes);
                 req_ctx->dst = NULL;
                 if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
                                         flags, DMA_FROM_DEVICE))
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 067402c7c2a9..df427c0e9e7b 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -73,7 +73,8 @@
                                        ICP_QAT_HW_CIPHER_KEY_CONVERT, \
                                        ICP_QAT_HW_CIPHER_DECRYPT)
 
-static atomic_t active_dev;
+static DEFINE_MUTEX(algs_lock);
+static unsigned int active_devs;
 
 struct qat_alg_buf {
         uint32_t len;
@@ -1280,7 +1281,10 @@ static struct crypto_alg qat_algs[] = { {
 
 int qat_algs_register(void)
 {
-        if (atomic_add_return(1, &active_dev) == 1) {
+        int ret = 0;
+
+        mutex_lock(&algs_lock);
+        if (++active_devs == 1) {
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(qat_algs); i++)
@@ -1289,21 +1293,25 @@ int qat_algs_register(void)
                                 CRYPTO_ALG_TYPE_AEAD | CRYPTO_ALG_ASYNC :
                                 CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_ASYNC;
 
-                return crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
+                ret = crypto_register_algs(qat_algs, ARRAY_SIZE(qat_algs));
         }
-        return 0;
+        mutex_unlock(&algs_lock);
+        return ret;
 }
 
 int qat_algs_unregister(void)
 {
-        if (atomic_sub_return(1, &active_dev) == 0)
-                return crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
-        return 0;
+        int ret = 0;
+
+        mutex_lock(&algs_lock);
+        if (--active_devs == 0)
+                ret = crypto_unregister_algs(qat_algs, ARRAY_SIZE(qat_algs));
+        mutex_unlock(&algs_lock);
+        return ret;
 }
 
 int qat_algs_init(void)
 {
-        atomic_set(&active_dev, 0);
         crypto_get_default_rng();
         return 0;
 }
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 59892126d175..d3629b7482dd 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -48,6 +48,8 @@
         BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) |\
         BIT(DMA_SLAVE_BUSWIDTH_4_BYTES))
 
+#define ATC_MAX_DSCR_TRIALS     10
+
 /*
  * Initial number of descriptors to allocate for each channel. This could
  * be increased during dma usage.
@@ -285,28 +287,19 @@ static struct at_desc *atc_get_desc_by_cookie(struct at_dma_chan *atchan,
  *
  * @current_len: the number of bytes left before reading CTRLA
  * @ctrla: the value of CTRLA
- * @desc: the descriptor containing the transfer width
  */
-static inline int atc_calc_bytes_left(int current_len, u32 ctrla,
-                                        struct at_desc *desc)
+static inline int atc_calc_bytes_left(int current_len, u32 ctrla)
 {
-        return current_len - ((ctrla & ATC_BTSIZE_MAX) << desc->tx_width);
-}
+        u32 btsize = (ctrla & ATC_BTSIZE_MAX);
+        u32 src_width = ATC_REG_TO_SRC_WIDTH(ctrla);
 
-/**
- * atc_calc_bytes_left_from_reg - calculates the number of bytes left according
- * to the current value of CTRLA.
- *
- * @current_len: the number of bytes left before reading CTRLA
- * @atchan: the channel to read CTRLA for
- * @desc: the descriptor containing the transfer width
- */
-static inline int atc_calc_bytes_left_from_reg(int current_len,
-                        struct at_dma_chan *atchan, struct at_desc *desc)
-{
-        u32 ctrla = channel_readl(atchan, CTRLA);
-
-        return atc_calc_bytes_left(current_len, ctrla, desc);
+        /*
+         * According to the datasheet, when reading the Control A Register
+         * (ctrla), the Buffer Transfer Size (btsize) bitfield refers to the
+         * number of transfers completed on the Source Interface.
+         * So btsize is always a number of source width transfers.
+         */
+        return current_len - (btsize << src_width);
 }
 
 /**
@@ -320,7 +313,7 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
         struct at_desc *desc_first = atc_first_active(atchan);
         struct at_desc *desc;
         int ret;
-        u32 ctrla, dscr;
+        u32 ctrla, dscr, trials;
 
         /*
          * If the cookie doesn't match to the currently running transfer then
@@ -346,15 +339,82 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
                  * the channel's DSCR register and compare it against the value
                  * of the hardware linked list structure of each child
                  * descriptor.
+                 *
+                 * The CTRLA register provides us with the amount of data
+                 * already read from the source for the current child
+                 * descriptor. So we can compute a more accurate residue by also
+                 * removing the number of bytes corresponding to this amount of
+                 * data.
+                 *
+                 * However, the DSCR and CTRLA registers cannot be read both
+                 * atomically. Hence a race condition may occur: the first read
+                 * register may refer to one child descriptor whereas the second
+                 * read may refer to a later child descriptor in the list
+                 * because of the DMA transfer progression inbetween the two
+                 * reads.
+                 *
+                 * One solution could have been to pause the DMA transfer, read
+                 * the DSCR and CTRLA then resume the DMA transfer. Nonetheless,
+                 * this approach presents some drawbacks:
+                 * - If the DMA transfer is paused, RX overruns or TX underruns
+                 *   are more likey to occur depending on the system latency.
+                 *   Taking the USART driver as an example, it uses a cyclic DMA
+                 *   transfer to read data from the Receive Holding Register
+                 *   (RHR) to avoid RX overruns since the RHR is not protected
+                 *   by any FIFO on most Atmel SoCs. So pausing the DMA transfer
+                 *   to compute the residue would break the USART driver design.
+                 * - The atc_pause() function masks interrupts but we'd rather
+                 *   avoid to do so for system latency purpose.
+                 *
+                 * Then we'd rather use another solution: the DSCR is read a
+                 * first time, the CTRLA is read in turn, next the DSCR is read
+                 * a second time. If the two consecutive read values of the DSCR
+                 * are the same then we assume both refers to the very same
+                 * child descriptor as well as the CTRLA value read inbetween
+                 * does. For cyclic tranfers, the assumption is that a full loop
+                 * is "not so fast".
+                 * If the two DSCR values are different, we read again the CTRLA
+                 * then the DSCR till two consecutive read values from DSCR are
+                 * equal or till the maxium trials is reach.
+                 * This algorithm is very unlikely not to find a stable value for
+                 * DSCR.
                  */
 
-                ctrla = channel_readl(atchan, CTRLA);
-                rmb(); /* ensure CTRLA is read before DSCR */
                 dscr = channel_readl(atchan, DSCR);
+                rmb(); /* ensure DSCR is read before CTRLA */
+                ctrla = channel_readl(atchan, CTRLA);
+                for (trials = 0; trials < ATC_MAX_DSCR_TRIALS; ++trials) {
+                        u32 new_dscr;
+
+                        rmb(); /* ensure DSCR is read after CTRLA */
+                        new_dscr = channel_readl(atchan, DSCR);
+
+                        /*
+                         * If the DSCR register value has not changed inside the
+                         * DMA controller since the previous read, we assume
+                         * that both the dscr and ctrla values refers to the
+                         * very same descriptor.
+                         */
+                        if (likely(new_dscr == dscr))
+                                break;
+
+                        /*
+                         * DSCR has changed inside the DMA controller, so the
+                         * previouly read value of CTRLA may refer to an already
+                         * processed descriptor hence could be outdated.
+                         * We need to update ctrla to match the current
+                         * descriptor.
+                         */
+                        dscr = new_dscr;
+                        rmb(); /* ensure DSCR is read before CTRLA */
+                        ctrla = channel_readl(atchan, CTRLA);
+                }
+                if (unlikely(trials >= ATC_MAX_DSCR_TRIALS))
+                        return -ETIMEDOUT;
 
                 /* for the first descriptor we can be more accurate */
                 if (desc_first->lli.dscr == dscr)
-                        return atc_calc_bytes_left(ret, ctrla, desc_first);
+                        return atc_calc_bytes_left(ret, ctrla);
 
                 ret -= desc_first->len;
                 list_for_each_entry(desc, &desc_first->tx_list, desc_node) {
@@ -365,16 +425,14 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
                 }
 
                 /*
-                 * For the last descriptor in the chain we can calculate
+                 * For the current descriptor in the chain we can calculate
                  * the remaining bytes using the channel's register.
-                 * Note that the transfer width of the first and last
-                 * descriptor may differ.
                  */
-                if (!desc->lli.dscr)
-                        ret = atc_calc_bytes_left_from_reg(ret, atchan, desc);
+                ret = atc_calc_bytes_left(ret, ctrla);
         } else {
                 /* single transfer */
-                ret = atc_calc_bytes_left_from_reg(ret, atchan, desc_first);
+                ctrla = channel_readl(atchan, CTRLA);
+                ret = atc_calc_bytes_left(ret, ctrla);
         }
 
         return ret;
@@ -726,7 +784,6 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
 
         desc->txd.cookie = -EBUSY;
         desc->total_len = desc->len = len;
-        desc->tx_width = dwidth;
 
         /* set end-of-link to the last link descriptor of list*/
         set_desc_eol(desc);
@@ -804,10 +861,6 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
         first->txd.cookie = -EBUSY;
         first->total_len = len;
 
-        /* set transfer width for the calculation of the residue */
-        first->tx_width = src_width;
-        prev->tx_width = src_width;
-
         /* set end-of-link to the last link descriptor of list*/
         set_desc_eol(desc);
 
@@ -956,10 +1009,6 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
         first->txd.cookie = -EBUSY;
         first->total_len = total_len;
 
-        /* set transfer width for the calculation of the residue */
-        first->tx_width = reg_width;
-        prev->tx_width = reg_width;
-
         /* first link descriptor of list is responsible of flags */
         first->txd.flags = flags; /* client is in control of this ack */
 
@@ -1077,12 +1126,6 @@ atc_prep_dma_sg(struct dma_chan *chan,
                 desc->txd.cookie = 0;
                 desc->len = len;
 
-                /*
-                 * Although we only need the transfer width for the first and
-                 * the last descriptor, its easier to set it to all descriptors.
-                 */
-                desc->tx_width = src_width;
-
                 atc_desc_chain(&first, &prev, desc);
 
                 /* update the lengths and addresses for the next loop cycle */
@@ -1256,7 +1299,6 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
         /* First descriptor of the chain embedds additional information */
         first->txd.cookie = -EBUSY;
         first->total_len = buf_len;
-        first->tx_width = reg_width;
 
         return &first->txd;
 
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index bc8d5ebedd19..7f5a08230f76 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -112,6 +112,7 @@
 #define         ATC_SRC_WIDTH_BYTE      (0x0 << 24)
 #define         ATC_SRC_WIDTH_HALFWORD  (0x1 << 24)
 #define         ATC_SRC_WIDTH_WORD      (0x2 << 24)
+#define         ATC_REG_TO_SRC_WIDTH(r) (((r) >> 24) & 0x3)
 #define ATC_DST_WIDTH_MASK      (0x3 << 28)     /* Destination Single Transfer Size */
 #define         ATC_DST_WIDTH(x)        ((x) << 28)
 #define         ATC_DST_WIDTH_BYTE      (0x0 << 28)
@@ -182,7 +183,6 @@ struct at_lli {
  * @txd: support for the async_tx api
  * @desc_node: node on the channed descriptors list
  * @len: descriptor byte count
- * @tx_width: transfer width
  * @total_len: total transaction byte count
  */
 struct at_desc {
@@ -194,7 +194,6 @@ struct at_desc {
         struct dma_async_tx_descriptor  txd;
         struct list_head                desc_node;
         size_t                          len;
-        u32                             tx_width;
         size_t                          total_len;
 
         /* Interleaved data */
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index cf1213de7865..40afa2a16cfc 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -359,18 +359,19 @@ static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan,
          * descriptor view 2 since some fields of the configuration register
          * depend on transfer size and src/dest addresses.
          */
-        if (at_xdmac_chan_is_cyclic(atchan)) {
+        if (at_xdmac_chan_is_cyclic(atchan))
                 reg = AT_XDMAC_CNDC_NDVIEW_NDV1;
-                at_xdmac_chan_write(atchan, AT_XDMAC_CC, first->lld.mbr_cfg);
-        } else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) {
+        else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3)
                 reg = AT_XDMAC_CNDC_NDVIEW_NDV3;
-        } else {
-                /*
-                 * No need to write AT_XDMAC_CC reg, it will be done when the
-                 * descriptor is fecthed.
-                 */
+        else
                 reg = AT_XDMAC_CNDC_NDVIEW_NDV2;
-        }
+        /*
+         * Even if the register will be updated from the configuration in the
+         * descriptor when using view 2 or higher, the PROT bit won't be set
+         * properly. This bit can be modified only by using the channel
+         * configuration register.
+         */
+        at_xdmac_chan_write(atchan, AT_XDMAC_CC, first->lld.mbr_cfg);
 
         reg |= AT_XDMAC_CNDC_NDDUP
                | AT_XDMAC_CNDC_NDSUP
@@ -681,15 +682,16 @@ at_xdmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                         desc->lld.mbr_sa = mem;
                         desc->lld.mbr_da = atchan->sconfig.dst_addr;
                 }
-                desc->lld.mbr_cfg = atchan->cfg;
-                dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg);
+                dwidth = at_xdmac_get_dwidth(atchan->cfg);
                 fixed_dwidth = IS_ALIGNED(len, 1 << dwidth)
-                               ? at_xdmac_get_dwidth(desc->lld.mbr_cfg)
+                               ? dwidth
                                : AT_XDMAC_CC_DWIDTH_BYTE;
                 desc->lld.mbr_ubc = AT_XDMAC_MBR_UBC_NDV2                       /* next descriptor view */
                         | AT_XDMAC_MBR_UBC_NDEN                                 /* next descriptor dst parameter update */
                         | AT_XDMAC_MBR_UBC_NSEN                                 /* next descriptor src parameter update */
                         | (len >> fixed_dwidth);                                /* microblock length */
+                desc->lld.mbr_cfg = (atchan->cfg & ~AT_XDMAC_CC_DWIDTH_MASK) |
+                                    AT_XDMAC_CC_DWIDTH(fixed_dwidth);
                 dev_dbg(chan2dev(chan),
                          "%s: lld: mbr_sa=%pad, mbr_da=%pad, mbr_ubc=0x%08x\n",
                          __func__, &desc->lld.mbr_sa, &desc->lld.mbr_da, desc->lld.mbr_ubc);
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index fbaf1ead2597..f1325f62563e 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -162,10 +162,11 @@ static void mv_chan_set_mode(struct mv_xor_chan *chan,
         config &= ~0x7;
         config |= op_mode;
 
-        if (IS_ENABLED(__BIG_ENDIAN))
-                config |= XOR_DESCRIPTOR_SWAP;
-        else
-                config &= ~XOR_DESCRIPTOR_SWAP;
+#if defined(__BIG_ENDIAN)
+        config |= XOR_DESCRIPTOR_SWAP;
+#else
+        config &= ~XOR_DESCRIPTOR_SWAP;
+#endif
 
         writel_relaxed(config, XOR_CONFIG(chan));
         chan->current_type = type;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index f513f77b1d85..ecab4ea059b4 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2328,7 +2328,7 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
                         desc->txd.callback = last->txd.callback;
                         desc->txd.callback_param = last->txd.callback_param;
                 }
-                last->last = false;
+                desc->last = false;
 
                 dma_cookie_assign(&desc->txd);
 
@@ -2623,6 +2623,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
                 desc->rqcfg.brst_len = 1;
 
         desc->rqcfg.brst_len = get_burst_len(desc, len);
+        desc->bytes_requested = len;
 
         desc->txd.flags = flags;
 
diff --git a/drivers/dma/virt-dma.c b/drivers/dma/virt-dma.c
index 7d2c17d8d30f..6f80432a3f0a 100644
--- a/drivers/dma/virt-dma.c
+++ b/drivers/dma/virt-dma.c
@@ -29,7 +29,7 @@ dma_cookie_t vchan_tx_submit(struct dma_async_tx_descriptor *tx)
         spin_lock_irqsave(&vc->lock, flags);
         cookie = dma_cookie_assign(tx);
 
-        list_move_tail(&vd->node, &vc->desc_submitted);
+        list_add_tail(&vd->node, &vc->desc_submitted);
         spin_unlock_irqrestore(&vc->lock, flags);
 
         dev_dbg(vc->chan.device->dev, "vchan %p: txd %p[%x]: submitted\n",
@@ -83,10 +83,8 @@ static void vchan_complete(unsigned long arg)
                 cb_data = vd->tx.callback_param;
 
                 list_del(&vd->node);
-                if (async_tx_test_ack(&vd->tx))
-                        list_add(&vd->node, &vc->desc_allocated);
-                else
-                        vc->desc_free(vd);
+
+                vc->desc_free(vd);
 
                 if (cb)
                         cb(cb_data);
@@ -98,13 +96,9 @@ void vchan_dma_desc_free_list(struct virt_dma_chan *vc, struct list_head *head)
         while (!list_empty(head)) {
                 struct virt_dma_desc *vd = list_first_entry(head,
                         struct virt_dma_desc, node);
-                if (async_tx_test_ack(&vd->tx)) {
-                        list_move_tail(&vd->node, &vc->desc_allocated);
-                } else {
-                        dev_dbg(vc->chan.device->dev, "txd %p: freeing\n", vd);
-                        list_del(&vd->node);
-                        vc->desc_free(vd);
-                }
+                list_del(&vd->node);
+                dev_dbg(vc->chan.device->dev, "txd %p: freeing\n", vd);
+                vc->desc_free(vd);
         }
 }
 EXPORT_SYMBOL_GPL(vchan_dma_desc_free_list);
@@ -114,7 +108,6 @@ void vchan_init(struct virt_dma_chan *vc, struct dma_device *dmadev)
         dma_cookie_init(&vc->chan);
 
         spin_lock_init(&vc->lock);
-        INIT_LIST_HEAD(&vc->desc_allocated);
         INIT_LIST_HEAD(&vc->desc_submitted);
         INIT_LIST_HEAD(&vc->desc_issued);
         INIT_LIST_HEAD(&vc->desc_completed);
diff --git a/drivers/dma/virt-dma.h b/drivers/dma/virt-dma.h
index 189e75dbcb15..181b95267866 100644
--- a/drivers/dma/virt-dma.h
+++ b/drivers/dma/virt-dma.h
@@ -29,7 +29,6 @@ struct virt_dma_chan {
         spinlock_t lock;
 
         /* protected by vc.lock */
-        struct list_head desc_allocated;
         struct list_head desc_submitted;
         struct list_head desc_issued;
         struct list_head desc_completed;
@@ -56,16 +55,11 @@ static inline struct dma_async_tx_descriptor *vchan_tx_prep(struct virt_dma_chan
         struct virt_dma_desc *vd, unsigned long tx_flags)
 {
         extern dma_cookie_t vchan_tx_submit(struct dma_async_tx_descriptor *);
-        unsigned long flags;
 
         dma_async_tx_descriptor_init(&vd->tx, &vc->chan);
         vd->tx.flags = tx_flags;
         vd->tx.tx_submit = vchan_tx_submit;
 
-        spin_lock_irqsave(&vc->lock, flags);
-        list_add_tail(&vd->node, &vc->desc_allocated);
-        spin_unlock_irqrestore(&vc->lock, flags);
-
         return &vd->tx;
 }
 
@@ -128,8 +122,7 @@ static inline struct virt_dma_desc *vchan_next_desc(struct virt_dma_chan *vc)
 }
 
 /**
- * vchan_get_all_descriptors - obtain all allocated, submitted and issued
- *                             descriptors
+ * vchan_get_all_descriptors - obtain all submitted and issued descriptors
  * vc: virtual channel to get descriptors from
  * head: list of descriptors found
  *
@@ -141,7 +134,6 @@ static inline struct virt_dma_desc *vchan_next_desc(struct virt_dma_chan *vc)
 static inline void vchan_get_all_descriptors(struct virt_dma_chan *vc,
         struct list_head *head)
 {
-        list_splice_tail_init(&vc->desc_allocated, head);
         list_splice_tail_init(&vc->desc_submitted, head);
         list_splice_tail_init(&vc->desc_issued, head);
         list_splice_tail_init(&vc->desc_completed, head);
@@ -149,14 +141,11 @@ static inline void vchan_get_all_descriptors(struct virt_dma_chan *vc,
 
 static inline void vchan_free_chan_resources(struct virt_dma_chan *vc)
 {
-        struct virt_dma_desc *vd;
         unsigned long flags;
         LIST_HEAD(head);
 
         spin_lock_irqsave(&vc->lock, flags);
         vchan_get_all_descriptors(vc, &head);
-        list_for_each_entry(vd, &head, node)
-                async_tx_clear_ack(&vd->tx);
         spin_unlock_irqrestore(&vc->lock, flags);
 
         vchan_dma_desc_free_list(vc, &head);
diff --git a/drivers/dma/xgene-dma.c b/drivers/dma/xgene-dma.c
index 620fd55ec766..dff22ab01851 100644
--- a/drivers/dma/xgene-dma.c
+++ b/drivers/dma/xgene-dma.c
@@ -111,6 +111,7 @@
 #define XGENE_DMA_MEM_RAM_SHUTDOWN              0xD070
 #define XGENE_DMA_BLK_MEM_RDY                   0xD074
 #define XGENE_DMA_BLK_MEM_RDY_VAL               0xFFFFFFFF
+#define XGENE_DMA_RING_CMD_SM_OFFSET            0x8000
 
 /* X-Gene SoC EFUSE csr register and bit defination */
 #define XGENE_SOC_JTAG1_SHADOW                  0x18
@@ -1887,6 +1888,8 @@ static int xgene_dma_get_resources(struct platform_device *pdev,
                 return -ENOMEM;
         }
 
+        pdma->csr_ring_cmd += XGENE_DMA_RING_CMD_SM_OFFSET;
+
         /* Get efuse csr region */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 3);
         if (!res) {
diff --git a/drivers/edac/ppc4xx_edac.c b/drivers/edac/ppc4xx_edac.c
index 3515b381c131..711d8ad74f11 100644
--- a/drivers/edac/ppc4xx_edac.c
+++ b/drivers/edac/ppc4xx_edac.c
@@ -920,7 +920,7 @@ static int ppc4xx_edac_init_csrows(struct mem_ctl_info *mci, u32 mcopt1)
          */
 
         for (row = 0; row < mci->nr_csrows; row++) {
-                struct csrow_info *csi = &mci->csrows[row];
+                struct csrow_info *csi = mci->csrows[row];
 
                 /*
                  * Get the configuration settings for this
diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c
index 080d5cc27055..eebdf2a33bfe 100644
--- a/drivers/extcon/extcon-palmas.c
+++ b/drivers/extcon/extcon-palmas.c
@@ -200,7 +200,6 @@ static int palmas_usb_probe(struct platform_device *pdev)
         status = devm_extcon_dev_register(&pdev->dev, palmas_usb->edev);
         if (status) {
                 dev_err(&pdev->dev, "failed to register extcon device\n");
-                kfree(palmas_usb->edev->name);
                 return status;
         }
 
@@ -214,7 +213,6 @@ static int palmas_usb_probe(struct platform_device *pdev)
                 if (status < 0) {
                         dev_err(&pdev->dev, "can't get IRQ %d, err %d\n",
                                         palmas_usb->id_irq, status);
-                        kfree(palmas_usb->edev->name);
                         return status;
                 }
         }
@@ -229,7 +227,6 @@ static int palmas_usb_probe(struct platform_device *pdev)
                 if (status < 0) {
                         dev_err(&pdev->dev, "can't get IRQ %d, err %d\n",
                                         palmas_usb->vbus_irq, status);
-                        kfree(palmas_usb->edev->name);
                         return status;
                 }
         }
@@ -239,15 +236,6 @@ static int palmas_usb_probe(struct platform_device *pdev)
         return 0;
 }
 
-static int palmas_usb_remove(struct platform_device *pdev)
-{
-        struct palmas_usb *palmas_usb = platform_get_drvdata(pdev);
-
-        kfree(palmas_usb->edev->name);
-
-        return 0;
-}
-
 #ifdef CONFIG_PM_SLEEP
 static int palmas_usb_suspend(struct device *dev)
 {
@@ -288,7 +276,6 @@ static const struct of_device_id of_palmas_match_tbl[] = {
 
 static struct platform_driver palmas_usb_driver = {
         .probe = palmas_usb_probe,
-        .remove = palmas_usb_remove,
         .driver = {
                 .name = "palmas-usb",
                 .of_match_table = of_palmas_match_tbl,
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index 76157ab9faf3..43b57b02d050 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -124,25 +124,35 @@ static int find_cable_index_by_id(struct extcon_dev *edev, const unsigned int id
         return -EINVAL;
 }
 
-static int find_cable_index_by_name(struct extcon_dev *edev, const char *name)
+static int find_cable_id_by_name(struct extcon_dev *edev, const char *name)
 {
-        unsigned int id = EXTCON_NONE;
+        unsigned int id = -EINVAL;
         int i = 0;
 
-        if (edev->max_supported == 0)
-                return -EINVAL;
-
-        /* Find the the number of extcon cable */
+        /* Find the id of extcon cable */
         while (extcon_name[i]) {
                 if (!strncmp(extcon_name[i], name, CABLE_NAME_MAX)) {
                         id = i;
                         break;
                 }
+                i++;
         }
 
-        if (id == EXTCON_NONE)
+        return id;
+}
+
+static int find_cable_index_by_name(struct extcon_dev *edev, const char *name)
+{
+        unsigned int id;
+
+        if (edev->max_supported == 0)
                 return -EINVAL;
 
+        /* Find the the number of extcon cable */
+        id = find_cable_id_by_name(edev, name);
+        if (id < 0)
+                return id;
+
         return find_cable_index_by_id(edev, id);
 }
 
@@ -228,9 +238,11 @@ static ssize_t cable_state_show(struct device *dev,
         struct extcon_cable *cable = container_of(attr, struct extcon_cable,
                                                   attr_state);
 
+        int i = cable->cable_index;
+
         return sprintf(buf, "%d\n",
                        extcon_get_cable_state_(cable->edev,
-                                               cable->cable_index));
+                                               cable->edev->supported_cable[i]));
 }
 
 /**
@@ -263,20 +275,25 @@ int extcon_update_state(struct extcon_dev *edev, u32 mask, u32 state)
         spin_lock_irqsave(&edev->lock, flags);
 
         if (edev->state != ((edev->state & ~mask) | (state & mask))) {
+                u32 old_state;
+
                 if (check_mutually_exclusive(edev, (edev->state & ~mask) |
                                                    (state & mask))) {
                         spin_unlock_irqrestore(&edev->lock, flags);
                         return -EPERM;
                 }
 
-                for (index = 0; index < edev->max_supported; index++) {
-                        if (is_extcon_changed(edev->state, state, index, &attached))
-                                raw_notifier_call_chain(&edev->nh[index], attached, edev);
-                }
-
+                old_state = edev->state;
                 edev->state &= ~mask;
                 edev->state |= state & mask;
 
+                for (index = 0; index < edev->max_supported; index++) {
+                        if (is_extcon_changed(old_state, edev->state, index,
+                                              &attached))
+                                raw_notifier_call_chain(&edev->nh[index],
+                                                        attached, edev);
+                }
+
                 /* This could be in interrupt handler */
                 prop_buf = (char *)get_zeroed_page(GFP_ATOMIC);
                 if (prop_buf) {
@@ -361,8 +378,13 @@ EXPORT_SYMBOL_GPL(extcon_get_cable_state_);
  */
 int extcon_get_cable_state(struct extcon_dev *edev, const char *cable_name)
 {
-        return extcon_get_cable_state_(edev, find_cable_index_by_name
-                                                (edev, cable_name));
+        unsigned int id;
+
+        id = find_cable_id_by_name(edev, cable_name);
+        if (id < 0)
+                return id;
+
+        return extcon_get_cable_state_(edev, id);
 }
 EXPORT_SYMBOL_GPL(extcon_get_cable_state);
 
@@ -404,8 +426,13 @@ EXPORT_SYMBOL_GPL(extcon_set_cable_state_);
 int extcon_set_cable_state(struct extcon_dev *edev,
                         const char *cable_name, bool cable_state)
 {
-        return extcon_set_cable_state_(edev, find_cable_index_by_name
-                                        (edev, cable_name), cable_state);
+        unsigned int id;
+
+        id = find_cable_id_by_name(edev, cable_name);
+        if (id < 0)
+                return id;
+
+        return extcon_set_cable_state_(edev, id, cable_state);
 }
 EXPORT_SYMBOL_GPL(extcon_set_cable_state);
 
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 9fa8084a7c8d..d6144e3b97c5 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -58,6 +58,11 @@ bool efi_runtime_disabled(void)
 
 static int __init parse_efi_cmdline(char *str)
 {
+        if (!str) {
+                pr_warn("need at least one option\n");
+                return -EINVAL;
+        }
+
         if (parse_option_str(str, "noruntime"))
                 disable_runtime = true;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index e9fde72cf038..f7b49d5ce4b8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1130,6 +1130,9 @@ struct amdgpu_gfx {
         uint32_t                        me_feature_version;
         uint32_t                        ce_feature_version;
         uint32_t                        pfp_feature_version;
+        uint32_t                        rlc_feature_version;
+        uint32_t                        mec_feature_version;
+        uint32_t                        mec2_feature_version;
         struct amdgpu_ring              gfx_ring[AMDGPU_MAX_GFX_RINGS];
         unsigned                        num_gfx_rings;
         struct amdgpu_ring              compute_ring[AMDGPU_MAX_COMPUTE_RINGS];
@@ -1639,6 +1642,7 @@ struct amdgpu_sdma {
         /* SDMA firmware */
         const struct firmware   *fw;
         uint32_t                fw_version;
+        uint32_t                feature_version;
 
         struct amdgpu_ring      ring;
 };
@@ -1866,6 +1870,12 @@ typedef void (*amdgpu_wreg_t)(struct amdgpu_device*, uint32_t, uint32_t);
 typedef uint32_t (*amdgpu_block_rreg_t)(struct amdgpu_device*, uint32_t, uint32_t);
 typedef void (*amdgpu_block_wreg_t)(struct amdgpu_device*, uint32_t, uint32_t, uint32_t);
 
+struct amdgpu_ip_block_status {
+        bool valid;
+        bool sw;
+        bool hw;
+};
+
 struct amdgpu_device {
         struct device                   *dev;
         struct drm_device               *ddev;
@@ -2008,7 +2018,7 @@ struct amdgpu_device {
 
         const struct amdgpu_ip_block_version *ip_blocks;
         int                             num_ip_blocks;
-        bool                            *ip_block_enabled;
+        struct amdgpu_ip_block_status   *ip_block_status;
         struct mutex    mn_lock;
         DECLARE_HASHTABLE(mn_hash, 7);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index d79009b65867..99f158e1baff 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1191,8 +1191,9 @@ static int amdgpu_early_init(struct amdgpu_device *adev)
                 return -EINVAL;
         }
 
-        adev->ip_block_enabled = kcalloc(adev->num_ip_blocks, sizeof(bool), GFP_KERNEL);
-        if (adev->ip_block_enabled == NULL)
+        adev->ip_block_status = kcalloc(adev->num_ip_blocks,
+                                        sizeof(struct amdgpu_ip_block_status), GFP_KERNEL);
+        if (adev->ip_block_status == NULL)
                 return -ENOMEM;
 
         if (adev->ip_blocks == NULL) {
@@ -1203,18 +1204,18 @@ static int amdgpu_early_init(struct amdgpu_device *adev)
         for (i = 0; i < adev->num_ip_blocks; i++) {
                 if ((amdgpu_ip_block_mask & (1 << i)) == 0) {
                         DRM_ERROR("disabled ip block: %d\n", i);
-                        adev->ip_block_enabled[i] = false;
+                        adev->ip_block_status[i].valid = false;
                 } else {
                         if (adev->ip_blocks[i].funcs->early_init) {
                                 r = adev->ip_blocks[i].funcs->early_init((void *)adev);
                                 if (r == -ENOENT)
-                                        adev->ip_block_enabled[i] = false;
+                                        adev->ip_block_status[i].valid = false;
                                 else if (r)
                                         return r;
                                 else
-                                        adev->ip_block_enabled[i] = true;
+                                        adev->ip_block_status[i].valid = true;
                         } else {
-                                adev->ip_block_enabled[i] = true;
+                                adev->ip_block_status[i].valid = true;
                         }
                 }
         }
@@ -1227,11 +1228,12 @@ static int amdgpu_init(struct amdgpu_device *adev)
         int i, r;
 
         for (i = 0; i < adev->num_ip_blocks; i++) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].valid)
                         continue;
                 r = adev->ip_blocks[i].funcs->sw_init((void *)adev);
                 if (r)
                         return r;
+                adev->ip_block_status[i].sw = true;
                 /* need to do gmc hw init early so we can allocate gpu mem */
                 if (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_GMC) {
                         r = amdgpu_vram_scratch_init(adev);
@@ -1243,11 +1245,12 @@ static int amdgpu_init(struct amdgpu_device *adev)
                         r = amdgpu_wb_init(adev);
                         if (r)
                                 return r;
+                        adev->ip_block_status[i].hw = true;
                 }
         }
 
         for (i = 0; i < adev->num_ip_blocks; i++) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].sw)
                         continue;
                 /* gmc hw init is done early */
                 if (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_GMC)
@@ -1255,6 +1258,7 @@ static int amdgpu_init(struct amdgpu_device *adev)
                 r = adev->ip_blocks[i].funcs->hw_init((void *)adev);
                 if (r)
                         return r;
+                adev->ip_block_status[i].hw = true;
         }
 
         return 0;
@@ -1265,7 +1269,7 @@ static int amdgpu_late_init(struct amdgpu_device *adev)
         int i = 0, r;
 
         for (i = 0; i < adev->num_ip_blocks; i++) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].valid)
                         continue;
                 /* enable clockgating to save power */
                 r = adev->ip_blocks[i].funcs->set_clockgating_state((void *)adev,
@@ -1287,7 +1291,7 @@ static int amdgpu_fini(struct amdgpu_device *adev)
         int i, r;
 
         for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].hw)
                         continue;
                 if (adev->ip_blocks[i].type == AMD_IP_BLOCK_TYPE_GMC) {
                         amdgpu_wb_fini(adev);
@@ -1300,14 +1304,16 @@ static int amdgpu_fini(struct amdgpu_device *adev)
                         return r;
                 r = adev->ip_blocks[i].funcs->hw_fini((void *)adev);
                 /* XXX handle errors */
+                adev->ip_block_status[i].hw = false;
         }
 
         for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].sw)
                         continue;
                 r = adev->ip_blocks[i].funcs->sw_fini((void *)adev);
                 /* XXX handle errors */
-                adev->ip_block_enabled[i] = false;
+                adev->ip_block_status[i].sw = false;
+                adev->ip_block_status[i].valid = false;
         }
 
         return 0;
@@ -1318,7 +1324,7 @@ static int amdgpu_suspend(struct amdgpu_device *adev)
         int i, r;
 
         for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].valid)
                         continue;
                 /* ungate blocks so that suspend can properly shut them down */
                 r = adev->ip_blocks[i].funcs->set_clockgating_state((void *)adev,
@@ -1336,7 +1342,7 @@ static int amdgpu_resume(struct amdgpu_device *adev)
         int i, r;
 
         for (i = 0; i < adev->num_ip_blocks; i++) {
-                if (!adev->ip_block_enabled[i])
+                if (!adev->ip_block_status[i].valid)
                         continue;
                 r = adev->ip_blocks[i].funcs->resume(adev);
                 if (r)
@@ -1582,8 +1588,8 @@ void amdgpu_device_fini(struct amdgpu_device *adev)
         amdgpu_fence_driver_fini(adev);
         amdgpu_fbdev_fini(adev);
         r = amdgpu_fini(adev);
-        kfree(adev->ip_block_enabled);
-        adev->ip_block_enabled = NULL;
+        kfree(adev->ip_block_status);
+        adev->ip_block_status = NULL;
         adev->accel_working = false;
         /* free i2c buses */
         amdgpu_i2c_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index ae43b58c9733..4afc507820c0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -449,7 +449,7 @@ out:
  * vital here, so they are not reported back to userspace.
  */
 static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
-                                    struct amdgpu_bo_va *bo_va)
+                                    struct amdgpu_bo_va *bo_va, uint32_t operation)
 {
         struct ttm_validate_buffer tv, *entry;
         struct amdgpu_bo_list_entry *vm_bos;
@@ -485,7 +485,9 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
         if (r)
                 goto error_unlock;
 
-        r = amdgpu_vm_bo_update(adev, bo_va, &bo_va->bo->tbo.mem);
+
+        if (operation == AMDGPU_VA_OP_MAP)
+                r = amdgpu_vm_bo_update(adev, bo_va, &bo_va->bo->tbo.mem);
 
 error_unlock:
         mutex_unlock(&bo_va->vm->mutex);
@@ -580,7 +582,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
         }
 
         if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE))
-                amdgpu_gem_va_update_vm(adev, bo_va);
+                amdgpu_gem_va_update_vm(adev, bo_va, args->operation);
 
         drm_gem_object_unreference_unlocked(gobj);
         return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 52dff75aac6f..bc0fac618a3f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -180,16 +180,16 @@ int amdgpu_ib_schedule(struct amdgpu_device *adev, unsigned num_ibs,
         if (vm) {
                 /* do context switch */
                 amdgpu_vm_flush(ring, vm, ib->sync.last_vm_update);
-        }
 
-        if (vm && ring->funcs->emit_gds_switch)
-                amdgpu_ring_emit_gds_switch(ring, ib->vm->ids[ring->idx].id,
-                                            ib->gds_base, ib->gds_size,
-                                            ib->gws_base, ib->gws_size,
-                                            ib->oa_base, ib->oa_size);
+                if (ring->funcs->emit_gds_switch)
+                        amdgpu_ring_emit_gds_switch(ring, ib->vm->ids[ring->idx].id,
+                                                    ib->gds_base, ib->gds_size,
+                                                    ib->gws_base, ib->gws_size,
+                                                    ib->oa_base, ib->oa_size);
 
-        if (ring->funcs->emit_hdp_flush)
-                amdgpu_ring_emit_hdp_flush(ring);
+                if (ring->funcs->emit_hdp_flush)
+                        amdgpu_ring_emit_hdp_flush(ring);
+        }
 
         old_ctx = ring->current_ctx;
         for (i = 0; i < num_ibs; ++i) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 31ad444c6386..3bfe67de8349 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -235,7 +235,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
 
                 for (i = 0; i < adev->num_ip_blocks; i++) {
                         if (adev->ip_blocks[i].type == type &&
-                            adev->ip_block_enabled[i]) {
+                            adev->ip_block_status[i].valid) {
                                 ip.hw_ip_version_major = adev->ip_blocks[i].major;
                                 ip.hw_ip_version_minor = adev->ip_blocks[i].minor;
                                 ip.capabilities_flags = 0;
@@ -274,7 +274,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
 
                 for (i = 0; i < adev->num_ip_blocks; i++)
                         if (adev->ip_blocks[i].type == type &&
-                            adev->ip_block_enabled[i] &&
+                            adev->ip_block_status[i].valid &&
                             count < AMDGPU_HW_IP_INSTANCE_MAX_COUNT)
                                 count++;
 
@@ -317,16 +317,17 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                         break;
                 case AMDGPU_INFO_FW_GFX_RLC:
                         fw_info.ver = adev->gfx.rlc_fw_version;
-                        fw_info.feature = 0;
+                        fw_info.feature = adev->gfx.rlc_feature_version;
                         break;
                 case AMDGPU_INFO_FW_GFX_MEC:
-                        if (info->query_fw.index == 0)
+                        if (info->query_fw.index == 0) {
                                 fw_info.ver = adev->gfx.mec_fw_version;
-                        else if (info->query_fw.index == 1)
+                                fw_info.feature = adev->gfx.mec_feature_version;
+                        } else if (info->query_fw.index == 1) {
                                 fw_info.ver = adev->gfx.mec2_fw_version;
-                        else
+                                fw_info.feature = adev->gfx.mec2_feature_version;
+                        } else
                                 return -EINVAL;
-                        fw_info.feature = 0;
                         break;
                 case AMDGPU_INFO_FW_SMC:
                         fw_info.ver = adev->pm.fw_version;
@@ -336,7 +337,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                         if (info->query_fw.index >= 2)
                                 return -EINVAL;
                         fw_info.ver = adev->sdma[info->query_fw.index].fw_version;
-                        fw_info.feature = 0;
+                        fw_info.feature = adev->sdma[info->query_fw.index].feature_version;
                         break;
                 default:
                         return -EINVAL;
@@ -416,7 +417,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 return n ? -EFAULT : 0;
         }
         case AMDGPU_INFO_DEV_INFO: {
-                struct drm_amdgpu_info_device dev_info;
+                struct drm_amdgpu_info_device dev_info = {};
                 struct amdgpu_cu_info cu_info;
 
                 dev_info.device_id = dev->pdev->device;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 2f7a5efa21c2..f5c22556ec2c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -374,7 +374,7 @@ static int amdgpu_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
         unsigned height_in_mb = ALIGN(height / 16, 2);
         unsigned fs_in_mb = width_in_mb * height_in_mb;
 
-        unsigned image_size, tmp, min_dpb_size, num_dpb_buffer;
+        unsigned image_size, tmp, min_dpb_size, num_dpb_buffer, min_ctx_size;
 
         image_size = width * height;
         image_size += image_size / 2;
@@ -466,6 +466,8 @@ static int amdgpu_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
 
                 num_dpb_buffer = (le32_to_cpu(msg[59]) & 0xff) + 2;
                 min_dpb_size = image_size * num_dpb_buffer;
+                min_ctx_size = ((width + 255) / 16) * ((height + 255) / 16)
+                                           * 16 * num_dpb_buffer + 52 * 1024;
                 break;
 
         default:
@@ -486,6 +488,7 @@ static int amdgpu_uvd_cs_msg_decode(uint32_t *msg, unsigned buf_sizes[])
 
         buf_sizes[0x1] = dpb_size;
         buf_sizes[0x2] = image_size;
+        buf_sizes[0x4] = min_ctx_size;
         return 0;
 }
 
@@ -628,6 +631,13 @@ static int amdgpu_uvd_cs_pass2(struct amdgpu_uvd_cs_ctx *ctx)
                         return -EINVAL;
                 }
 
+        } else if (cmd == 0x206) {
+                if ((end - start) < ctx->buf_sizes[4]) {
+                        DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
+                                          (unsigned)(end - start),
+                                          ctx->buf_sizes[4]);
+                        return -EINVAL;
+                }
         } else if ((cmd != 0x100) && (cmd != 0x204)) {
                 DRM_ERROR("invalid UVD command %X!\n", cmd);
                 return -EINVAL;
@@ -755,9 +765,10 @@ int amdgpu_uvd_ring_parse_cs(struct amdgpu_cs_parser *parser, uint32_t ib_idx)
         struct amdgpu_uvd_cs_ctx ctx = {};
         unsigned buf_sizes[] = {
                 [0x00000000]    =       2048,
-                [0x00000001]    =       32 * 1024 * 1024,
-                [0x00000002]    =       2048 * 1152 * 3,
+                [0x00000001]    =       0xFFFFFFFF,
+                [0x00000002]    =       0xFFFFFFFF,
                 [0x00000003]    =       2048,
+                [0x00000004]    =       0xFFFFFFFF,
         };
         struct amdgpu_ib *ib = &parser->ibs[ib_idx];
         int r;
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index ab83cc1ca4cc..15df46c93f0a 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -500,6 +500,7 @@ static int cik_sdma_load_microcode(struct amdgpu_device *adev)
                 amdgpu_ucode_print_sdma_hdr(&hdr->header);
                 fw_size = le32_to_cpu(hdr->header.ucode_size_bytes) / 4;
                 adev->sdma[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
+                adev->sdma[i].feature_version = le32_to_cpu(hdr->ucode_feature_version);
                 fw_data = (const __le32 *)
                         (adev->sdma[i].fw->data + le32_to_cpu(hdr->header.ucode_array_offset_bytes));
                 WREG32(mmSDMA0_UCODE_ADDR + sdma_offsets[i], 0);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 2c188fb9fd22..0d8bf2cb1956 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -2561,7 +2561,7 @@ static bool gfx_v7_0_ring_emit_semaphore(struct amdgpu_ring *ring,
  * sheduling on the ring.  This function schedules the IB
  * on the gfx ring for execution by the GPU.
  */
-static void gfx_v7_0_ring_emit_ib(struct amdgpu_ring *ring,
+static void gfx_v7_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
                                   struct amdgpu_ib *ib)
 {
         bool need_ctx_switch = ring->current_ctx != ib->ctx;
@@ -2569,15 +2569,10 @@ static void gfx_v7_0_ring_emit_ib(struct amdgpu_ring *ring,
         u32 next_rptr = ring->wptr + 5;
 
         /* drop the CE preamble IB for the same context */
-        if ((ring->type == AMDGPU_RING_TYPE_GFX) &&
-            (ib->flags & AMDGPU_IB_FLAG_PREAMBLE) &&
-            !need_ctx_switch)
+        if ((ib->flags & AMDGPU_IB_FLAG_PREAMBLE) && !need_ctx_switch)
                 return;
 
-        if (ring->type == AMDGPU_RING_TYPE_COMPUTE)
-                control |= INDIRECT_BUFFER_VALID;
-
-        if (need_ctx_switch && ring->type == AMDGPU_RING_TYPE_GFX)
+        if (need_ctx_switch)
                 next_rptr += 2;
 
         next_rptr += 4;
@@ -2588,7 +2583,7 @@ static void gfx_v7_0_ring_emit_ib(struct amdgpu_ring *ring,
         amdgpu_ring_write(ring, next_rptr);
 
         /* insert SWITCH_BUFFER packet before first IB in the ring frame */
-        if (need_ctx_switch && ring->type == AMDGPU_RING_TYPE_GFX) {
+        if (need_ctx_switch) {
                 amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
                 amdgpu_ring_write(ring, 0);
         }
@@ -2611,6 +2606,35 @@ static void gfx_v7_0_ring_emit_ib(struct amdgpu_ring *ring,
         amdgpu_ring_write(ring, control);
 }
 
+static void gfx_v7_0_ring_emit_ib_compute(struct amdgpu_ring *ring,
+                                  struct amdgpu_ib *ib)
+{
+        u32 header, control = 0;
+        u32 next_rptr = ring->wptr + 5;
+
+        control |= INDIRECT_BUFFER_VALID;
+        next_rptr += 4;
+        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+        amdgpu_ring_write(ring, WRITE_DATA_DST_SEL(5) | WR_CONFIRM);
+        amdgpu_ring_write(ring, ring->next_rptr_gpu_addr & 0xfffffffc);
+        amdgpu_ring_write(ring, upper_32_bits(ring->next_rptr_gpu_addr) & 0xffffffff);
+        amdgpu_ring_write(ring, next_rptr);
+
+        header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+        control |= ib->length_dw |
+                           (ib->vm ? (ib->vm->ids[ring->idx].id << 24) : 0);
+
+        amdgpu_ring_write(ring, header);
+        amdgpu_ring_write(ring,
+#ifdef __BIG_ENDIAN
+                                          (2 << 0) |
+#endif
+                                          (ib->gpu_addr & 0xFFFFFFFC));
+        amdgpu_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
+        amdgpu_ring_write(ring, control);
+}
+
 /**
  * gfx_v7_0_ring_test_ib - basic ring IB test
  *
@@ -3056,6 +3080,8 @@ static int gfx_v7_0_cp_compute_load_microcode(struct amdgpu_device *adev)
         mec_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.mec_fw->data;
         amdgpu_ucode_print_gfx_hdr(&mec_hdr->header);
         adev->gfx.mec_fw_version = le32_to_cpu(mec_hdr->header.ucode_version);
+        adev->gfx.mec_feature_version = le32_to_cpu(
+                                        mec_hdr->ucode_feature_version);
 
         gfx_v7_0_cp_compute_enable(adev, false);
 
@@ -3078,6 +3104,8 @@ static int gfx_v7_0_cp_compute_load_microcode(struct amdgpu_device *adev)
                 mec2_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.mec2_fw->data;
                 amdgpu_ucode_print_gfx_hdr(&mec2_hdr->header);
                 adev->gfx.mec2_fw_version = le32_to_cpu(mec2_hdr->header.ucode_version);
+                adev->gfx.mec2_feature_version = le32_to_cpu(
+                                mec2_hdr->ucode_feature_version);
 
                 /* MEC2 */
                 fw_data = (const __le32 *)
@@ -4042,6 +4070,8 @@ static int gfx_v7_0_rlc_resume(struct amdgpu_device *adev)
         hdr = (const struct rlc_firmware_header_v1_0 *)adev->gfx.rlc_fw->data;
         amdgpu_ucode_print_rlc_hdr(&hdr->header);
         adev->gfx.rlc_fw_version = le32_to_cpu(hdr->header.ucode_version);
+        adev->gfx.rlc_feature_version = le32_to_cpu(
+                                        hdr->ucode_feature_version);
 
         gfx_v7_0_rlc_stop(adev);
 
@@ -5098,7 +5128,7 @@ static void gfx_v7_0_print_status(void *handle)
                 dev_info(adev->dev, "  CP_HPD_EOP_CONTROL=0x%08X\n",
                          RREG32(mmCP_HPD_EOP_CONTROL));
 
-                for (queue = 0; queue < 8; i++) {
+                for (queue = 0; queue < 8; queue++) {
                         cik_srbm_select(adev, me, pipe, queue, 0);
                         dev_info(adev->dev, "  queue: %d\n", queue);
                         dev_info(adev->dev, "  CP_PQ_WPTR_POLL_CNTL=0x%08X\n",
@@ -5555,7 +5585,7 @@ static const struct amdgpu_ring_funcs gfx_v7_0_ring_funcs_gfx = {
         .get_wptr = gfx_v7_0_ring_get_wptr_gfx,
         .set_wptr = gfx_v7_0_ring_set_wptr_gfx,
         .parse_cs = NULL,
-        .emit_ib = gfx_v7_0_ring_emit_ib,
+        .emit_ib = gfx_v7_0_ring_emit_ib_gfx,
         .emit_fence = gfx_v7_0_ring_emit_fence_gfx,
         .emit_semaphore = gfx_v7_0_ring_emit_semaphore,
         .emit_vm_flush = gfx_v7_0_ring_emit_vm_flush,
@@ -5571,7 +5601,7 @@ static const struct amdgpu_ring_funcs gfx_v7_0_ring_funcs_compute = {
         .get_wptr = gfx_v7_0_ring_get_wptr_compute,
         .set_wptr = gfx_v7_0_ring_set_wptr_compute,
         .parse_cs = NULL,
-        .emit_ib = gfx_v7_0_ring_emit_ib,
+        .emit_ib = gfx_v7_0_ring_emit_ib_compute,
         .emit_fence = gfx_v7_0_ring_emit_fence_compute,
         .emit_semaphore = gfx_v7_0_ring_emit_semaphore,
         .emit_vm_flush = gfx_v7_0_ring_emit_vm_flush,
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 1c7c992dea37..20e2cfd521d5 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -587,6 +587,7 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
         int err;
         struct amdgpu_firmware_info *info = NULL;
         const struct common_firmware_header *header = NULL;
+        const struct gfx_firmware_header_v1_0 *cp_hdr;
 
         DRM_DEBUG("\n");
 
@@ -611,6 +612,9 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
         err = amdgpu_ucode_validate(adev->gfx.pfp_fw);
         if (err)
                 goto out;
+        cp_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.pfp_fw->data;
+        adev->gfx.pfp_fw_version = le32_to_cpu(cp_hdr->header.ucode_version);
+        adev->gfx.pfp_feature_version = le32_to_cpu(cp_hdr->ucode_feature_version);
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_me.bin", chip_name);
         err = request_firmware(&adev->gfx.me_fw, fw_name, adev->dev);
@@ -619,6 +623,9 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
         err = amdgpu_ucode_validate(adev->gfx.me_fw);
         if (err)
                 goto out;
+        cp_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.me_fw->data;
+        adev->gfx.me_fw_version = le32_to_cpu(cp_hdr->header.ucode_version);
+        adev->gfx.me_feature_version = le32_to_cpu(cp_hdr->ucode_feature_version);
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ce.bin", chip_name);
         err = request_firmware(&adev->gfx.ce_fw, fw_name, adev->dev);
@@ -627,12 +634,18 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
         err = amdgpu_ucode_validate(adev->gfx.ce_fw);
         if (err)
                 goto out;
+        cp_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.ce_fw->data;
+        adev->gfx.ce_fw_version = le32_to_cpu(cp_hdr->header.ucode_version);
+        adev->gfx.ce_feature_version = le32_to_cpu(cp_hdr->ucode_feature_version);
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
         err = request_firmware(&adev->gfx.rlc_fw, fw_name, adev->dev);
         if (err)
                 goto out;
         err = amdgpu_ucode_validate(adev->gfx.rlc_fw);
+        cp_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.rlc_fw->data;
+        adev->gfx.rlc_fw_version = le32_to_cpu(cp_hdr->header.ucode_version);
+        adev->gfx.rlc_feature_version = le32_to_cpu(cp_hdr->ucode_feature_version);
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
         err = request_firmware(&adev->gfx.mec_fw, fw_name, adev->dev);
@@ -641,6 +654,9 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
         err = amdgpu_ucode_validate(adev->gfx.mec_fw);
         if (err)
                 goto out;
+        cp_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.mec_fw->data;
+        adev->gfx.mec_fw_version = le32_to_cpu(cp_hdr->header.ucode_version);
+        adev->gfx.mec_feature_version = le32_to_cpu(cp_hdr->ucode_feature_version);
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec2.bin", chip_name);
         err = request_firmware(&adev->gfx.mec2_fw, fw_name, adev->dev);
@@ -648,6 +664,12 @@ static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
                 err = amdgpu_ucode_validate(adev->gfx.mec2_fw);
                 if (err)
                         goto out;
+                cp_hdr = (const struct gfx_firmware_header_v1_0 *)
+                                                adev->gfx.mec2_fw->data;
+                adev->gfx.mec2_fw_version = le32_to_cpu(
+                                                cp_hdr->header.ucode_version);
+                adev->gfx.mec2_feature_version = le32_to_cpu(
+                                                cp_hdr->ucode_feature_version);
         } else {
                 err = 0;
                 adev->gfx.mec2_fw = NULL;
@@ -1983,6 +2005,7 @@ static void gfx_v8_0_gpu_init(struct amdgpu_device *adev)
                 adev->gfx.config.max_shader_engines = 1;
                 adev->gfx.config.max_tile_pipes = 2;
                 adev->gfx.config.max_sh_per_se = 1;
+                adev->gfx.config.max_backends_per_se = 2;
 
                 switch (adev->pdev->revision) {
                 case 0xc4:
@@ -1991,7 +2014,6 @@ static void gfx_v8_0_gpu_init(struct amdgpu_device *adev)
                 case 0xcc:
                         /* B10 */
                         adev->gfx.config.max_cu_per_sh = 8;
-                        adev->gfx.config.max_backends_per_se = 2;
                         break;
                 case 0xc5:
                 case 0x81:
@@ -2000,14 +2022,12 @@ static void gfx_v8_0_gpu_init(struct amdgpu_device *adev)
                 case 0xcd:
                         /* B8 */
                         adev->gfx.config.max_cu_per_sh = 6;
-                        adev->gfx.config.max_backends_per_se = 2;
                         break;
                 case 0xc6:
                 case 0xca:
                 case 0xce:
                         /* B6 */
                         adev->gfx.config.max_cu_per_sh = 6;
-                        adev->gfx.config.max_backends_per_se = 2;
                         break;
                 case 0xc7:
                 case 0x87:
@@ -2015,7 +2035,6 @@ static void gfx_v8_0_gpu_init(struct amdgpu_device *adev)
                 default:
                         /* B4 */
                         adev->gfx.config.max_cu_per_sh = 4;
-                        adev->gfx.config.max_backends_per_se = 1;
                         break;
                 }
 
@@ -2275,7 +2294,6 @@ static int gfx_v8_0_rlc_load_microcode(struct amdgpu_device *adev)
 
         hdr = (const struct rlc_firmware_header_v2_0 *)adev->gfx.rlc_fw->data;
         amdgpu_ucode_print_rlc_hdr(&hdr->header);
-        adev->gfx.rlc_fw_version = le32_to_cpu(hdr->header.ucode_version);
 
         fw_data = (const __le32 *)(adev->gfx.rlc_fw->data +
                            le32_to_cpu(hdr->header.ucode_array_offset_bytes));
@@ -2361,12 +2379,6 @@ static int gfx_v8_0_cp_gfx_load_microcode(struct amdgpu_device *adev)
         amdgpu_ucode_print_gfx_hdr(&pfp_hdr->header);
         amdgpu_ucode_print_gfx_hdr(&ce_hdr->header);
         amdgpu_ucode_print_gfx_hdr(&me_hdr->header);
-        adev->gfx.pfp_fw_version = le32_to_cpu(pfp_hdr->header.ucode_version);
-        adev->gfx.ce_fw_version = le32_to_cpu(ce_hdr->header.ucode_version);
-        adev->gfx.me_fw_version = le32_to_cpu(me_hdr->header.ucode_version);
-        adev->gfx.me_feature_version = le32_to_cpu(me_hdr->ucode_feature_version);
-        adev->gfx.ce_feature_version = le32_to_cpu(ce_hdr->ucode_feature_version);
-        adev->gfx.pfp_feature_version = le32_to_cpu(pfp_hdr->ucode_feature_version);
 
         gfx_v8_0_cp_gfx_enable(adev, false);
 
@@ -2622,7 +2634,6 @@ static int gfx_v8_0_cp_compute_load_microcode(struct amdgpu_device *adev)
 
         mec_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.mec_fw->data;
         amdgpu_ucode_print_gfx_hdr(&mec_hdr->header);
-        adev->gfx.mec_fw_version = le32_to_cpu(mec_hdr->header.ucode_version);
 
         fw_data = (const __le32 *)
                 (adev->gfx.mec_fw->data +
@@ -2641,7 +2652,6 @@ static int gfx_v8_0_cp_compute_load_microcode(struct amdgpu_device *adev)
 
                 mec2_hdr = (const struct gfx_firmware_header_v1_0 *)adev->gfx.mec2_fw->data;
                 amdgpu_ucode_print_gfx_hdr(&mec2_hdr->header);
-                adev->gfx.mec2_fw_version = le32_to_cpu(mec2_hdr->header.ucode_version);
 
                 fw_data = (const __le32 *)
                         (adev->gfx.mec2_fw->data +
@@ -3125,7 +3135,7 @@ static int gfx_v8_0_cp_compute_resume(struct amdgpu_device *adev)
                                 WREG32(mmCP_MEC_DOORBELL_RANGE_LOWER,
                                        AMDGPU_DOORBELL_KIQ << 2);
                                 WREG32(mmCP_MEC_DOORBELL_RANGE_UPPER,
-                                                0x7FFFF << 2);
+                                       AMDGPU_DOORBELL_MEC_RING7 << 2);
                         }
                         tmp = RREG32(mmCP_HQD_PQ_DOORBELL_CONTROL);
                         tmp = REG_SET_FIELD(tmp, CP_HQD_PQ_DOORBELL_CONTROL,
@@ -3753,7 +3763,7 @@ static void gfx_v8_0_ring_emit_hdp_flush(struct amdgpu_ring *ring)
         amdgpu_ring_write(ring, 0x20); /* poll interval */
 }
 
-static void gfx_v8_0_ring_emit_ib(struct amdgpu_ring *ring,
+static void gfx_v8_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,
                                   struct amdgpu_ib *ib)
 {
         bool need_ctx_switch = ring->current_ctx != ib->ctx;
@@ -3761,15 +3771,10 @@ static void gfx_v8_0_ring_emit_ib(struct amdgpu_ring *ring,
         u32 next_rptr = ring->wptr + 5;
 
         /* drop the CE preamble IB for the same context */
-        if ((ring->type == AMDGPU_RING_TYPE_GFX) &&
-            (ib->flags & AMDGPU_IB_FLAG_PREAMBLE) &&
-            !need_ctx_switch)
+        if ((ib->flags & AMDGPU_IB_FLAG_PREAMBLE) && !need_ctx_switch)
                 return;
 
-        if (ring->type == AMDGPU_RING_TYPE_COMPUTE)
-                control |= INDIRECT_BUFFER_VALID;
-
-        if (need_ctx_switch && ring->type == AMDGPU_RING_TYPE_GFX)
+        if (need_ctx_switch)
                 next_rptr += 2;
 
         next_rptr += 4;
@@ -3780,7 +3785,7 @@ static void gfx_v8_0_ring_emit_ib(struct amdgpu_ring *ring,
         amdgpu_ring_write(ring, next_rptr);
 
         /* insert SWITCH_BUFFER packet before first IB in the ring frame */
-        if (need_ctx_switch && ring->type == AMDGPU_RING_TYPE_GFX) {
+        if (need_ctx_switch) {
                 amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
                 amdgpu_ring_write(ring, 0);
         }
@@ -3803,6 +3808,36 @@ static void gfx_v8_0_ring_emit_ib(struct amdgpu_ring *ring,
         amdgpu_ring_write(ring, control);
 }
 
+static void gfx_v8_0_ring_emit_ib_compute(struct amdgpu_ring *ring,
+                                  struct amdgpu_ib *ib)
+{
+        u32 header, control = 0;
+        u32 next_rptr = ring->wptr + 5;
+
+        control |= INDIRECT_BUFFER_VALID;
+
+        next_rptr += 4;
+        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+        amdgpu_ring_write(ring, WRITE_DATA_DST_SEL(5) | WR_CONFIRM);
+        amdgpu_ring_write(ring, ring->next_rptr_gpu_addr & 0xfffffffc);
+        amdgpu_ring_write(ring, upper_32_bits(ring->next_rptr_gpu_addr) & 0xffffffff);
+        amdgpu_ring_write(ring, next_rptr);
+
+        header = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+
+        control |= ib->length_dw |
+                           (ib->vm ? (ib->vm->ids[ring->idx].id << 24) : 0);
+
+        amdgpu_ring_write(ring, header);
+        amdgpu_ring_write(ring,
+#ifdef __BIG_ENDIAN
+                                          (2 << 0) |
+#endif
+                                          (ib->gpu_addr & 0xFFFFFFFC));
+        amdgpu_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
+        amdgpu_ring_write(ring, control);
+}
+
 static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr,
                                          u64 seq, unsigned flags)
 {
@@ -4224,7 +4259,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = {
         .get_wptr = gfx_v8_0_ring_get_wptr_gfx,
         .set_wptr = gfx_v8_0_ring_set_wptr_gfx,
         .parse_cs = NULL,
-        .emit_ib = gfx_v8_0_ring_emit_ib,
+        .emit_ib = gfx_v8_0_ring_emit_ib_gfx,
         .emit_fence = gfx_v8_0_ring_emit_fence_gfx,
         .emit_semaphore = gfx_v8_0_ring_emit_semaphore,
         .emit_vm_flush = gfx_v8_0_ring_emit_vm_flush,
@@ -4240,7 +4275,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_compute = {
         .get_wptr = gfx_v8_0_ring_get_wptr_compute,
         .set_wptr = gfx_v8_0_ring_set_wptr_compute,
         .parse_cs = NULL,
-        .emit_ib = gfx_v8_0_ring_emit_ib,
+        .emit_ib = gfx_v8_0_ring_emit_ib_compute,
         .emit_fence = gfx_v8_0_ring_emit_fence_compute,
         .emit_semaphore = gfx_v8_0_ring_emit_semaphore,
         .emit_vm_flush = gfx_v8_0_ring_emit_vm_flush,
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
index d7895885fe0c..a988dfb1d394 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
@@ -121,6 +121,7 @@ static int sdma_v2_4_init_microcode(struct amdgpu_device *adev)
         int err, i;
         struct amdgpu_firmware_info *info = NULL;
         const struct common_firmware_header *header = NULL;
+        const struct sdma_firmware_header_v1_0 *hdr;
 
         DRM_DEBUG("\n");
 
@@ -142,6 +143,9 @@ static int sdma_v2_4_init_microcode(struct amdgpu_device *adev)
                 err = amdgpu_ucode_validate(adev->sdma[i].fw);
                 if (err)
                         goto out;
+                hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma[i].fw->data;
+                adev->sdma[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
+                adev->sdma[i].feature_version = le32_to_cpu(hdr->ucode_feature_version);
 
                 if (adev->firmware.smu_load) {
                         info = &adev->firmware.ucode[AMDGPU_UCODE_ID_SDMA0 + i];
@@ -541,8 +545,6 @@ static int sdma_v2_4_load_microcode(struct amdgpu_device *adev)
                         hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma[i].fw->data;
                         amdgpu_ucode_print_sdma_hdr(&hdr->header);
                         fw_size = le32_to_cpu(hdr->header.ucode_size_bytes) / 4;
-                        adev->sdma[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
-
                         fw_data = (const __le32 *)
                                 (adev->sdma[i].fw->data +
                                  le32_to_cpu(hdr->header.ucode_array_offset_bytes));
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index 7bb37b93993f..2b86569b18d3 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -159,6 +159,7 @@ static int sdma_v3_0_init_microcode(struct amdgpu_device *adev)
         int err, i;
         struct amdgpu_firmware_info *info = NULL;
         const struct common_firmware_header *header = NULL;
+        const struct sdma_firmware_header_v1_0 *hdr;
 
         DRM_DEBUG("\n");
 
@@ -183,6 +184,9 @@ static int sdma_v3_0_init_microcode(struct amdgpu_device *adev)
                 err = amdgpu_ucode_validate(adev->sdma[i].fw);
                 if (err)
                         goto out;
+                hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma[i].fw->data;
+                adev->sdma[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
+                adev->sdma[i].feature_version = le32_to_cpu(hdr->ucode_feature_version);
 
                 if (adev->firmware.smu_load) {
                         info = &adev->firmware.ucode[AMDGPU_UCODE_ID_SDMA0 + i];
@@ -630,8 +634,6 @@ static int sdma_v3_0_load_microcode(struct amdgpu_device *adev)
                 hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma[i].fw->data;
                 amdgpu_ucode_print_sdma_hdr(&hdr->header);
                 fw_size = le32_to_cpu(hdr->header.ucode_size_bytes) / 4;
-                adev->sdma[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
-
                 fw_data = (const __le32 *)
                         (adev->sdma[i].fw->data +
                                 le32_to_cpu(hdr->header.ucode_array_offset_bytes));
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 5b59d5ad7d1c..9dcc7280e572 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -196,7 +196,12 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
         }
 
         funcs = connector->helper_private;
-        new_encoder = funcs->best_encoder(connector);
+
+        if (funcs->atomic_best_encoder)
+                new_encoder = funcs->atomic_best_encoder(connector,
+                                                         connector_state);
+        else
+                new_encoder = funcs->best_encoder(connector);
 
         if (!new_encoder) {
                 DRM_DEBUG_ATOMIC("No suitable encoder found for [CONNECTOR:%d:%s]\n",
@@ -229,6 +234,9 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
                 }
         }
 
+        if (WARN_ON(!connector_state->crtc))
+                return -EINVAL;
+
         connector_state->best_encoder = new_encoder;
         idx = drm_crtc_index(connector_state->crtc);
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 778bbb6425b8..b0487c9f018c 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1294,7 +1294,6 @@ retry:
                                 goto retry;
                         }
                         DRM_DEBUG_KMS("failed to dpcd write %d %d\n", tosend, ret);
-                        WARN(1, "fail\n");
 
                         return -EIO;
                 }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index f9cc68fbd2a3..b50fa0afd907 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -75,7 +75,7 @@ module_param_named(timestamp_precision_usec, drm_timestamp_precision, int, 0600)
 module_param_named(timestamp_monotonic, drm_timestamp_monotonic, int, 0600);
 
 static void store_vblank(struct drm_device *dev, int crtc,
-                         unsigned vblank_count_inc,
+                         u32 vblank_count_inc,
                          struct timeval *t_vblank)
 {
         struct drm_vblank_crtc *vblank = &dev->vblank[crtc];
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index fe1599d75f14..424228be79ae 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -606,8 +606,6 @@ static void
 tda998x_write_if(struct tda998x_priv *priv, uint8_t bit, uint16_t addr,
                  uint8_t *buf, size_t size)
 {
-        buf[PB(0)] = tda998x_cksum(buf, size);
-
         reg_clear(priv, REG_DIP_IF_FLAGS, bit);
         reg_write_range(priv, addr, buf, size);
         reg_set(priv, REG_DIP_IF_FLAGS, bit);
@@ -627,6 +625,8 @@ tda998x_write_aif(struct tda998x_priv *priv, struct tda998x_encoder_params *p)
         buf[PB(4)] = p->audio_frame[4];
         buf[PB(5)] = p->audio_frame[5] & 0xf8; /* DM_INH + LSV */
 
+        buf[PB(0)] = tda998x_cksum(buf, sizeof(buf));
+
         tda998x_write_if(priv, DIP_IF_FLAGS_IF4, REG_IF4_HB0, buf,
                          sizeof(buf));
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 5f27290201e0..fd1de451c8c6 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3303,15 +3303,14 @@ int intel_freq_opcode(struct drm_i915_private *dev_priv, int val);
 #define I915_READ64(reg)        dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true)
 
 #define I915_READ64_2x32(lower_reg, upper_reg) ({                       \
-                u32 upper = I915_READ(upper_reg);                       \
-                u32 lower = I915_READ(lower_reg);                       \
-                u32 tmp = I915_READ(upper_reg);                         \
-                if (upper != tmp) {                                     \
-                        upper = tmp;                                    \
-                        lower = I915_READ(lower_reg);                   \
-                        WARN_ON(I915_READ(upper_reg) != upper);         \
-                }                                                       \
-                (u64)upper << 32 | lower; })
+        u32 upper, lower, tmp;                                          \
+        tmp = I915_READ(upper_reg);                                     \
+        do {                                                            \
+                upper = tmp;                                            \
+                lower = I915_READ(lower_reg);                           \
+                tmp = I915_READ(upper_reg);                             \
+        } while (upper != tmp);                                         \
+        (u64)upper << 32 | lower; })
 
 #define POSTING_READ(reg)       (void)I915_READ_NOTRACE(reg)
 #define POSTING_READ16(reg)     (void)I915_READ16_NOTRACE(reg)
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 56b52a4767d4..31e8269e6e3d 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1923,6 +1923,17 @@ static int ggtt_bind_vma(struct i915_vma *vma,
                 vma->vm->insert_entries(vma->vm, pages,
                                         vma->node.start,
                                         cache_level, pte_flags);
+
+                /* Note the inconsistency here is due to absence of the
+                 * aliasing ppgtt on gen4 and earlier. Though we always
+                 * request PIN_USER for execbuffer (translated to LOCAL_BIND),
+                 * without the appgtt, we cannot honour that request and so
+                 * must substitute it with a global binding. Since we do this
+                 * behind the upper layers back, we need to explicitly set
+                 * the bound flag ourselves.
+                 */
+                vma->bound |= GLOBAL_BIND;
+
         }
 
         if (dev_priv->mm.aliasing_ppgtt && flags & LOCAL_BIND) {
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 633bd1fcab69..d19c9db5e18c 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -464,7 +464,10 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
         }
 
         /* Hide bit 17 from the user -- see comment in i915_gem_set_tiling */
-        args->phys_swizzle_mode = args->swizzle_mode;
+        if (dev_priv->quirks & QUIRK_PIN_SWIZZLED_PAGES)
+                args->phys_swizzle_mode = I915_BIT_6_SWIZZLE_UNKNOWN;
+        else
+                args->phys_swizzle_mode = args->swizzle_mode;
         if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_17)
                 args->swizzle_mode = I915_BIT_6_SWIZZLE_9;
         if (args->swizzle_mode == I915_BIT_6_SWIZZLE_9_10_17)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 198fc3c3291b..3dcd59e694db 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1075,15 +1075,34 @@ parse_device_mapping(struct drm_i915_private *dev_priv,
         const union child_device_config *p_child;
         union child_device_config *child_dev_ptr;
         int i, child_device_num, count;
-        u16     block_size;
+        u8 expected_size;
+        u16 block_size;
 
         p_defs = find_section(bdb, BDB_GENERAL_DEFINITIONS);
         if (!p_defs) {
                 DRM_DEBUG_KMS("No general definition block is found, no devices defined.\n");
                 return;
         }
-        if (p_defs->child_dev_size < sizeof(*p_child)) {
-                DRM_ERROR("General definiton block child device size is too small.\n");
+        if (bdb->version < 195) {
+                expected_size = 33;
+        } else if (bdb->version == 195) {
+                expected_size = 37;
+        } else if (bdb->version <= 197) {
+                expected_size = 38;
+        } else {
+                expected_size = 38;
+                DRM_DEBUG_DRIVER("Expected child_device_config size for BDB version %u not known; assuming %u\n",
+                                 expected_size, bdb->version);
+        }
+
+        if (expected_size > sizeof(*p_child)) {
+                DRM_ERROR("child_device_config cannot fit in p_child\n");
+                return;
+        }
+
+        if (p_defs->child_dev_size != expected_size) {
+                DRM_ERROR("Size mismatch; child_device_config size=%u (expected %u); bdb->version: %u\n",
+                          p_defs->child_dev_size, expected_size, bdb->version);
                 return;
         }
         /* get the block size of general definitions */
@@ -1130,7 +1149,7 @@ parse_device_mapping(struct drm_i915_private *dev_priv,
 
                 child_dev_ptr = dev_priv->vbt.child_dev + count;
                 count++;
-                memcpy(child_dev_ptr, p_child, sizeof(*p_child));
+                memcpy(child_dev_ptr, p_child, p_defs->child_dev_size);
         }
         return;
 }
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 6e4cc5334f47..600afdbef8c9 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -357,6 +357,16 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
+static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *connector,
+                                                         struct drm_connector_state *state)
+{
+        struct intel_connector *intel_connector = to_intel_connector(connector);
+        struct intel_dp *intel_dp = intel_connector->mst_port;
+        struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+        return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+}
+
 static struct drm_encoder *intel_mst_best_encoder(struct drm_connector *connector)
 {
         struct intel_connector *intel_connector = to_intel_connector(connector);
@@ -367,6 +377,7 @@ static struct drm_encoder *intel_mst_best_encoder(struct drm_connector *connecto
 static const struct drm_connector_helper_funcs intel_dp_mst_connector_helper_funcs = {
         .get_modes = intel_dp_mst_get_modes,
         .mode_valid = intel_dp_mst_mode_valid,
+        .atomic_best_encoder = intel_mst_atomic_best_encoder,
         .best_encoder = intel_mst_best_encoder,
 };
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
index 0d1dbb737933..247a424445f7 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c
@@ -220,13 +220,15 @@ static int mdp4_plane_mode_set(struct drm_plane *plane,
         uint32_t op_mode = 0;
         uint32_t phasex_step = MDP4_VG_PHASE_STEP_DEFAULT;
         uint32_t phasey_step = MDP4_VG_PHASE_STEP_DEFAULT;
-        enum mdp4_frame_format frame_type = mdp4_get_frame_format(fb);
+        enum mdp4_frame_format frame_type;
 
         if (!(crtc && fb)) {
                 DBG("%s: disabled!", mdp4_plane->name);
                 return 0;
         }
 
+        frame_type = mdp4_get_frame_format(fb);
+
         /* src values are in Q16 fixed point, convert to integer: */
         src_x = src_x >> 16;
         src_y = src_y >> 16;
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 206f758f7d64..e253db5de5aa 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -76,7 +76,20 @@ static void mdp5_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *st
 
 static void mdp5_complete_commit(struct msm_kms *kms, struct drm_atomic_state *state)
 {
+        int i;
         struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(kms));
+        int nplanes = mdp5_kms->dev->mode_config.num_total_plane;
+
+        for (i = 0; i < nplanes; i++) {
+                struct drm_plane *plane = state->planes[i];
+                struct drm_plane_state *plane_state = state->plane_states[i];
+
+                if (!plane)
+                        continue;
+
+                mdp5_plane_complete_commit(plane, plane_state);
+        }
+
         mdp5_disable(mdp5_kms);
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
index e0eb24587c84..e79ac09b7216 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.h
@@ -227,6 +227,8 @@ void mdp5_plane_install_properties(struct drm_plane *plane,
                 struct drm_mode_object *obj);
 uint32_t mdp5_plane_get_flush(struct drm_plane *plane);
 void mdp5_plane_complete_flip(struct drm_plane *plane);
+void mdp5_plane_complete_commit(struct drm_plane *plane,
+        struct drm_plane_state *state);
 enum mdp5_pipe mdp5_plane_pipe(struct drm_plane *plane);
 struct drm_plane *mdp5_plane_init(struct drm_device *dev,
                 enum mdp5_pipe pipe, bool private_plane, uint32_t reg_offset);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index 57b8f56ae9d0..22275568ab8b 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -31,8 +31,6 @@ struct mdp5_plane {
 
         uint32_t nformats;
         uint32_t formats[32];
-
-        bool enabled;
 };
 #define to_mdp5_plane(x) container_of(x, struct mdp5_plane, base)
 
@@ -56,22 +54,6 @@ static bool plane_enabled(struct drm_plane_state *state)
         return state->fb && state->crtc;
 }
 
-static int mdp5_plane_disable(struct drm_plane *plane)
-{
-        struct mdp5_plane *mdp5_plane = to_mdp5_plane(plane);
-        struct mdp5_kms *mdp5_kms = get_kms(plane);
-        enum mdp5_pipe pipe = mdp5_plane->pipe;
-
-        DBG("%s: disable", mdp5_plane->name);
-
-        if (mdp5_kms) {
-                /* Release the memory we requested earlier from the SMP: */
-                mdp5_smp_release(mdp5_kms->smp, pipe);
-        }
-
-        return 0;
-}
-
 static void mdp5_plane_destroy(struct drm_plane *plane)
 {
         struct mdp5_plane *mdp5_plane = to_mdp5_plane(plane);
@@ -224,7 +206,6 @@ static void mdp5_plane_atomic_update(struct drm_plane *plane,
 
         if (!plane_enabled(state)) {
                 to_mdp5_plane_state(state)->pending = true;
-                mdp5_plane_disable(plane);
         } else if (to_mdp5_plane_state(state)->mode_changed) {
                 int ret;
                 to_mdp5_plane_state(state)->pending = true;
@@ -602,6 +583,20 @@ uint32_t mdp5_plane_get_flush(struct drm_plane *plane)
         return mdp5_plane->flush_mask;
 }
 
+/* called after vsync in thread context */
+void mdp5_plane_complete_commit(struct drm_plane *plane,
+        struct drm_plane_state *state)
+{
+        struct mdp5_kms *mdp5_kms = get_kms(plane);
+        struct mdp5_plane *mdp5_plane = to_mdp5_plane(plane);
+        enum mdp5_pipe pipe = mdp5_plane->pipe;
+
+        if (!plane_enabled(plane->state)) {
+                DBG("%s: free SMP", mdp5_plane->name);
+                mdp5_smp_release(mdp5_kms->smp, pipe);
+        }
+}
+
 /* initialize plane */
 struct drm_plane *mdp5_plane_init(struct drm_device *dev,
                 enum mdp5_pipe pipe, bool private_plane, uint32_t reg_offset)
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c
index 16702aecf0df..64a27d86f2f5 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c
@@ -34,22 +34,44 @@
  * and CANNOT be re-allocated (eg: MMB0 and MMB1 both tied to RGB0).
  *
  * For each block that can be dynamically allocated, it can be either
- * free, or pending/in-use by a client. The updates happen in three steps:
+ *     free:
+ *     The block is free.
+ *
+ *     pending:
+ *     The block is allocated to some client and not free.
+ *
+ *     configured:
+ *     The block is allocated to some client, and assigned to that
+ *     client in MDP5_MDP_SMP_ALLOC registers.
+ *
+ *     inuse:
+ *     The block is being actively used by a client.
+ *
+ * The updates happen in the following steps:
  *
  *  1) mdp5_smp_request():
  *     When plane scanout is setup, calculate required number of
- *     blocks needed per client, and request.  Blocks not inuse or
- *     pending by any other client are added to client's pending
- *     set.
+ *     blocks needed per client, and request. Blocks neither inuse nor
+ *     configured nor pending by any other client are added to client's
+ *     pending set.
+ *     For shrinking, blocks in pending but not in configured can be freed
+ *     directly, but those already in configured will be freed later by
+ *     mdp5_smp_commit.
  *
  *  2) mdp5_smp_configure():
  *     As hw is programmed, before FLUSH, MDP5_MDP_SMP_ALLOC registers
  *     are configured for the union(pending, inuse)
+ *     Current pending is copied to configured.
+ *     It is assumed that mdp5_smp_request and mdp5_smp_configure not run
+ *     concurrently for the same pipe.
  *
  *  3) mdp5_smp_commit():
- *     After next vblank, copy pending -> inuse.  Optionally update
+ *     After next vblank, copy configured -> inuse.  Optionally update
  *     MDP5_SMP_ALLOC registers if there are newly unused blocks
  *
+ *  4) mdp5_smp_release():
+ *     Must be called after the pipe is disabled and no longer uses any SMB
+ *
  * On the next vblank after changes have been committed to hw, the
  * client's pending blocks become it's in-use blocks (and no-longer
  * in-use blocks become available to other clients).
@@ -77,6 +99,9 @@ struct mdp5_smp {
         struct mdp5_client_smp_state client_state[MAX_CLIENTS];
 };
 
+static void update_smp_state(struct mdp5_smp *smp,
+                u32 cid, mdp5_smp_state_t *assigned);
+
 static inline
 struct mdp5_kms *get_kms(struct mdp5_smp *smp)
 {
@@ -149,7 +174,12 @@ static int smp_request_block(struct mdp5_smp *smp,
                 for (i = cur_nblks; i > nblks; i--) {
                         int blk = find_first_bit(ps->pending, cnt);
                         clear_bit(blk, ps->pending);
-                        /* don't clear in global smp_state until _commit() */
+
+                        /* clear in global smp_state if not in configured
+                         * otherwise until _commit()
+                         */
+                        if (!test_bit(blk, ps->configured))
+                                clear_bit(blk, smp->state);
                 }
         }
 
@@ -223,10 +253,33 @@ int mdp5_smp_request(struct mdp5_smp *smp, enum mdp5_pipe pipe, u32 fmt, u32 wid
 /* Release SMP blocks for all clients of the pipe */
 void mdp5_smp_release(struct mdp5_smp *smp, enum mdp5_pipe pipe)
 {
-        int i, nblks;
+        int i;
+        unsigned long flags;
+        int cnt = smp->blk_cnt;
+
+        for (i = 0; i < pipe2nclients(pipe); i++) {
+                mdp5_smp_state_t assigned;
+                u32 cid = pipe2client(pipe, i);
+                struct mdp5_client_smp_state *ps = &smp->client_state[cid];
+
+                spin_lock_irqsave(&smp->state_lock, flags);
+
+                /* clear hw assignment */
+                bitmap_or(assigned, ps->inuse, ps->configured, cnt);
+                update_smp_state(smp, CID_UNUSED, &assigned);
+
+                /* free to global pool */
+                bitmap_andnot(smp->state, smp->state, ps->pending, cnt);
+                bitmap_andnot(smp->state, smp->state, assigned, cnt);
+
+                /* clear client's infor */
+                bitmap_zero(ps->pending, cnt);
+                bitmap_zero(ps->configured, cnt);
+                bitmap_zero(ps->inuse, cnt);
+
+                spin_unlock_irqrestore(&smp->state_lock, flags);
+        }
 
-        for (i = 0, nblks = 0; i < pipe2nclients(pipe); i++)
-                smp_request_block(smp, pipe2client(pipe, i), 0);
         set_fifo_thresholds(smp, pipe, 0);
 }
 
@@ -274,12 +327,20 @@ void mdp5_smp_configure(struct mdp5_smp *smp, enum mdp5_pipe pipe)
                 u32 cid = pipe2client(pipe, i);
                 struct mdp5_client_smp_state *ps = &smp->client_state[cid];
 
-                bitmap_or(assigned, ps->inuse, ps->pending, cnt);
+                /*
+                 * if vblank has not happened since last smp_configure
+                 * skip the configure for now
+                 */
+                if (!bitmap_equal(ps->inuse, ps->configured, cnt))
+                        continue;
+
+                bitmap_copy(ps->configured, ps->pending, cnt);
+                bitmap_or(assigned, ps->inuse, ps->configured, cnt);
                 update_smp_state(smp, cid, &assigned);
         }
 }
 
-/* step #3: after vblank, copy pending -> inuse: */
+/* step #3: after vblank, copy configured -> inuse: */
 void mdp5_smp_commit(struct mdp5_smp *smp, enum mdp5_pipe pipe)
 {
         int cnt = smp->blk_cnt;
@@ -295,7 +356,7 @@ void mdp5_smp_commit(struct mdp5_smp *smp, enum mdp5_pipe pipe)
                  * using, which can be released and made available to other
                  * clients:
                  */
-                if (bitmap_andnot(released, ps->inuse, ps->pending, cnt)) {
+                if (bitmap_andnot(released, ps->inuse, ps->configured, cnt)) {
                         unsigned long flags;
 
                         spin_lock_irqsave(&smp->state_lock, flags);
@@ -306,7 +367,7 @@ void mdp5_smp_commit(struct mdp5_smp *smp, enum mdp5_pipe pipe)
                         update_smp_state(smp, CID_UNUSED, &released);
                 }
 
-                bitmap_copy(ps->inuse, ps->pending, cnt);
+                bitmap_copy(ps->inuse, ps->configured, cnt);
         }
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.h
index e47179f63585..5b6c2363f592 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.h
@@ -23,6 +23,7 @@
 
 struct mdp5_client_smp_state {
         mdp5_smp_state_t inuse;
+        mdp5_smp_state_t configured;
         mdp5_smp_state_t pending;
 };
 
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 1b22d8bfe142..1ceb4f22dd89 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -283,12 +283,8 @@ int msm_atomic_commit(struct drm_device *dev,
 
         timeout = ktime_add_ms(ktime_get(), 1000);
 
-        ret = msm_wait_fence_interruptable(dev, c->fence, &timeout);
-        if (ret) {
-                WARN_ON(ret);  // TODO unswap state back?  or??
-                commit_destroy(c);
-                return ret;
-        }
+        /* uninterruptible wait */
+        msm_wait_fence(dev, c->fence, &timeout, false);
 
         complete_commit(c);
 
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index b7ef56ed8d1c..d3467b115e04 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -637,8 +637,8 @@ static void msm_debugfs_cleanup(struct drm_minor *minor)
  * Fences:
  */
 
-int msm_wait_fence_interruptable(struct drm_device *dev, uint32_t fence,
-                ktime_t *timeout)
+int msm_wait_fence(struct drm_device *dev, uint32_t fence,
+                ktime_t *timeout , bool interruptible)
 {
         struct msm_drm_private *priv = dev->dev_private;
         int ret;
@@ -667,7 +667,12 @@ int msm_wait_fence_interruptable(struct drm_device *dev, uint32_t fence,
                         remaining_jiffies = timespec_to_jiffies(&ts);
                 }
 
-                ret = wait_event_interruptible_timeout(priv->fence_event,
+                if (interruptible)
+                        ret = wait_event_interruptible_timeout(priv->fence_event,
+                                fence_completed(dev, fence),
+                                remaining_jiffies);
+                else
+                        ret = wait_event_timeout(priv->fence_event,
                                 fence_completed(dev, fence),
                                 remaining_jiffies);
 
@@ -853,7 +858,7 @@ static int msm_ioctl_wait_fence(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
 
-        return msm_wait_fence_interruptable(dev, args->fence, &timeout);
+        return msm_wait_fence(dev, args->fence, &timeout, true);
 }
 
 static const struct drm_ioctl_desc msm_ioctls[] = {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index e7c5ea125d45..4ff0ec9c994b 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -164,8 +164,8 @@ int msm_atomic_commit(struct drm_device *dev,
 
 int msm_register_mmu(struct drm_device *dev, struct msm_mmu *mmu);
 
-int msm_wait_fence_interruptable(struct drm_device *dev, uint32_t fence,
-                ktime_t *timeout);
+int msm_wait_fence(struct drm_device *dev, uint32_t fence,
+                ktime_t *timeout, bool interruptible);
 int msm_queue_fence_cb(struct drm_device *dev,
                 struct msm_fence_cb *cb, uint32_t fence);
 void msm_update_fence(struct drm_device *dev, uint32_t fence);
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index f211b80e3a1e..c76cc853b08a 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -460,7 +460,7 @@ int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op, ktime_t *timeout)
                 if (op & MSM_PREP_NOSYNC)
                         timeout = NULL;
 
-                ret = msm_wait_fence_interruptable(dev, fence, timeout);
+                ret = msm_wait_fence(dev, fence, timeout, true);
         }
 
         /* TODO cache maintenance */
diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index dd7a7ab603e2..831461bc98a5 100644
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -23,8 +23,12 @@
 struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)
 {
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
-        BUG_ON(!msm_obj->sgt);  /* should have already pinned! */
-        return msm_obj->sgt;
+        int npages = obj->size >> PAGE_SHIFT;
+
+        if (WARN_ON(!msm_obj->pages))  /* should have already pinned! */
+                return NULL;
+
+        return drm_prime_pages_to_sg(msm_obj->pages, npages);
 }
 
 void *msm_gem_prime_vmap(struct drm_gem_object *obj)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 649024d4daf1..477cbb12809b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -128,6 +128,7 @@ nouveau_cli_destroy(struct nouveau_cli *cli)
         nvkm_vm_ref(NULL, &nvxx_client(&cli->base)->vm, NULL);
         nvif_client_fini(&cli->base);
         usif_client_fini(cli);
+        kfree(cli);
 }
 
 static void
@@ -865,8 +866,10 @@ nouveau_drm_preclose(struct drm_device *dev, struct drm_file *fpriv)
 
         pm_runtime_get_sync(dev->dev);
 
+        mutex_lock(&cli->mutex);
         if (cli->abi16)
                 nouveau_abi16_fini(cli->abi16);
+        mutex_unlock(&cli->mutex);
 
         mutex_lock(&drm->client.mutex);
         list_del(&cli->head);
diff --git a/drivers/gpu/drm/nouveau/nouveau_platform.c b/drivers/gpu/drm/nouveau/nouveau_platform.c
index 775277f1edb0..dcfbbfaf1739 100644
--- a/drivers/gpu/drm/nouveau/nouveau_platform.c
+++ b/drivers/gpu/drm/nouveau/nouveau_platform.c
@@ -92,6 +92,8 @@ static int nouveau_platform_power_down(struct nouveau_platform_gpu *gpu)
         return 0;
 }
 
+#if IS_ENABLED(CONFIG_IOMMU_API)
+
 static void nouveau_platform_probe_iommu(struct device *dev,
                                          struct nouveau_platform_gpu *gpu)
 {
@@ -158,6 +160,20 @@ static void nouveau_platform_remove_iommu(struct device *dev,
         }
 }
 
+#else
+
+static void nouveau_platform_probe_iommu(struct device *dev,
+                                         struct nouveau_platform_gpu *gpu)
+{
+}
+
+static void nouveau_platform_remove_iommu(struct device *dev,
+                                          struct nouveau_platform_gpu *gpu)
+{
+}
+
+#endif
+
 static int nouveau_platform_probe(struct platform_device *pdev)
 {
         struct nouveau_platform_gpu *gpu;
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 18f449715788..7464aef34674 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -175,15 +175,24 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
         node->page_shift = 12;
 
         switch (drm->device.info.family) {
+        case NV_DEVICE_INFO_V0_TNT:
+        case NV_DEVICE_INFO_V0_CELSIUS:
+        case NV_DEVICE_INFO_V0_KELVIN:
+        case NV_DEVICE_INFO_V0_RANKINE:
+        case NV_DEVICE_INFO_V0_CURIE:
+                break;
         case NV_DEVICE_INFO_V0_TESLA:
                 if (drm->device.info.chipset != 0x50)
                         node->memtype = (nvbo->tile_flags & 0x7f00) >> 8;
                 break;
         case NV_DEVICE_INFO_V0_FERMI:
         case NV_DEVICE_INFO_V0_KEPLER:
+        case NV_DEVICE_INFO_V0_MAXWELL:
                 node->memtype = (nvbo->tile_flags & 0xff00) >> 8;
                 break;
         default:
+                NV_WARN(drm, "%s: unhandled family type %x\n", __func__,
+                        drm->device.info.family);
                 break;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
index 4ef602c5469d..495c57644ced 100644
--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -203,7 +203,7 @@ nv04_fbcon_accel_init(struct fb_info *info)
         if (ret)
                 return ret;
 
-        if (RING_SPACE(chan, 49)) {
+        if (RING_SPACE(chan, 49 + (device->info.chipset >= 0x11 ? 4 : 0))) {
                 nouveau_fbcon_gpu_lockup(info);
                 return 0;
         }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 7da7958556a3..981342d142ff 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -979,7 +979,7 @@ nv50_crtc_cursor_show_hide(struct nouveau_crtc *nv_crtc, bool show, bool update)
 {
         struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
 
-        if (show && nv_crtc->cursor.nvbo)
+        if (show && nv_crtc->cursor.nvbo && nv_crtc->base.enabled)
                 nv50_crtc_cursor_show(nv_crtc);
         else
                 nv50_crtc_cursor_hide(nv_crtc);
diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
index 394c89abcc97..901130b06072 100644
--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -188,7 +188,7 @@ nv50_fbcon_accel_init(struct fb_info *info)
         if (ret)
                 return ret;
 
-        ret = RING_SPACE(chan, 59);
+        ret = RING_SPACE(chan, 58);
         if (ret) {
                 nouveau_fbcon_gpu_lockup(info);
                 return ret;
@@ -252,6 +252,7 @@ nv50_fbcon_accel_init(struct fb_info *info)
         OUT_RING(chan, info->var.yres_virtual);
         OUT_RING(chan, upper_32_bits(fb->vma.offset));
         OUT_RING(chan, lower_32_bits(fb->vma.offset));
+        FIRE_RING(chan);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
index 61246677e8dc..fcd2e5f27bb9 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
@@ -188,7 +188,7 @@ nvc0_fbcon_accel_init(struct fb_info *info)
                 return -EINVAL;
         }
 
-        ret = RING_SPACE(chan, 60);
+        ret = RING_SPACE(chan, 58);
         if (ret) {
                 WARN_ON(1);
                 nouveau_fbcon_gpu_lockup(info);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf110.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf110.c
index 9ef6728c528d..7f2f05f78cc8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf110.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf110.c
@@ -809,7 +809,7 @@ exec_lookup(struct nv50_disp_priv *priv, int head, int or, u32 ctrl,
                 case 0x00000900: type = DCB_OUTPUT_DP; mask = 2; break;
                 default:
                         nv_error(priv, "unknown SOR mc 0x%08x\n", ctrl);
-                        return 0x0000;
+                        return NULL;
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index e10f9644140f..52c22b026005 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -166,14 +166,30 @@ gk104_fifo_context_attach(struct nvkm_object *parent,
 }
 
 static int
+gk104_fifo_chan_kick(struct gk104_fifo_chan *chan)
+{
+        struct nvkm_object *obj = (void *)chan;
+        struct gk104_fifo_priv *priv = (void *)obj->engine;
+
+        nv_wr32(priv, 0x002634, chan->base.chid);
+        if (!nv_wait(priv, 0x002634, 0x100000, 0x000000)) {
+                nv_error(priv, "channel %d [%s] kick timeout\n",
+                         chan->base.chid, nvkm_client_name(chan));
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
+static int
 gk104_fifo_context_detach(struct nvkm_object *parent, bool suspend,
                           struct nvkm_object *object)
 {
         struct nvkm_bar *bar = nvkm_bar(parent);
-        struct gk104_fifo_priv *priv = (void *)parent->engine;
         struct gk104_fifo_base *base = (void *)parent->parent;
         struct gk104_fifo_chan *chan = (void *)parent;
         u32 addr;
+        int ret;
 
         switch (nv_engidx(object->engine)) {
         case NVDEV_ENGINE_SW    : return 0;
@@ -188,13 +204,9 @@ gk104_fifo_context_detach(struct nvkm_object *parent, bool suspend,
                 return -EINVAL;
         }
 
-        nv_wr32(priv, 0x002634, chan->base.chid);
-        if (!nv_wait(priv, 0x002634, 0xffffffff, chan->base.chid)) {
-                nv_error(priv, "channel %d [%s] kick timeout\n",
-                         chan->base.chid, nvkm_client_name(chan));
-                if (suspend)
-                        return -EBUSY;
-        }
+        ret = gk104_fifo_chan_kick(chan);
+        if (ret && suspend)
+                return ret;
 
         if (addr) {
                 nv_wo32(base, addr + 0x00, 0x00000000);
@@ -319,6 +331,7 @@ gk104_fifo_chan_fini(struct nvkm_object *object, bool suspend)
                 gk104_fifo_runlist_update(priv, chan->engine);
         }
 
+        gk104_fifo_chan_kick(chan);
         nv_wr32(priv, 0x800000 + (chid * 8), 0x00000000);
         return nvkm_fifo_channel_fini(&chan->base, suspend);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
index 5606c25e5d02..ca11ddb6ed46 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -663,6 +663,37 @@ gf100_gr_zbc_init(struct gf100_gr_priv *priv)
                 gf100_gr_zbc_clear_depth(priv, index);
 }
 
+/**
+ * Wait until GR goes idle. GR is considered idle if it is disabled by the
+ * MC (0x200) register, or GR is not busy and a context switch is not in
+ * progress.
+ */
+int
+gf100_gr_wait_idle(struct gf100_gr_priv *priv)
+{
+        unsigned long end_jiffies = jiffies + msecs_to_jiffies(2000);
+        bool gr_enabled, ctxsw_active, gr_busy;
+
+        do {
+                /*
+                 * required to make sure FIFO_ENGINE_STATUS (0x2640) is
+                 * up-to-date
+                 */
+                nv_rd32(priv, 0x400700);
+
+                gr_enabled = nv_rd32(priv, 0x200) & 0x1000;
+                ctxsw_active = nv_rd32(priv, 0x2640) & 0x8000;
+                gr_busy = nv_rd32(priv, 0x40060c) & 0x1;
+
+                if (!gr_enabled || (!gr_busy && !ctxsw_active))
+                        return 0;
+        } while (time_before(jiffies, end_jiffies));
+
+        nv_error(priv, "wait for idle timeout (en: %d, ctxsw: %d, busy: %d)\n",
+                 gr_enabled, ctxsw_active, gr_busy);
+        return -EAGAIN;
+}
+
 void
 gf100_gr_mmio(struct gf100_gr_priv *priv, const struct gf100_gr_pack *p)
 {
@@ -699,7 +730,13 @@ gf100_gr_icmd(struct gf100_gr_priv *priv, const struct gf100_gr_pack *p)
 
                 while (addr < next) {
                         nv_wr32(priv, 0x400200, addr);
-                        nv_wait(priv, 0x400700, 0x00000002, 0x00000000);
+                        /**
+                         * Wait for GR to go idle after submitting a
+                         * GO_IDLE bundle
+                         */
+                        if ((addr & 0xffff) == 0xe100)
+                                gf100_gr_wait_idle(priv);
+                        nv_wait(priv, 0x400700, 0x00000004, 0x00000000);
                         addr += init->pitch;
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
index 8af1a89eda84..c9533fdac4fc 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.h
@@ -181,6 +181,7 @@ struct gf100_gr_oclass {
         int ppc_nr;
 };
 
+int  gf100_gr_wait_idle(struct gf100_gr_priv *);
 void gf100_gr_mmio(struct gf100_gr_priv *, const struct gf100_gr_pack *);
 void gf100_gr_icmd(struct gf100_gr_priv *, const struct gf100_gr_pack *);
 void gf100_gr_mthd(struct gf100_gr_priv *, const struct gf100_gr_pack *);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/pm/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/pm/base.c
index 2006c445938d..4cf36a3aa814 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/pm/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/pm/base.c
@@ -332,9 +332,12 @@ static void
 nvkm_perfctx_dtor(struct nvkm_object *object)
 {
         struct nvkm_pm *ppm = (void *)object->engine;
+        struct nvkm_perfctx *ctx = (void *)object;
+
         mutex_lock(&nv_subdev(ppm)->mutex);
-        nvkm_engctx_destroy(&ppm->context->base);
-        ppm->context = NULL;
+        nvkm_engctx_destroy(&ctx->base);
+        if (ppm->context == ctx)
+                ppm->context = NULL;
         mutex_unlock(&nv_subdev(ppm)->mutex);
 }
 
@@ -355,12 +358,11 @@ nvkm_perfctx_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
         mutex_lock(&nv_subdev(ppm)->mutex);
         if (ppm->context == NULL)
                 ppm->context = ctx;
-        mutex_unlock(&nv_subdev(ppm)->mutex);
-
         if (ctx != ppm->context)
-                return -EBUSY;
+                ret = -EBUSY;
+        mutex_unlock(&nv_subdev(ppm)->mutex);
 
-        return 0;
+        return ret;
 }
 
 struct nvkm_oclass
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/init.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/init.c
index f67cdae1e90a..f4611e3f0971 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/init.c
@@ -1285,6 +1285,44 @@ init_zm_reg_sequence(struct nvbios_init *init)
 }
 
 /**
+ * INIT_PLL_INDIRECT - opcode 0x59
+ *
+ */
+static void
+init_pll_indirect(struct nvbios_init *init)
+{
+        struct nvkm_bios *bios = init->bios;
+        u32  reg = nv_ro32(bios, init->offset + 1);
+        u16 addr = nv_ro16(bios, init->offset + 5);
+        u32 freq = (u32)nv_ro16(bios, addr) * 1000;
+
+        trace("PLL_INDIRECT\tR[0x%06x] =PLL= VBIOS[%04x] = %dkHz\n",
+              reg, addr, freq);
+        init->offset += 7;
+
+        init_prog_pll(init, reg, freq);
+}
+
+/**
+ * INIT_ZM_REG_INDIRECT - opcode 0x5a
+ *
+ */
+static void
+init_zm_reg_indirect(struct nvbios_init *init)
+{
+        struct nvkm_bios *bios = init->bios;
+        u32  reg = nv_ro32(bios, init->offset + 1);
+        u16 addr = nv_ro16(bios, init->offset + 5);
+        u32 data = nv_ro32(bios, addr);
+
+        trace("ZM_REG_INDIRECT\tR[0x%06x] = VBIOS[0x%04x] = 0x%08x\n",
+              reg, addr, data);
+        init->offset += 7;
+
+        init_wr32(init, addr, data);
+}
+
+/**
  * INIT_SUB_DIRECT - opcode 0x5b
  *
  */
@@ -2145,6 +2183,8 @@ static struct nvbios_init_opcode {
         [0x56] = { init_condition_time },
         [0x57] = { init_ltime },
         [0x58] = { init_zm_reg_sequence },
+        [0x59] = { init_pll_indirect },
+        [0x5a] = { init_zm_reg_indirect },
         [0x5b] = { init_sub_direct },
         [0x5c] = { init_jump },
         [0x5e] = { init_i2c_if },
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c
index 822d32a28d6e..065e9f5c8db9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c
@@ -180,7 +180,8 @@ gt215_clk_info(struct nvkm_clk *clock, int clk, u32 khz,
                struct gt215_clk_info *info)
 {
         struct gt215_clk_priv *priv = (void *)clock;
-        u32 oclk, sclk, sdiv, diff;
+        u32 oclk, sclk, sdiv;
+        s32 diff;
 
         info->clk = 0;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk20a.c
index c0fdb89e74ac..24dcdfb58a8d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk20a.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk20a.c
@@ -38,6 +38,14 @@ gk20a_ibus_init_priv_ring(struct gk20a_ibus_priv *priv)
         nv_wr32(priv, 0x12004c, 0x4);
         nv_wr32(priv, 0x122204, 0x2);
         nv_rd32(priv, 0x122204);
+
+        /*
+         * Bug: increase clock timeout to avoid operation failure at high
+         * gpcclk rate.
+         */
+        nv_wr32(priv, 0x122354, 0x800);
+        nv_wr32(priv, 0x128328, 0x800);
+        nv_wr32(priv, 0x124320, 0x800);
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
index 80614f1b2074..282143f49d72 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
@@ -50,7 +50,12 @@ nv04_instobj_dtor(struct nvkm_object *object)
 {
         struct nv04_instmem_priv *priv = (void *)nvkm_instmem(object);
         struct nv04_instobj_priv *node = (void *)object;
+        struct nvkm_subdev *subdev = (void *)priv;
+
+        mutex_lock(&subdev->mutex);
         nvkm_mm_free(&priv->heap, &node->mem);
+        mutex_unlock(&subdev->mutex);
+
         nvkm_instobj_destroy(&node->base);
 }
 
@@ -62,6 +67,7 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
         struct nv04_instmem_priv *priv = (void *)nvkm_instmem(parent);
         struct nv04_instobj_priv *node;
         struct nvkm_instobj_args *args = data;
+        struct nvkm_subdev *subdev = (void *)priv;
         int ret;
 
         if (!args->align)
@@ -72,8 +78,10 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
         if (ret)
                 return ret;
 
+        mutex_lock(&subdev->mutex);
         ret = nvkm_mm_head(&priv->heap, 0, 1, args->size, args->size,
                            args->align, &node->mem);
+        mutex_unlock(&subdev->mutex);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index dd39f434b4a7..c3872598b85a 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -2299,8 +2299,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         encoder_mode = atombios_get_encoder_mode(encoder);
         if (connector && (radeon_audio != 0) &&
             ((encoder_mode == ATOM_ENCODER_MODE_HDMI) ||
-             (ENCODER_MODE_IS_DP(encoder_mode) &&
-              drm_detect_monitor_audio(radeon_connector_edid(connector)))))
+             ENCODER_MODE_IS_DP(encoder_mode)))
                 radeon_audio_mode_set(encoder, adjusted_mode);
 }
 
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 68fd9fc677e3..44480c1b9738 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -93,30 +93,26 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset;
 
-        if (!dig || !dig->afmt || !dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->pin)
                 return;
 
-        offset = dig->afmt->offset;
-
-        WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
-               AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
+        WREG32(AFMT_AUDIO_SRC_CONTROL +  dig->afmt->offset,
+               AFMT_AUDIO_SRC_SELECT(dig->pin->id));
 }
 
 void dce6_afmt_write_latency_fields(struct drm_encoder *encoder,
-                struct drm_connector *connector, struct drm_display_mode *mode)
+                                    struct drm_connector *connector,
+                                    struct drm_display_mode *mode)
 {
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 tmp = 0, offset;
+        u32 tmp = 0;
 
-        if (!dig || !dig->afmt || !dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->pin)
                 return;
 
-        offset = dig->afmt->pin->offset;
-
         if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
                 if (connector->latency_present[1])
                         tmp = VIDEO_LIPSYNC(connector->video_latency[1]) |
@@ -130,24 +126,24 @@ void dce6_afmt_write_latency_fields(struct drm_encoder *encoder,
                 else
                         tmp = VIDEO_LIPSYNC(0) | AUDIO_LIPSYNC(0);
         }
-        WREG32_ENDPOINT(offset, AZ_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC, tmp);
+        WREG32_ENDPOINT(dig->pin->offset,
+                        AZ_F0_CODEC_PIN_CONTROL_RESPONSE_LIPSYNC, tmp);
 }
 
 void dce6_afmt_hdmi_write_speaker_allocation(struct drm_encoder *encoder,
-        u8 *sadb, int sad_count)
+                                             u8 *sadb, int sad_count)
 {
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset, tmp;
+        u32 tmp;
 
-        if (!dig || !dig->afmt || !dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->pin)
                 return;
 
-        offset = dig->afmt->pin->offset;
-
         /* program the speaker allocation */
-        tmp = RREG32_ENDPOINT(offset, AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER);
+        tmp = RREG32_ENDPOINT(dig->pin->offset,
+                              AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER);
         tmp &= ~(DP_CONNECTION | SPEAKER_ALLOCATION_MASK);
         /* set HDMI mode */
         tmp |= HDMI_CONNECTION;
@@ -155,24 +151,24 @@ void dce6_afmt_hdmi_write_speaker_allocation(struct drm_encoder *encoder,
                 tmp |= SPEAKER_ALLOCATION(sadb[0]);
         else
                 tmp |= SPEAKER_ALLOCATION(5); /* stereo */
-        WREG32_ENDPOINT(offset, AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER, tmp);
+        WREG32_ENDPOINT(dig->pin->offset,
+                        AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER, tmp);
 }
 
 void dce6_afmt_dp_write_speaker_allocation(struct drm_encoder *encoder,
-        u8 *sadb, int sad_count)
+                                           u8 *sadb, int sad_count)
 {
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset, tmp;
+        u32 tmp;
 
-        if (!dig || !dig->afmt || !dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->pin)
                 return;
 
-        offset = dig->afmt->pin->offset;
-
         /* program the speaker allocation */
-        tmp = RREG32_ENDPOINT(offset, AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER);
+        tmp = RREG32_ENDPOINT(dig->pin->offset,
+                              AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER);
         tmp &= ~(HDMI_CONNECTION | SPEAKER_ALLOCATION_MASK);
         /* set DP mode */
         tmp |= DP_CONNECTION;
@@ -180,13 +176,13 @@ void dce6_afmt_dp_write_speaker_allocation(struct drm_encoder *encoder,
                 tmp |= SPEAKER_ALLOCATION(sadb[0]);
         else
                 tmp |= SPEAKER_ALLOCATION(5); /* stereo */
-        WREG32_ENDPOINT(offset, AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER, tmp);
+        WREG32_ENDPOINT(dig->pin->offset,
+                        AZ_F0_CODEC_PIN_CONTROL_CHANNEL_SPEAKER, tmp);
 }
 
 void dce6_afmt_write_sad_regs(struct drm_encoder *encoder,
-        struct cea_sad *sads, int sad_count)
+                              struct cea_sad *sads, int sad_count)
 {
-        u32 offset;
         int i;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
@@ -206,11 +202,9 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder,
                 { AZ_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13, HDMI_AUDIO_CODING_TYPE_WMA_PRO },
         };
 
-        if (!dig || !dig->afmt || !dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->pin)
                 return;
 
-        offset = dig->afmt->pin->offset;
-
         for (i = 0; i < ARRAY_SIZE(eld_reg_to_type); i++) {
                 u32 value = 0;
                 u8 stereo_freqs = 0;
@@ -237,7 +231,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder,
 
                 value |= SUPPORTED_FREQUENCIES_STEREO(stereo_freqs);
 
-                WREG32_ENDPOINT(offset, eld_reg_to_type[i][0], value);
+                WREG32_ENDPOINT(dig->pin->offset, eld_reg_to_type[i][0], value);
         }
 }
 
@@ -253,7 +247,7 @@ void dce6_audio_enable(struct radeon_device *rdev,
 }
 
 void dce6_hdmi_audio_set_dto(struct radeon_device *rdev,
-        struct radeon_crtc *crtc, unsigned int clock)
+                             struct radeon_crtc *crtc, unsigned int clock)
 {
         /* Two dtos; generally use dto0 for HDMI */
         u32 value = 0;
@@ -272,7 +266,7 @@ void dce6_hdmi_audio_set_dto(struct radeon_device *rdev,
 }
 
 void dce6_dp_audio_set_dto(struct radeon_device *rdev,
-        struct radeon_crtc *crtc, unsigned int clock)
+                           struct radeon_crtc *crtc, unsigned int clock)
 {
         /* Two dtos; generally use dto1 for DP */
         u32 value = 0;
diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
index fa719c53449b..fbc8d88d6e5d 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -245,6 +245,28 @@ static struct radeon_audio_funcs dce6_dp_funcs = {
 static void radeon_audio_enable(struct radeon_device *rdev,
                                 struct r600_audio_pin *pin, u8 enable_mask)
 {
+        struct drm_encoder *encoder;
+        struct radeon_encoder *radeon_encoder;
+        struct radeon_encoder_atom_dig *dig;
+        int pin_count = 0;
+
+        if (!pin)
+                return;
+
+        if (rdev->mode_info.mode_config_initialized) {
+                list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
+                        if (radeon_encoder_is_digital(encoder)) {
+                                radeon_encoder = to_radeon_encoder(encoder);
+                                dig = radeon_encoder->enc_priv;
+                                if (dig->pin == pin)
+                                        pin_count++;
+                        }
+                }
+
+                if ((pin_count > 1) && (enable_mask == 0))
+                        return;
+        }
+
         if (rdev->audio.funcs->enable)
                 rdev->audio.funcs->enable(rdev, pin, enable_mask);
 }
@@ -336,24 +358,13 @@ void radeon_audio_endpoint_wreg(struct radeon_device *rdev, u32 offset,
 
 static void radeon_audio_write_sad_regs(struct drm_encoder *encoder)
 {
-        struct radeon_encoder *radeon_encoder;
-        struct drm_connector *connector;
-        struct radeon_connector *radeon_connector = NULL;
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct cea_sad *sads;
         int sad_count;
 
-        list_for_each_entry(connector,
-                &encoder->dev->mode_config.connector_list, head) {
-                if (connector->encoder == encoder) {
-                        radeon_connector = to_radeon_connector(connector);
-                        break;
-                }
-        }
-
-        if (!radeon_connector) {
-                DRM_ERROR("Couldn't find encoder's connector\n");
+        if (!connector)
                 return;
-        }
 
         sad_count = drm_edid_to_sad(radeon_connector_edid(connector), &sads);
         if (sad_count <= 0) {
@@ -362,8 +373,6 @@ static void radeon_audio_write_sad_regs(struct drm_encoder *encoder)
         }
         BUG_ON(!sads);
 
-        radeon_encoder = to_radeon_encoder(encoder);
-
         if (radeon_encoder->audio && radeon_encoder->audio->write_sad_regs)
                 radeon_encoder->audio->write_sad_regs(encoder, sads, sad_count);
 
@@ -372,27 +381,16 @@ static void radeon_audio_write_sad_regs(struct drm_encoder *encoder)
 
 static void radeon_audio_write_speaker_allocation(struct drm_encoder *encoder)
 {
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-        struct drm_connector *connector;
-        struct radeon_connector *radeon_connector = NULL;
         u8 *sadb = NULL;
         int sad_count;
 
-        list_for_each_entry(connector,
-                            &encoder->dev->mode_config.connector_list, head) {
-                if (connector->encoder == encoder) {
-                        radeon_connector = to_radeon_connector(connector);
-                        break;
-                }
-        }
-
-        if (!radeon_connector) {
-                DRM_ERROR("Couldn't find encoder's connector\n");
+        if (!connector)
                 return;
-        }
 
-        sad_count = drm_edid_to_speaker_allocation(
-                radeon_connector_edid(connector), &sadb);
+        sad_count = drm_edid_to_speaker_allocation(radeon_connector_edid(connector),
+                                                   &sadb);
         if (sad_count < 0) {
                 DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n",
                           sad_count);
@@ -406,26 +404,13 @@ static void radeon_audio_write_speaker_allocation(struct drm_encoder *encoder)
 }
 
 static void radeon_audio_write_latency_fields(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                                              struct drm_display_mode *mode)
 {
-        struct radeon_encoder *radeon_encoder;
-        struct drm_connector *connector;
-        struct radeon_connector *radeon_connector = 0;
-
-        list_for_each_entry(connector,
-                &encoder->dev->mode_config.connector_list, head) {
-                if (connector->encoder == encoder) {
-                        radeon_connector = to_radeon_connector(connector);
-                        break;
-                }
-        }
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
-        if (!radeon_connector) {
-                DRM_ERROR("Couldn't find encoder's connector\n");
+        if (!connector)
                 return;
-        }
-
-        radeon_encoder = to_radeon_encoder(encoder);
 
         if (radeon_encoder->audio && radeon_encoder->audio->write_latency_fields)
                 radeon_encoder->audio->write_latency_fields(encoder, connector, mode);
@@ -451,29 +436,23 @@ static void radeon_audio_select_pin(struct drm_encoder *encoder)
 }
 
 void radeon_audio_detect(struct drm_connector *connector,
+                         struct drm_encoder *encoder,
                          enum drm_connector_status status)
 {
-        struct radeon_device *rdev;
-        struct radeon_encoder *radeon_encoder;
+        struct drm_device *dev = connector->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig;
 
-        if (!connector || !connector->encoder)
+        if (!radeon_audio_chipset_supported(rdev))
                 return;
 
-        rdev = connector->encoder->dev->dev_private;
-
-        if (!radeon_audio_chipset_supported(rdev))
+        if (!radeon_encoder_is_digital(encoder))
                 return;
 
-        radeon_encoder = to_radeon_encoder(connector->encoder);
         dig = radeon_encoder->enc_priv;
 
         if (status == connector_status_connected) {
-                if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
-                        radeon_encoder->audio = NULL;
-                        return;
-                }
-
                 if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
                         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
 
@@ -486,11 +465,17 @@ void radeon_audio_detect(struct drm_connector *connector,
                         radeon_encoder->audio = rdev->audio.hdmi_funcs;
                 }
 
-                dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
-                radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
+                if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+                        if (!dig->pin)
+                                dig->pin = radeon_audio_get_pin(encoder);
+                        radeon_audio_enable(rdev, dig->pin, 0xf);
+                } else {
+                        radeon_audio_enable(rdev, dig->pin, 0);
+                        dig->pin = NULL;
+                }
         } else {
-                radeon_audio_enable(rdev, dig->afmt->pin, 0);
-                dig->afmt->pin = NULL;
+                radeon_audio_enable(rdev, dig->pin, 0);
+                dig->pin = NULL;
         }
 }
 
@@ -518,29 +503,18 @@ static void radeon_audio_set_dto(struct drm_encoder *encoder, unsigned int clock
 }
 
 static int radeon_audio_set_avi_packet(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                                       struct drm_display_mode *mode)
 {
         struct radeon_device *rdev = encoder->dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        struct drm_connector *connector;
-        struct radeon_connector *radeon_connector = NULL;
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
         u8 buffer[HDMI_INFOFRAME_HEADER_SIZE + HDMI_AVI_INFOFRAME_SIZE];
         struct hdmi_avi_infoframe frame;
         int err;
 
-        list_for_each_entry(connector,
-                &encoder->dev->mode_config.connector_list, head) {
-                if (connector->encoder == encoder) {
-                        radeon_connector = to_radeon_connector(connector);
-                        break;
-                }
-        }
-
-        if (!radeon_connector) {
-                DRM_ERROR("Couldn't find encoder's connector\n");
-                return -ENOENT;
-        }
+        if (!connector)
+                return -EINVAL;
 
         err = drm_hdmi_avi_infoframe_from_display_mode(&frame, mode);
         if (err < 0) {
@@ -563,8 +537,8 @@ static int radeon_audio_set_avi_packet(struct drm_encoder *encoder,
                 return err;
         }
 
-        if (dig && dig->afmt &&
-                radeon_encoder->audio && radeon_encoder->audio->set_avi_packet)
+        if (dig && dig->afmt && radeon_encoder->audio &&
+            radeon_encoder->audio->set_avi_packet)
                 radeon_encoder->audio->set_avi_packet(rdev, dig->afmt->offset,
                         buffer, sizeof(buffer));
 
@@ -722,30 +696,41 @@ static void radeon_audio_hdmi_mode_set(struct drm_encoder *encoder,
 {
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+        struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
         if (!dig || !dig->afmt)
                 return;
 
-        radeon_audio_set_mute(encoder, true);
+        if (!connector)
+                return;
 
-        radeon_audio_write_speaker_allocation(encoder);
-        radeon_audio_write_sad_regs(encoder);
-        radeon_audio_write_latency_fields(encoder, mode);
-        radeon_audio_set_dto(encoder, mode->clock);
-        radeon_audio_set_vbi_packet(encoder);
-        radeon_hdmi_set_color_depth(encoder);
-        radeon_audio_update_acr(encoder, mode->clock);
-        radeon_audio_set_audio_packet(encoder);
-        radeon_audio_select_pin(encoder);
+        if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+                radeon_audio_set_mute(encoder, true);
 
-        if (radeon_audio_set_avi_packet(encoder, mode) < 0)
-                return;
+                radeon_audio_write_speaker_allocation(encoder);
+                radeon_audio_write_sad_regs(encoder);
+                radeon_audio_write_latency_fields(encoder, mode);
+                radeon_audio_set_dto(encoder, mode->clock);
+                radeon_audio_set_vbi_packet(encoder);
+                radeon_hdmi_set_color_depth(encoder);
+                radeon_audio_update_acr(encoder, mode->clock);
+                radeon_audio_set_audio_packet(encoder);
+                radeon_audio_select_pin(encoder);
+
+                if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+                        return;
 
-        radeon_audio_set_mute(encoder, false);
+                radeon_audio_set_mute(encoder, false);
+        } else {
+                radeon_hdmi_set_color_depth(encoder);
+
+                if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+                        return;
+        }
 }
 
 static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                                     struct drm_display_mode *mode)
 {
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
@@ -759,22 +744,27 @@ static void radeon_audio_dp_mode_set(struct drm_encoder *encoder,
         if (!dig || !dig->afmt)
                 return;
 
-        radeon_audio_write_speaker_allocation(encoder);
-        radeon_audio_write_sad_regs(encoder);
-        radeon_audio_write_latency_fields(encoder, mode);
-        if (rdev->clock.dp_extclk || ASIC_IS_DCE5(rdev))
-                radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
-        else
-                radeon_audio_set_dto(encoder, dig_connector->dp_clock);
-        radeon_audio_set_audio_packet(encoder);
-        radeon_audio_select_pin(encoder);
-
-        if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+        if (!connector)
                 return;
+
+        if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+                radeon_audio_write_speaker_allocation(encoder);
+                radeon_audio_write_sad_regs(encoder);
+                radeon_audio_write_latency_fields(encoder, mode);
+                if (rdev->clock.dp_extclk || ASIC_IS_DCE5(rdev))
+                        radeon_audio_set_dto(encoder, rdev->clock.default_dispclk * 10);
+                else
+                        radeon_audio_set_dto(encoder, dig_connector->dp_clock);
+                radeon_audio_set_audio_packet(encoder);
+                radeon_audio_select_pin(encoder);
+
+                if (radeon_audio_set_avi_packet(encoder, mode) < 0)
+                        return;
+        }
 }
 
 void radeon_audio_mode_set(struct drm_encoder *encoder,
-        struct drm_display_mode *mode)
+                           struct drm_display_mode *mode)
 {
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
diff --git a/drivers/gpu/drm/radeon/radeon_audio.h b/drivers/gpu/drm/radeon/radeon_audio.h
index 8438304f7139..059cc3012062 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.h
+++ b/drivers/gpu/drm/radeon/radeon_audio.h
@@ -68,7 +68,8 @@ struct radeon_audio_funcs
 
 int radeon_audio_init(struct radeon_device *rdev);
 void radeon_audio_detect(struct drm_connector *connector,
-        enum drm_connector_status status);
+                         struct drm_encoder *encoder,
+                         enum drm_connector_status status);
 u32 radeon_audio_endpoint_rreg(struct radeon_device *rdev,
         u32 offset, u32 reg);
 void radeon_audio_endpoint_wreg(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 3e5f6b71f3ad..c097d3a82bda 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1255,10 +1255,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
 
                         if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) &&
                             (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) {
+                                u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+
+                                if (hss > lvds->native_mode.hdisplay)
+                                        hss = (10 - 1) * 8;
+
                                 lvds->native_mode.htotal = lvds->native_mode.hdisplay +
                                         (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8;
                                 lvds->native_mode.hsync_start = lvds->native_mode.hdisplay +
-                                        (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+                                        hss;
                                 lvds->native_mode.hsync_end = lvds->native_mode.hsync_start +
                                         (RBIOS8(tmp + 23) * 8);
 
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index cebb65e07e1d..94b21ae70ef7 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1379,8 +1379,16 @@ out:
         /* updated in get modes as well since we need to know if it's analog or digital */
         radeon_connector_update_scratch_regs(connector, ret);
 
-        if (radeon_audio != 0)
-                radeon_audio_detect(connector, ret);
+        if ((radeon_audio != 0) && radeon_connector->use_digital) {
+                const struct drm_connector_helper_funcs *connector_funcs =
+                        connector->helper_private;
+
+                encoder = connector_funcs->best_encoder(connector);
+                if (encoder && (encoder->encoder_type == DRM_MODE_ENCODER_TMDS)) {
+                        radeon_connector_get_edid(connector);
+                        radeon_audio_detect(connector, encoder, ret);
+                }
+        }
 
 exit:
         pm_runtime_mark_last_busy(connector->dev->dev);
@@ -1717,8 +1725,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
 
         radeon_connector_update_scratch_regs(connector, ret);
 
-        if (radeon_audio != 0)
-                radeon_audio_detect(connector, ret);
+        if ((radeon_audio != 0) && encoder) {
+                radeon_connector_get_edid(connector);
+                radeon_audio_detect(connector, encoder, ret);
+        }
 
 out:
         pm_runtime_mark_last_busy(connector->dev->dev);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 07909d817381..aecc3e3dec0c 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -237,7 +237,6 @@ struct radeon_afmt {
         int offset;
         bool last_buffer_filled_status;
         int id;
-        struct r600_audio_pin *pin;
 };
 
 struct radeon_mode_info {
@@ -439,6 +438,7 @@ struct radeon_encoder_atom_dig {
         uint8_t backlight_level;
         int panel_mode;
         struct radeon_afmt *afmt;
+        struct r600_audio_pin *pin;
         int active_mst_links;
 };
 
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index f822fd2a1ada..884d82f9190e 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -546,6 +546,12 @@ static const struct hid_device_id apple_devices[] = {
                 .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
                 .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 157c62775053..e6fce23b121a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1782,6 +1782,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -2463,6 +2466,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING8_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING9_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b04b0820d816..b3b225b75d0a 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -142,6 +142,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI    0x0272
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO             0x0273
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS             0x0274
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY    0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY     0x030b
 #define USB_DEVICE_ID_APPLE_IRCONTROL   0x8240
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3511bbaba505..e3c63640df73 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -462,12 +462,15 @@ out:
 
 static void hidinput_cleanup_battery(struct hid_device *dev)
 {
+        const struct power_supply_desc *psy_desc;
+
         if (!dev->battery)
                 return;
 
+        psy_desc = dev->battery->desc;
         power_supply_unregister(dev->battery);
-        kfree(dev->battery->desc->name);
-        kfree(dev->battery->desc);
+        kfree(psy_desc->name);
+        kfree(psy_desc);
         dev->battery = NULL;
 }
 #else  /* !CONFIG_HID_BATTERY_STRENGTH */
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 94167310e15a..b905d501e752 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev)
         for (p = drvdata->rdesc;
              p <= drvdata->rdesc + drvdata->rsize - 4;) {
                 if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D &&
-                    p[3] < sizeof(params)) {
+                    p[3] < ARRAY_SIZE(params)) {
                         v = params[p[3]];
                         put_unaligned(cpu_to_le32(v), (s32 *)p);
                         p += 4;
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 44958d79d598..01b937e63cf3 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1284,6 +1284,39 @@ fail_register_pen_input:
         return error;
 }
 
+/*
+ * Not all devices report physical dimensions from HID.
+ * Compute the default from hardcoded logical dimension
+ * and resolution before driver overwrites them.
+ */
+static void wacom_set_default_phy(struct wacom_features *features)
+{
+        if (features->x_resolution) {
+                features->x_phy = (features->x_max * 100) /
+                                        features->x_resolution;
+                features->y_phy = (features->y_max * 100) /
+                                        features->y_resolution;
+        }
+}
+
+static void wacom_calculate_res(struct wacom_features *features)
+{
+        /* set unit to "100th of a mm" for devices not reported by HID */
+        if (!features->unit) {
+                features->unit = 0x11;
+                features->unitExpo = -3;
+        }
+
+        features->x_resolution = wacom_calc_hid_res(features->x_max,
+                                                    features->x_phy,
+                                                    features->unit,
+                                                    features->unitExpo);
+        features->y_resolution = wacom_calc_hid_res(features->y_max,
+                                                    features->y_phy,
+                                                    features->unit,
+                                                    features->unitExpo);
+}
+
 static void wacom_wireless_work(struct work_struct *work)
 {
         struct wacom *wacom = container_of(work, struct wacom, work);
@@ -1341,6 +1374,8 @@ static void wacom_wireless_work(struct work_struct *work)
                 if (wacom_wac1->features.type != INTUOSHT &&
                     wacom_wac1->features.type != BAMBOO_PT)
                         wacom_wac1->features.device_type |= WACOM_DEVICETYPE_PAD;
+                wacom_set_default_phy(&wacom_wac1->features);
+                wacom_calculate_res(&wacom_wac1->features);
                 snprintf(wacom_wac1->pen_name, WACOM_NAME_MAX, "%s (WL) Pen",
                          wacom_wac1->features.name);
                 snprintf(wacom_wac1->pad_name, WACOM_NAME_MAX, "%s (WL) Pad",
@@ -1359,7 +1394,9 @@ static void wacom_wireless_work(struct work_struct *work)
                         wacom_wac2->features =
                                 *((struct wacom_features *)id->driver_data);
                         wacom_wac2->features.pktlen = WACOM_PKGLEN_BBTOUCH3;
+                        wacom_set_default_phy(&wacom_wac2->features);
                         wacom_wac2->features.x_max = wacom_wac2->features.y_max = 4096;
+                        wacom_calculate_res(&wacom_wac2->features);
                         snprintf(wacom_wac2->touch_name, WACOM_NAME_MAX,
                                  "%s (WL) Finger",wacom_wac2->features.name);
                         snprintf(wacom_wac2->pad_name, WACOM_NAME_MAX,
@@ -1407,39 +1444,6 @@ void wacom_battery_work(struct work_struct *work)
         }
 }
 
-/*
- * Not all devices report physical dimensions from HID.
- * Compute the default from hardcoded logical dimension
- * and resolution before driver overwrites them.
- */
-static void wacom_set_default_phy(struct wacom_features *features)
-{
-        if (features->x_resolution) {
-                features->x_phy = (features->x_max * 100) /
-                                        features->x_resolution;
-                features->y_phy = (features->y_max * 100) /
-                                        features->y_resolution;
-        }
-}
-
-static void wacom_calculate_res(struct wacom_features *features)
-{
-        /* set unit to "100th of a mm" for devices not reported by HID */
-        if (!features->unit) {
-                features->unit = 0x11;
-                features->unitExpo = -3;
-        }
-
-        features->x_resolution = wacom_calc_hid_res(features->x_max,
-                                                    features->x_phy,
-                                                    features->unit,
-                                                    features->unitExpo);
-        features->y_resolution = wacom_calc_hid_res(features->y_max,
-                                                    features->y_phy,
-                                                    features->unit,
-                                                    features->unitExpo);
-}
-
 static size_t wacom_compute_pktlen(struct hid_device *hdev)
 {
         struct hid_report_enum *report_enum;
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 37c16afe007a..c8487894b312 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -929,6 +929,21 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = {
 
 MODULE_DEVICE_TABLE(dmi, i8k_dmi_table);
 
+static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = {
+        {
+                /*
+                 * CPU fan speed going up and down on Dell Studio XPS 8100
+                 * for unknown reasons.
+                 */
+                .ident = "Dell Studio XPS 8100",
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"),
+                },
+        },
+        { }
+};
+
 /*
  * Probe for the presence of a supported laptop.
  */
@@ -940,7 +955,8 @@ static int __init i8k_probe(void)
         /*
          * Get DMI information
          */
-        if (!dmi_check_system(i8k_dmi_table)) {
+        if (!dmi_check_system(i8k_dmi_table) ||
+            dmi_check_system(i8k_blacklist_dmi_table)) {
                 if (!ignore_dmi && !force)
                         return -ENODEV;
 
diff --git a/drivers/hwmon/g762.c b/drivers/hwmon/g762.c
index 9b55e673b67c..85d106fe3ce8 100644
--- a/drivers/hwmon/g762.c
+++ b/drivers/hwmon/g762.c
@@ -582,6 +582,7 @@ static const struct of_device_id g762_dt_match[] = {
         { .compatible = "gmt,g763" },
         { },
 };
+MODULE_DEVICE_TABLE(of, g762_dt_match);
 
 /*
  * Grab clock (a required property), enable it, get (fixed) clock frequency
diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
index 28fcb2e246d5..fbfc02bb2cfa 100644
--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -195,7 +195,7 @@ abort:
 }
 
 static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
-                                 unsigned int voltage)
+                                 unsigned long voltage)
 {
         int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
         int err;
diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
index b77b82f24480..08ff89d222e5 100644
--- a/drivers/hwmon/nct7904.c
+++ b/drivers/hwmon/nct7904.c
@@ -412,8 +412,9 @@ static ssize_t show_pwm(struct device *dev,
         return sprintf(buf, "%d\n", val);
 }
 
-static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
-                          const char *buf, size_t count)
+static ssize_t store_enable(struct device *dev,
+                            struct device_attribute *devattr,
+                            const char *buf, size_t count)
 {
         int index = to_sensor_dev_attr(devattr)->index;
         struct nct7904_data *data = dev_get_drvdata(dev);
@@ -422,18 +423,18 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
 
         if (kstrtoul(buf, 10, &val) < 0)
                 return -EINVAL;
-        if (val > 1 || (val && !data->fan_mode[index]))
+        if (val < 1 || val > 2 || (val == 2 && !data->fan_mode[index]))
                 return -EINVAL;
 
         ret = nct7904_write_reg(data, BANK_3, FANCTL1_FMR_REG + index,
-                                val ? data->fan_mode[index] : 0);
+                                val == 2 ? data->fan_mode[index] : 0);
 
         return ret ? ret : count;
 }
 
-/* Return 0 for manual mode or 1 for SmartFan mode */
-static ssize_t show_mode(struct device *dev,
-                         struct device_attribute *devattr, char *buf)
+/* Return 1 for manual mode or 2 for SmartFan mode */
+static ssize_t show_enable(struct device *dev,
+                           struct device_attribute *devattr, char *buf)
 {
         int index = to_sensor_dev_attr(devattr)->index;
         struct nct7904_data *data = dev_get_drvdata(dev);
@@ -443,36 +444,36 @@ static ssize_t show_mode(struct device *dev,
         if (val < 0)
                 return val;
 
-        return sprintf(buf, "%d\n", val ? 1 : 0);
+        return sprintf(buf, "%d\n", val ? 2 : 1);
 }
 
 /* 2 attributes per channel: pwm and mode */
-static SENSOR_DEVICE_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR,
                         show_pwm, store_pwm, 0);
-static SENSOR_DEVICE_ATTR(fan1_mode, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 0);
-static SENSOR_DEVICE_ATTR(fan2_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
+                        show_enable, store_enable, 0);
+static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR,
                         show_pwm, store_pwm, 1);
-static SENSOR_DEVICE_ATTR(fan2_mode, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 1);
-static SENSOR_DEVICE_ATTR(fan3_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm2_enable, S_IRUGO | S_IWUSR,
+                        show_enable, store_enable, 1);
+static SENSOR_DEVICE_ATTR(pwm3, S_IRUGO | S_IWUSR,
                         show_pwm, store_pwm, 2);
-static SENSOR_DEVICE_ATTR(fan3_mode, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 2);
-static SENSOR_DEVICE_ATTR(fan4_pwm, S_IRUGO | S_IWUSR,
+static SENSOR_DEVICE_ATTR(pwm3_enable, S_IRUGO | S_IWUSR,
+                        show_enable, store_enable, 2);
+static SENSOR_DEVICE_ATTR(pwm4, S_IRUGO | S_IWUSR,
                         show_pwm, store_pwm, 3);
-static SENSOR_DEVICE_ATTR(fan4_mode, S_IRUGO | S_IWUSR,
-                        show_mode, store_mode, 3);
+static SENSOR_DEVICE_ATTR(pwm4_enable, S_IRUGO | S_IWUSR,
+                        show_enable, store_enable, 3);
 
 static struct attribute *nct7904_fanctl_attrs[] = {
-        &sensor_dev_attr_fan1_pwm.dev_attr.attr,
-        &sensor_dev_attr_fan1_mode.dev_attr.attr,
-        &sensor_dev_attr_fan2_pwm.dev_attr.attr,
-        &sensor_dev_attr_fan2_mode.dev_attr.attr,
-        &sensor_dev_attr_fan3_pwm.dev_attr.attr,
-        &sensor_dev_attr_fan3_mode.dev_attr.attr,
-        &sensor_dev_attr_fan4_pwm.dev_attr.attr,
-        &sensor_dev_attr_fan4_mode.dev_attr.attr,
+        &sensor_dev_attr_pwm1.dev_attr.attr,
+        &sensor_dev_attr_pwm1_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm2.dev_attr.attr,
+        &sensor_dev_attr_pwm2_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm3.dev_attr.attr,
+        &sensor_dev_attr_pwm3_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm4.dev_attr.attr,
+        &sensor_dev_attr_pwm4_enable.dev_attr.attr,
         NULL
 };
 
@@ -574,6 +575,7 @@ static const struct i2c_device_id nct7904_id[] = {
         {"nct7904", 0},
         {}
 };
+MODULE_DEVICE_TABLE(i2c, nct7904_id);
 
 static struct i2c_driver nct7904_driver = {
         .class = I2C_CLASS_HWMON,
diff --git a/drivers/i2c/busses/i2c-bfin-twi.c b/drivers/i2c/busses/i2c-bfin-twi.c
index af162b4c7a6d..025686d41640 100644
--- a/drivers/i2c/busses/i2c-bfin-twi.c
+++ b/drivers/i2c/busses/i2c-bfin-twi.c
@@ -692,7 +692,7 @@ static int i2c_bfin_twi_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, iface);
 
-        dev_info(&pdev->dev, "Blackfin BF5xx on-chip I2C TWI Contoller, "
+        dev_info(&pdev->dev, "Blackfin BF5xx on-chip I2C TWI Controller, "
                 "regs_base@%p\n", iface->regs_base);
 
         return 0;
@@ -735,6 +735,6 @@ subsys_initcall(i2c_bfin_twi_init);
 module_exit(i2c_bfin_twi_exit);
 
 MODULE_AUTHOR("Bryan Wu, Sonic Zhang");
-MODULE_DESCRIPTION("Blackfin BF5xx on-chip I2C TWI Contoller Driver");
+MODULE_DESCRIPTION("Blackfin BF5xx on-chip I2C TWI Controller Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:i2c-bfin-twi");
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index d1c22e3fdd14..fc9bf7f30e35 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1247,7 +1247,14 @@ static void omap_i2c_prepare_recovery(struct i2c_adapter *adap)
         u32 reg;
 
         reg = omap_i2c_read_reg(dev, OMAP_I2C_SYSTEST_REG);
+        /* enable test mode */
         reg |= OMAP_I2C_SYSTEST_ST_EN;
+        /* select SDA/SCL IO mode */
+        reg |= 3 << OMAP_I2C_SYSTEST_TMODE_SHIFT;
+        /* set SCL to high-impedance state (reset value is 0) */
+        reg |= OMAP_I2C_SYSTEST_SCL_O;
+        /* set SDA to high-impedance state (reset value is 0) */
+        reg |= OMAP_I2C_SYSTEST_SDA_O;
         omap_i2c_write_reg(dev, OMAP_I2C_SYSTEST_REG, reg);
 }
 
@@ -1257,7 +1264,11 @@ static void omap_i2c_unprepare_recovery(struct i2c_adapter *adap)
         u32 reg;
 
         reg = omap_i2c_read_reg(dev, OMAP_I2C_SYSTEST_REG);
+        /* restore reset values */
         reg &= ~OMAP_I2C_SYSTEST_ST_EN;
+        reg &= ~OMAP_I2C_SYSTEST_TMODE_MASK;
+        reg &= ~OMAP_I2C_SYSTEST_SCL_O;
+        reg &= ~OMAP_I2C_SYSTEST_SDA_O;
         omap_i2c_write_reg(dev, OMAP_I2C_SYSTEST_REG, reg);
 }
 
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index e6d4935161e4..c83e4d13cfc5 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -567,6 +567,9 @@ static int i2c_generic_recovery(struct i2c_adapter *adap)
         if (bri->prepare_recovery)
                 bri->prepare_recovery(adap);
 
+        bri->set_scl(adap, val);
+        ndelay(RECOVERY_NDELAY);
+
         /*
          * By this time SCL is high, as we need to give 9 falling-rising edges
          */
@@ -597,7 +600,6 @@ static int i2c_generic_recovery(struct i2c_adapter *adap)
 
 int i2c_generic_scl_recovery(struct i2c_adapter *adap)
 {
-        adap->bus_recovery_info->set_scl(adap, 1);
         return i2c_generic_recovery(adap);
 }
 EXPORT_SYMBOL_GPL(i2c_generic_scl_recovery);
@@ -1338,13 +1340,17 @@ static int of_dev_node_match(struct device *dev, void *data)
 struct i2c_client *of_find_i2c_device_by_node(struct device_node *node)
 {
         struct device *dev;
+        struct i2c_client *client;
 
-        dev = bus_find_device(&i2c_bus_type, NULL, node,
-                                         of_dev_node_match);
+        dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
         if (!dev)
                 return NULL;
 
-        return i2c_verify_client(dev);
+        client = i2c_verify_client(dev);
+        if (!client)
+                put_device(dev);
+
+        return client;
 }
 EXPORT_SYMBOL(of_find_i2c_device_by_node);
 
@@ -1352,13 +1358,17 @@ EXPORT_SYMBOL(of_find_i2c_device_by_node);
 struct i2c_adapter *of_find_i2c_adapter_by_node(struct device_node *node)
 {
         struct device *dev;
+        struct i2c_adapter *adapter;
 
-        dev = bus_find_device(&i2c_bus_type, NULL, node,
-                                         of_dev_node_match);
+        dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
         if (!dev)
                 return NULL;
 
-        return i2c_verify_adapter(dev);
+        adapter = i2c_verify_adapter(dev);
+        if (!adapter)
+                put_device(dev);
+
+        return adapter;
 }
 EXPORT_SYMBOL(of_find_i2c_adapter_by_node);
 #else
diff --git a/drivers/i2c/i2c-slave-eeprom.c b/drivers/i2c/i2c-slave-eeprom.c
index 822374654609..1da449614779 100644
--- a/drivers/i2c/i2c-slave-eeprom.c
+++ b/drivers/i2c/i2c-slave-eeprom.c
@@ -80,9 +80,6 @@ static ssize_t i2c_slave_eeprom_bin_read(struct file *filp, struct kobject *kobj
         struct eeprom_data *eeprom;
         unsigned long flags;
 
-        if (off + count > attr->size)
-                return -EFBIG;
-
         eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
 
         spin_lock_irqsave(&eeprom->buffer_lock, flags);
@@ -98,9 +95,6 @@ static ssize_t i2c_slave_eeprom_bin_write(struct file *filp, struct kobject *kob
         struct eeprom_data *eeprom;
         unsigned long flags;
 
-        if (off + count > attr->size)
-                return -EFBIG;
-
         eeprom = dev_get_drvdata(container_of(kobj, struct device, kobj));
 
         spin_lock_irqsave(&eeprom->buffer_lock, flags);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index b1b73232f217..bbbe0184e592 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -736,6 +736,10 @@ static struct ib_mr *iwch_get_dma_mr(struct ib_pd *pd, int acc)
         /*
          * T3 only supports 32 bits of size.
          */
+        if (sizeof(phys_addr_t) > 4) {
+                pr_warn_once(MOD "Cannot support dma_mrs on this platform.\n");
+                return ERR_PTR(-ENOTSUPP);
+        }
         bl.size = 0xffffffff;
         bl.addr = 0;
         kva = 0;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index b396344fae16..6a36338593cd 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_H__
 #define __OCRDMA_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
index 1554cca5712a..430b1350fe96 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_ABI_H__
 #define __OCRDMA_ABI_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index 29b27675dd70..44766fee1f4e 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #include <net/neighbour.h>
 #include <net/netevent.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.h b/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
index cf366fe03cb8..04a30ae67473 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_AH_H__
 #define __OCRDMA_AH_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 47615ff33bc6..aab391a15db4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) CNA Adapters.              *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #include <linux/sched.h>
 #include <linux/interrupt.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
index e905972fceb7..7ed885c1851e 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) CNA Adapters.              *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_HW_H__
 #define __OCRDMA_HW_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index d98a707a5eb9..b119a3413a15 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #include <linux/module.h>
 #include <linux/idr.h>
@@ -46,7 +61,7 @@
 MODULE_VERSION(OCRDMA_ROCE_DRV_VERSION);
 MODULE_DESCRIPTION(OCRDMA_ROCE_DRV_DESC " " OCRDMA_ROCE_DRV_VERSION);
 MODULE_AUTHOR("Emulex Corporation");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 
 static LIST_HEAD(ocrdma_dev_list);
 static DEFINE_SPINLOCK(ocrdma_devlist_lock);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 02ad0aee99af..80006b24aa11 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_SLI_H__
 #define __OCRDMA_SLI_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index 48d7ef51aa0c..69334e214571 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2014 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #include <rdma/ib_addr.h>
 #include <rdma/ib_pma.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
index 091edd68a8a3..c9e58d04c7b8 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2014 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_STATS_H__
 #define __OCRDMA_STATS_H__
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 5bb61eb58f2c..bc84cd462ecf 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #include <linux/dma-mapping.h>
 #include <rdma/ib_verbs.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
index b15c608efa7b..eaccb2d3cb9f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
@@ -1,21 +1,36 @@
-/*******************************************************************
- * This file is part of the Emulex RoCE Device Driver for          *
- * RoCE (RDMA over Converged Ethernet) adapters.                   *
- * Copyright (C) 2008-2012 Emulex. All rights reserved.            *
- * EMULEX and SLI are trademarks of Emulex.                        *
- * www.emulex.com                                                  *
- *                                                                 *
- * This program is free software; you can redistribute it and/or   *
- * modify it under the terms of version 2 of the GNU General       *
- * Public License as published by the Free Software Foundation.    *
- * This program is distributed in the hope that it will be useful. *
- * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
- * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
- * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
- * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
- * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
- * more details, a copy of which can be found in the file COPYING  *
- * included with this package.                                     *
+/* This file is part of the Emulex RoCE Device Driver for
+ * RoCE (RDMA over Converged Ethernet) adapters.
+ * Copyright (C) 2012-2015 Emulex. All rights reserved.
+ * EMULEX and SLI are trademarks of Emulex.
+ * www.emulex.com
+ *
+ * This software is available to you under a choice of one of two licenses.
+ * You may choose to be licensed under the terms of the GNU General Public
+ * License (GPL) Version 2, available from the file COPYING in the main
+ * directory of this source tree, or the BSD license below:
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright notice,
+ *   this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ *   notice, this list of conditions and the following disclaimer in
+ *   the documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * Contact Information:
  * linux-drivers@emulex.com
@@ -23,7 +38,7 @@
  * Emulex
  * 3333 Susan Street
  * Costa Mesa, CA 92626
- *******************************************************************/
+ */
 
 #ifndef __OCRDMA_VERBS_H__
 #define __OCRDMA_VERBS_H__
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 9e6ee82a8fd7..851c8219d501 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -177,7 +177,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
                 else
                         size += ipoib_recvq_size * ipoib_max_conn_qp;
         } else
-                goto out_free_wq;
+                if (ret != -ENOSYS)
+                        goto out_free_wq;
 
         cq_attr.cqe = size;
         priv->recv_cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 771700963127..d851e1828d6f 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -775,6 +775,17 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         ret = isert_rdma_post_recvl(isert_conn);
         if (ret)
                 goto out_conn_dev;
+        /*
+         * Obtain the second reference now before isert_rdma_accept() to
+         * ensure that any initiator generated REJECT CM event that occurs
+         * asynchronously won't drop the last reference until the error path
+         * in iscsi_target_login_sess_out() does it's ->iscsit_free_conn() ->
+         * isert_free_conn() -> isert_put_conn() -> kref_put().
+         */
+        if (!kref_get_unless_zero(&isert_conn->kref)) {
+                isert_warn("conn %p connect_release is running\n", isert_conn);
+                goto out_conn_dev;
+        }
 
         ret = isert_rdma_accept(isert_conn);
         if (ret)
@@ -836,11 +847,6 @@ isert_connected_handler(struct rdma_cm_id *cma_id)
 
         isert_info("conn %p\n", isert_conn);
 
-        if (!kref_get_unless_zero(&isert_conn->kref)) {
-                isert_warn("conn %p connect_release is running\n", isert_conn);
-                return;
-        }
-
         mutex_lock(&isert_conn->mutex);
         if (isert_conn->state != ISER_CONN_FULL_FEATURE)
                 isert_conn->state = ISER_CONN_UP;
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c
index 27b6a3ce18ca..891797ad76bc 100644
--- a/drivers/input/joystick/turbografx.c
+++ b/drivers/input/joystick/turbografx.c
@@ -196,7 +196,7 @@ static struct tgfx __init *tgfx_probe(int parport, int *n_buttons, int n_devs)
                 if (n_buttons[i] < 1)
                         continue;
 
-                if (n_buttons[i] > 6) {
+                if (n_buttons[i] > ARRAY_SIZE(tgfx_buttons)) {
                         printk(KERN_ERR "turbografx.c: Invalid number of buttons %d\n", n_buttons[i]);
                         err = -EINVAL;
                         goto err_unreg_devs;
diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
index 10e140af5aac..1ac898db303a 100644
--- a/drivers/input/misc/axp20x-pek.c
+++ b/drivers/input/misc/axp20x-pek.c
@@ -292,3 +292,4 @@ module_platform_driver(axp20x_pek_driver);
 MODULE_DESCRIPTION("axp20x Power Button");
 MODULE_AUTHOR("Carlo Caione <carlo@caione.org>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:axp20x-pek");
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index fc17b9592f54..10c4e3d462f1 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -183,7 +183,8 @@ static bool twl4030_vibra_check_coexist(struct twl4030_vibra_data *pdata,
         if (pdata && pdata->coexist)
                 return true;
 
-        if (of_find_node_by_name(node, "codec")) {
+        node = of_find_node_by_name(node, "codec");
+        if (node) {
                 of_node_put(node);
                 return true;
         }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 113d6f1516a5..4d246861d692 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -20,6 +20,7 @@
 #include <linux/input/mt.h>
 #include <linux/serio.h>
 #include <linux/libps2.h>
+#include <linux/dmi.h>
 
 #include "psmouse.h"
 #include "alps.h"
@@ -99,6 +100,7 @@ static const struct alps_nibble_commands alps_v6_nibble_commands[] = {
 #define ALPS_FOUR_BUTTONS       0x40    /* 4 direction button present */
 #define ALPS_PS2_INTERLEAVED    0x80    /* 3-byte PS/2 packet interleaved with
                                            6-byte ALPS packet */
+#define ALPS_DELL               0x100   /* device is a Dell laptop */
 #define ALPS_BUTTONPAD          0x200   /* device is a clickpad */
 
 static const struct alps_model_info alps_model_data[] = {
@@ -251,9 +253,9 @@ static void alps_process_packet_v1_v2(struct psmouse *psmouse)
                 return;
         }
 
-        /* Non interleaved V2 dualpoint has separate stick button bits */
+        /* Dell non interleaved V2 dualpoint has separate stick button bits */
         if (priv->proto_version == ALPS_PROTO_V2 &&
-            priv->flags == (ALPS_PASS | ALPS_DUALPOINT)) {
+            priv->flags == (ALPS_DELL | ALPS_PASS | ALPS_DUALPOINT)) {
                 left |= packet[0] & 1;
                 right |= packet[0] & 2;
                 middle |= packet[0] & 4;
@@ -2550,6 +2552,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
         priv->byte0 = protocol->byte0;
         priv->mask0 = protocol->mask0;
         priv->flags = protocol->flags;
+        if (dmi_name_in_vendors("Dell"))
+                priv->flags |= ALPS_DELL;
 
         priv->x_max = 2000;
         priv->y_max = 1400;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index b10709f04615..30e3442518f8 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -2,6 +2,7 @@
  * Apple USB BCM5974 (Macbook Air and Penryn Macbook Pro) multitouch driver
  *
  * Copyright (C) 2008      Henrik Rydberg (rydberg@euromail.se)
+ * Copyright (C) 2015      John Horan (knasher@gmail.com)
  *
  * The USB initialization and package decoding was made by
  * Scott Shawcroft as part of the touchd user-space driver project:
@@ -91,6 +92,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
+/* MacbookPro12,1 (2015) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI    0x0272
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_ISO     0x0273
+#define USB_DEVICE_ID_APPLE_WELLSPRING9_JIS     0x0274
 
 #define BCM5974_DEVICE(prod) {                                  \
         .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -152,6 +157,10 @@ static const struct usb_device_id bcm5974_table[] = {
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_ISO),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING8_JIS),
+        /* MacbookPro12,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING9_JIS),
         /* Terminating entry */
         {}
 };
@@ -180,21 +189,47 @@ struct bt_data {
 enum tp_type {
         TYPE1,                  /* plain trackpad */
         TYPE2,                  /* button integrated in trackpad */
-        TYPE3                   /* additional header fields since June 2013 */
+        TYPE3,                  /* additional header fields since June 2013 */
+        TYPE4                   /* additional header field for pressure data */
 };
 
 /* trackpad finger data offsets, le16-aligned */
-#define FINGER_TYPE1            (13 * sizeof(__le16))
-#define FINGER_TYPE2            (15 * sizeof(__le16))
-#define FINGER_TYPE3            (19 * sizeof(__le16))
+#define HEADER_TYPE1            (13 * sizeof(__le16))
+#define HEADER_TYPE2            (15 * sizeof(__le16))
+#define HEADER_TYPE3            (19 * sizeof(__le16))
+#define HEADER_TYPE4            (23 * sizeof(__le16))
 
 /* trackpad button data offsets */
+#define BUTTON_TYPE1            0
 #define BUTTON_TYPE2            15
 #define BUTTON_TYPE3            23
+#define BUTTON_TYPE4            31
 
 /* list of device capability bits */
 #define HAS_INTEGRATED_BUTTON   1
 
+/* trackpad finger data block size */
+#define FSIZE_TYPE1             (14 * sizeof(__le16))
+#define FSIZE_TYPE2             (14 * sizeof(__le16))
+#define FSIZE_TYPE3             (14 * sizeof(__le16))
+#define FSIZE_TYPE4             (15 * sizeof(__le16))
+
+/* offset from header to finger struct */
+#define DELTA_TYPE1             (0 * sizeof(__le16))
+#define DELTA_TYPE2             (0 * sizeof(__le16))
+#define DELTA_TYPE3             (0 * sizeof(__le16))
+#define DELTA_TYPE4             (1 * sizeof(__le16))
+
+/* usb control message mode switch data */
+#define USBMSG_TYPE1            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE2            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE3            8, 0x300, 0, 0, 0x1, 0x8
+#define USBMSG_TYPE4            2, 0x302, 2, 1, 0x1, 0x0
+
+/* Wellspring initialization constants */
+#define BCM5974_WELLSPRING_MODE_READ_REQUEST_ID         1
+#define BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID        9
+
 /* trackpad finger structure, le16-aligned */
 struct tp_finger {
         __le16 origin;          /* zero when switching track finger */
@@ -207,14 +242,13 @@ struct tp_finger {
         __le16 orientation;     /* 16384 when point, else 15 bit angle */
         __le16 touch_major;     /* touch area, major axis */
         __le16 touch_minor;     /* touch area, minor axis */
-        __le16 unused[3];       /* zeros */
+        __le16 unused[2];       /* zeros */
+        __le16 pressure;        /* pressure on forcetouch touchpad */
         __le16 multi;           /* one finger: varies, more fingers: constant */
 } __attribute__((packed,aligned(2)));
 
 /* trackpad finger data size, empirically at least ten fingers */
 #define MAX_FINGERS             16
-#define SIZEOF_FINGER           sizeof(struct tp_finger)
-#define SIZEOF_ALL_FINGERS      (MAX_FINGERS * SIZEOF_FINGER)
 #define MAX_FINGER_ORIENTATION  16384
 
 /* device-specific parameters */
@@ -232,8 +266,17 @@ struct bcm5974_config {
         int bt_datalen;         /* data length of the button interface */
         int tp_ep;              /* the endpoint of the trackpad interface */
         enum tp_type tp_type;   /* type of trackpad interface */
-        int tp_offset;          /* offset to trackpad finger data */
+        int tp_header;          /* bytes in header block */
         int tp_datalen;         /* data length of the trackpad interface */
+        int tp_button;          /* offset to button data */
+        int tp_fsize;           /* bytes in single finger block */
+        int tp_delta;           /* offset from header to finger struct */
+        int um_size;            /* usb control message length */
+        int um_req_val;         /* usb control message value */
+        int um_req_idx;         /* usb control message index */
+        int um_switch_idx;      /* usb control message mode switch index */
+        int um_switch_on;       /* usb control message mode switch on */
+        int um_switch_off;      /* usb control message mode switch off */
         struct bcm5974_param p; /* finger pressure limits */
         struct bcm5974_param w; /* finger width limits */
         struct bcm5974_param x; /* horizontal limits */
@@ -259,6 +302,24 @@ struct bcm5974 {
         int slots[MAX_FINGERS];                         /* slot assignments */
 };
 
+/* trackpad finger block data, le16-aligned */
+static const struct tp_finger *get_tp_finger(const struct bcm5974 *dev, int i)
+{
+        const struct bcm5974_config *c = &dev->cfg;
+        u8 *f_base = dev->tp_data + c->tp_header + c->tp_delta;
+
+        return (const struct tp_finger *)(f_base + i * c->tp_fsize);
+}
+
+#define DATAFORMAT(type)                                \
+        type,                                           \
+        HEADER_##type,                                  \
+        HEADER_##type + (MAX_FINGERS) * (FSIZE_##type), \
+        BUTTON_##type,                                  \
+        FSIZE_##type,                                   \
+        DELTA_##type,                                   \
+        USBMSG_##type
+
 /* logical signal quality */
 #define SN_PRESSURE     45              /* pressure signal-to-noise ratio */
 #define SN_WIDTH        25              /* width signal-to-noise ratio */
@@ -273,7 +334,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING_JIS,
                 0,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE1),
                 { SN_PRESSURE, 0, 256 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4824, 5342 },
@@ -286,7 +347,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING2_JIS,
                 0,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE1, FINGER_TYPE1, FINGER_TYPE1 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE1),
                 { SN_PRESSURE, 0, 256 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4824, 4824 },
@@ -299,7 +360,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING3_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4460, 5166 },
@@ -312,7 +373,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING4_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4620, 5140 },
@@ -325,7 +386,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4616, 5112 },
@@ -338,7 +399,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING5_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4415, 5050 },
@@ -351,7 +412,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING6_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4620, 5140 },
@@ -364,7 +425,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4750, 5280 },
@@ -377,7 +438,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4620, 5140 },
@@ -390,7 +451,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING7_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4750, 5280 },
@@ -403,7 +464,7 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0x84, sizeof(struct bt_data),
-                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                0x81, DATAFORMAT(TYPE2),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4750, 5280 },
@@ -416,13 +477,26 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 USB_DEVICE_ID_APPLE_WELLSPRING8_JIS,
                 HAS_INTEGRATED_BUTTON,
                 0, sizeof(struct bt_data),
-                0x83, TYPE3, FINGER_TYPE3, FINGER_TYPE3 + SIZEOF_ALL_FINGERS,
+                0x83, DATAFORMAT(TYPE3),
                 { SN_PRESSURE, 0, 300 },
                 { SN_WIDTH, 0, 2048 },
                 { SN_COORD, -4620, 5140 },
                 { SN_COORD, -150, 6600 },
                 { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
         },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING9_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING9_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING9_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0, sizeof(struct bt_data),
+                0x83, DATAFORMAT(TYPE4),
+                { SN_PRESSURE, 0, 300 },
+                { SN_WIDTH, 0, 2048 },
+                { SN_COORD, -4828, 5345 },
+                { SN_COORD, -203, 6803 },
+                { SN_ORIENT, -MAX_FINGER_ORIENTATION, MAX_FINGER_ORIENTATION }
+        },
         {}
 };
 
@@ -549,19 +623,18 @@ static int report_tp_state(struct bcm5974 *dev, int size)
         struct input_dev *input = dev->input;
         int raw_n, i, n = 0;
 
-        if (size < c->tp_offset || (size - c->tp_offset) % SIZEOF_FINGER != 0)
+        if (size < c->tp_header || (size - c->tp_header) % c->tp_fsize != 0)
                 return -EIO;
 
-        /* finger data, le16-aligned */
-        f = (const struct tp_finger *)(dev->tp_data + c->tp_offset);
-        raw_n = (size - c->tp_offset) / SIZEOF_FINGER;
+        raw_n = (size - c->tp_header) / c->tp_fsize;
 
         for (i = 0; i < raw_n; i++) {
-                if (raw2int(f[i].touch_major) == 0)
+                f = get_tp_finger(dev, i);
+                if (raw2int(f->touch_major) == 0)
                         continue;
-                dev->pos[n].x = raw2int(f[i].abs_x);
-                dev->pos[n].y = c->y.min + c->y.max - raw2int(f[i].abs_y);
-                dev->index[n++] = &f[i];
+                dev->pos[n].x = raw2int(f->abs_x);
+                dev->pos[n].y = c->y.min + c->y.max - raw2int(f->abs_y);
+                dev->index[n++] = f;
         }
 
         input_mt_assign_slots(input, dev->slots, dev->pos, n, 0);
@@ -572,32 +645,22 @@ static int report_tp_state(struct bcm5974 *dev, int size)
 
         input_mt_sync_frame(input);
 
-        report_synaptics_data(input, c, f, raw_n);
+        report_synaptics_data(input, c, get_tp_finger(dev, 0), raw_n);
 
-        /* type 2 reports button events via ibt only */
-        if (c->tp_type == TYPE2) {
-                int ibt = raw2int(dev->tp_data[BUTTON_TYPE2]);
+        /* later types report button events via integrated button only */
+        if (c->caps & HAS_INTEGRATED_BUTTON) {
+                int ibt = raw2int(dev->tp_data[c->tp_button]);
                 input_report_key(input, BTN_LEFT, ibt);
         }
 
-        if (c->tp_type == TYPE3)
-                input_report_key(input, BTN_LEFT, dev->tp_data[BUTTON_TYPE3]);
-
         input_sync(input);
 
         return 0;
 }
 
-/* Wellspring initialization constants */
-#define BCM5974_WELLSPRING_MODE_READ_REQUEST_ID         1
-#define BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID        9
-#define BCM5974_WELLSPRING_MODE_REQUEST_VALUE           0x300
-#define BCM5974_WELLSPRING_MODE_REQUEST_INDEX           0
-#define BCM5974_WELLSPRING_MODE_VENDOR_VALUE            0x01
-#define BCM5974_WELLSPRING_MODE_NORMAL_VALUE            0x08
-
 static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
 {
+        const struct bcm5974_config *c = &dev->cfg;
         int retval = 0, size;
         char *data;
 
@@ -605,7 +668,7 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
         if (dev->cfg.tp_type == TYPE3)
                 return 0;
 
-        data = kmalloc(8, GFP_KERNEL);
+        data = kmalloc(c->um_size, GFP_KERNEL);
         if (!data) {
                 dev_err(&dev->intf->dev, "out of memory\n");
                 retval = -ENOMEM;
@@ -616,28 +679,24 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
         size = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                         BCM5974_WELLSPRING_MODE_READ_REQUEST_ID,
                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_VALUE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_INDEX, data, 8, 5000);
+                        c->um_req_val, c->um_req_idx, data, c->um_size, 5000);
 
-        if (size != 8) {
+        if (size != c->um_size) {
                 dev_err(&dev->intf->dev, "could not read from device\n");
                 retval = -EIO;
                 goto out;
         }
 
         /* apply the mode switch */
-        data[0] = on ?
-                BCM5974_WELLSPRING_MODE_VENDOR_VALUE :
-                BCM5974_WELLSPRING_MODE_NORMAL_VALUE;
+        data[c->um_switch_idx] = on ? c->um_switch_on : c->um_switch_off;
 
         /* write configuration */
         size = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                         BCM5974_WELLSPRING_MODE_WRITE_REQUEST_ID,
                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_VALUE,
-                        BCM5974_WELLSPRING_MODE_REQUEST_INDEX, data, 8, 5000);
+                        c->um_req_val, c->um_req_idx, data, c->um_size, 5000);
 
-        if (size != 8) {
+        if (size != c->um_size) {
                 dev_err(&dev->intf->dev, "could not write to device\n");
                 retval = -EIO;
                 goto out;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 22b9ca901f4e..2955f1d0ca6c 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -783,19 +783,26 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
         struct elantech_data *etd = psmouse->private;
         unsigned char *packet = psmouse->packet;
         unsigned char packet_type = packet[3] & 0x03;
+        unsigned int ic_version;
         bool sanity_check;
 
         if (etd->tp_dev && (packet[3] & 0x0f) == 0x06)
                 return PACKET_TRACKPOINT;
 
+        /* This represents the version of IC body. */
+        ic_version = (etd->fw_version & 0x0f0000) >> 16;
+
         /*
          * Sanity check based on the constant bits of a packet.
          * The constant bits change depending on the value of
-         * the hardware flag 'crc_enabled' but are the same for
-         * every packet, regardless of the type.
+         * the hardware flag 'crc_enabled' and the version of
+         * the IC body, but are the same for every packet,
+         * regardless of the type.
          */
         if (etd->crc_enabled)
                 sanity_check = ((packet[3] & 0x08) == 0x00);
+        else if (ic_version == 7 && etd->samples[1] == 0x2A)
+                sanity_check = ((packet[3] & 0x1c) == 0x10);
         else
                 sanity_check = ((packet[0] & 0x0c) == 0x04 &&
                                 (packet[3] & 0x1c) == 0x10);
@@ -1116,6 +1123,7 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
+ * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
  * Lenovo L430             0x350f02        b9, 15, 0c      2 hw buttons (*)
@@ -1651,6 +1659,16 @@ int elantech_init(struct psmouse *psmouse)
                      etd->capabilities[0], etd->capabilities[1],
                      etd->capabilities[2]);
 
+        if (etd->hw_version != 1) {
+                if (etd->send_cmd(psmouse, ETP_SAMPLE_QUERY, etd->samples)) {
+                        psmouse_err(psmouse, "failed to query sample data\n");
+                        goto init_fail;
+                }
+                psmouse_info(psmouse,
+                             "Elan sample query result %02x, %02x, %02x\n",
+                             etd->samples[0], etd->samples[1], etd->samples[2]);
+        }
+
         if (elantech_set_absolute_mode(psmouse)) {
                 psmouse_err(psmouse,
                             "failed to put touchpad into absolute mode.\n");
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index f965d1569cc3..e1cbf409d9c8 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -129,6 +129,7 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities[3];
+        unsigned char samples[3];
         bool paritycheck;
         bool jumpy_cursor;
         bool reports_pressure;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 3a32caf06bf1..6025eb430c0a 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1484,12 +1484,12 @@ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
         priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
 
         psmouse_info(psmouse,
-                     "Touchpad model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx, board id: %lu, fw id: %lu\n",
+                     "Touchpad model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx/%#lx, board id: %lu, fw id: %lu\n",
                      SYN_ID_MODEL(priv->identity),
                      SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
                      priv->model_id,
                      priv->capabilities, priv->ext_cap, priv->ext_cap_0c,
-                     priv->board_id, priv->firmware_id);
+                     priv->ext_cap_10, priv->board_id, priv->firmware_id);
 
         set_input_params(psmouse, priv);
 
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 80285c71786e..f58a196521a9 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -429,7 +429,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
                 goto unlock;
         }
 
-        if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
+        if (buf[PAYLOAD_LENGTH] == 0) {
                 dev_err(&client->dev, "invalid payload length: %d\n",
                         buf[PAYLOAD_LENGTH]);
                 ret = -EIO;
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index a57e9b749895..658ee39e6569 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -76,8 +76,6 @@ LIST_HEAD(hpet_map);
  * Domain for untranslated devices - only allocated
  * if iommu=pt passed on kernel cmd line.
  */
-static struct protection_domain *pt_domain;
-
 static const struct iommu_ops amd_iommu_ops;
 
 static ATOMIC_NOTIFIER_HEAD(ppr_notifier);
@@ -96,7 +94,7 @@ struct iommu_dev_data {
         struct protection_domain *domain; /* Domain the device is bound to */
         u16 devid;                        /* PCI Device ID */
         bool iommu_v2;                    /* Device can make use of IOMMUv2 */
-        bool passthrough;                 /* Default for device is pt_domain */
+        bool passthrough;                 /* Device is identity mapped */
         struct {
                 bool enabled;
                 int qdep;
@@ -116,7 +114,6 @@ struct iommu_cmd {
 struct kmem_cache *amd_iommu_irq_cache;
 
 static void update_domain(struct protection_domain *domain);
-static int alloc_passthrough_domain(void);
 static int protection_domain_init(struct protection_domain *domain);
 
 /****************************************************************************
@@ -2167,15 +2164,17 @@ static int attach_device(struct device *dev,
         dev_data = get_dev_data(dev);
 
         if (domain->flags & PD_IOMMUV2_MASK) {
-                if (!dev_data->iommu_v2 || !dev_data->passthrough)
+                if (!dev_data->passthrough)
                         return -EINVAL;
 
-                if (pdev_iommuv2_enable(pdev) != 0)
-                        return -EINVAL;
+                if (dev_data->iommu_v2) {
+                        if (pdev_iommuv2_enable(pdev) != 0)
+                                return -EINVAL;
 
-                dev_data->ats.enabled = true;
-                dev_data->ats.qdep    = pci_ats_queue_depth(pdev);
-                dev_data->pri_tlp     = pci_pri_tlp_required(pdev);
+                        dev_data->ats.enabled = true;
+                        dev_data->ats.qdep    = pci_ats_queue_depth(pdev);
+                        dev_data->pri_tlp     = pci_pri_tlp_required(pdev);
+                }
         } else if (amd_iommu_iotlb_sup &&
                    pci_enable_ats(pdev, PAGE_SHIFT) == 0) {
                 dev_data->ats.enabled = true;
@@ -2221,15 +2220,6 @@ static void __detach_device(struct iommu_dev_data *dev_data)
         do_detach(head);
 
         spin_unlock_irqrestore(&domain->lock, flags);
-
-        /*
-         * If we run in passthrough mode the device must be assigned to the
-         * passthrough domain if it is detached from any other domain.
-         * Make sure we can deassign from the pt_domain itself.
-         */
-        if (dev_data->passthrough &&
-            (dev_data->domain == NULL && domain != pt_domain))
-                __attach_device(dev_data, pt_domain);
 }
 
 /*
@@ -2249,7 +2239,7 @@ static void detach_device(struct device *dev)
         __detach_device(dev_data);
         write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
 
-        if (domain->flags & PD_IOMMUV2_MASK)
+        if (domain->flags & PD_IOMMUV2_MASK && dev_data->iommu_v2)
                 pdev_iommuv2_disable(to_pci_dev(dev));
         else if (dev_data->ats.enabled)
                 pci_disable_ats(to_pci_dev(dev));
@@ -2287,17 +2277,15 @@ static int amd_iommu_add_device(struct device *dev)
 
         BUG_ON(!dev_data);
 
-        if (dev_data->iommu_v2)
+        if (iommu_pass_through || dev_data->iommu_v2)
                 iommu_request_dm_for_dev(dev);
 
         /* Domains are initialized for this device - have a look what we ended up with */
         domain = iommu_get_domain_for_dev(dev);
-        if (domain->type == IOMMU_DOMAIN_IDENTITY) {
+        if (domain->type == IOMMU_DOMAIN_IDENTITY)
                 dev_data->passthrough = true;
-                dev->archdata.dma_ops = &nommu_dma_ops;
-        } else {
+        else
                 dev->archdata.dma_ops = &amd_iommu_dma_ops;
-        }
 
 out:
         iommu_completion_wait(iommu);
@@ -2862,8 +2850,17 @@ int __init amd_iommu_init_api(void)
 
 int __init amd_iommu_init_dma_ops(void)
 {
+        swiotlb        = iommu_pass_through ? 1 : 0;
         iommu_detected = 1;
-        swiotlb = 0;
+
+        /*
+         * In case we don't initialize SWIOTLB (actually the common case
+         * when AMD IOMMU is enabled), make sure there are global
+         * dma_ops set as a fall-back for devices not handled by this
+         * driver (for example non-PCI devices).
+         */
+        if (!swiotlb)
+                dma_ops = &nommu_dma_ops;
 
         amd_iommu_stats_init();
 
@@ -2947,21 +2944,6 @@ out_err:
         return NULL;
 }
 
-static int alloc_passthrough_domain(void)
-{
-        if (pt_domain != NULL)
-                return 0;
-
-        /* allocate passthrough domain */
-        pt_domain = protection_domain_alloc();
-        if (!pt_domain)
-                return -ENOMEM;
-
-        pt_domain->mode = PAGE_MODE_NONE;
-
-        return 0;
-}
-
 static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
 {
         struct protection_domain *pdomain;
@@ -3222,33 +3204,6 @@ static const struct iommu_ops amd_iommu_ops = {
  *
  *****************************************************************************/
 
-int __init amd_iommu_init_passthrough(void)
-{
-        struct iommu_dev_data *dev_data;
-        struct pci_dev *dev = NULL;
-        int ret;
-
-        ret = alloc_passthrough_domain();
-        if (ret)
-                return ret;
-
-        for_each_pci_dev(dev) {
-                if (!check_device(&dev->dev))
-                        continue;
-
-                dev_data = get_dev_data(&dev->dev);
-                dev_data->passthrough = true;
-
-                attach_device(&dev->dev, pt_domain);
-        }
-
-        amd_iommu_stats_init();
-
-        pr_info("AMD-Vi: Initialized for Passthrough Mode\n");
-
-        return 0;
-}
-
 /* IOMMUv2 specific functions */
 int amd_iommu_register_ppr_notifier(struct notifier_block *nb)
 {
@@ -3363,7 +3318,12 @@ static int __flush_pasid(struct protection_domain *domain, int pasid,
                 struct amd_iommu *iommu;
                 int qdep;
 
-                BUG_ON(!dev_data->ats.enabled);
+                /*
+                   There might be non-IOMMUv2 capable devices in an IOMMUv2
+                 * domain.
+                 */
+                if (!dev_data->ats.enabled)
+                        continue;
 
                 qdep  = dev_data->ats.qdep;
                 iommu = amd_iommu_rlookup_table[dev_data->devid];
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index dbda9ae68c5d..a24495eb4e26 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -2026,14 +2026,6 @@ static bool detect_ivrs(void)
         return true;
 }
 
-static int amd_iommu_init_dma(void)
-{
-        if (iommu_pass_through)
-                return amd_iommu_init_passthrough();
-        else
-                return amd_iommu_init_dma_ops();
-}
-
 /****************************************************************************
  *
  * AMD IOMMU Initialization State Machine
@@ -2073,7 +2065,7 @@ static int __init state_next(void)
                 init_state = ret ? IOMMU_INIT_ERROR : IOMMU_INTERRUPTS_EN;
                 break;
         case IOMMU_INTERRUPTS_EN:
-                ret = amd_iommu_init_dma();
+                ret = amd_iommu_init_dma_ops();
                 init_state = ret ? IOMMU_INIT_ERROR : IOMMU_DMA_OPS;
                 break;
         case IOMMU_DMA_OPS:
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 3465faf1809e..f7b875bb70d4 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -132,11 +132,19 @@ static struct device_state *get_device_state(u16 devid)
 
 static void free_device_state(struct device_state *dev_state)
 {
+        struct iommu_group *group;
+
         /*
          * First detach device from domain - No more PRI requests will arrive
          * from that device after it is unbound from the IOMMUv2 domain.
          */
-        iommu_detach_device(dev_state->domain, &dev_state->pdev->dev);
+        group = iommu_group_get(&dev_state->pdev->dev);
+        if (WARN_ON(!group))
+                return;
+
+        iommu_detach_group(dev_state->domain, group);
+
+        iommu_group_put(group);
 
         /* Everything is down now, free the IOMMUv2 domain */
         iommu_domain_free(dev_state->domain);
@@ -731,6 +739,7 @@ EXPORT_SYMBOL(amd_iommu_unbind_pasid);
 int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
 {
         struct device_state *dev_state;
+        struct iommu_group *group;
         unsigned long flags;
         int ret, tmp;
         u16 devid;
@@ -776,10 +785,16 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
         if (ret)
                 goto out_free_domain;
 
-        ret = iommu_attach_device(dev_state->domain, &pdev->dev);
-        if (ret != 0)
+        group = iommu_group_get(&pdev->dev);
+        if (!group)
                 goto out_free_domain;
 
+        ret = iommu_attach_group(dev_state->domain, group);
+        if (ret != 0)
+                goto out_drop_group;
+
+        iommu_group_put(group);
+
         spin_lock_irqsave(&state_lock, flags);
 
         if (__get_device_state(devid) != NULL) {
@@ -794,6 +809,9 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
 
         return 0;
 
+out_drop_group:
+        iommu_group_put(group);
+
 out_free_domain:
         iommu_domain_free(dev_state->domain);
 
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index b7d54d428b5e..ff4be0515a0d 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -538,7 +538,7 @@ static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 
 static irqreturn_t ipi_call_interrupt(int irq, void *dev_id)
 {
-        smp_call_function_interrupt();
+        generic_smp_call_function_interrupt();
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/macintosh/ans-lcd.c b/drivers/macintosh/ans-lcd.c
index 1a57e88a38f7..cd35079c8c98 100644
--- a/drivers/macintosh/ans-lcd.c
+++ b/drivers/macintosh/ans-lcd.c
@@ -7,7 +7,7 @@
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/fcntl.h>
-#include <linux/init.h>
+#include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/fs.h>
 
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index b59727309072..bfec3bdfe598 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -259,7 +259,7 @@ config DM_CRYPT
           the ciphers you're going to use in the cryptoapi configuration.
 
           For further information on dm-crypt and userspace tools see:
-          <http://code.google.com/p/cryptsetup/wiki/DMCrypt>
+          <https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt>
 
           To compile this code as a module, choose M here: the module will
           be called dm-crypt.
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index b6f22651dd35..48a4a826ae07 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -1686,7 +1686,7 @@ static struct dm_cache_policy *smq_create(dm_cblock_t cache_size,
 
         if (from_cblock(cache_size)) {
                 mq->cache_hit_bits = alloc_bitset(from_cblock(cache_size));
-                if (!mq->cache_hit_bits && mq->cache_hit_bits) {
+                if (!mq->cache_hit_bits) {
                         DMERR("couldn't allocate cache hit bitset");
                         goto bad_cache_hit_bits;
                 }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index b680da5d7b93..1fe93cfea7d3 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -424,6 +424,7 @@ static void free_migration(struct dm_cache_migration *mg)
                 wake_up(&cache->migration_wait);
 
         mempool_free(mg, cache->migration_pool);
+        wake_worker(cache);
 }
 
 static int prealloc_data_structs(struct cache *cache, struct prealloc *p)
@@ -1966,6 +1967,7 @@ static void process_deferred_bios(struct cache *cache)
                  * this bio might require one, we pause until there are some
                  * prepared mappings to process.
                  */
+                prealloc_used = true;
                 if (prealloc_data_structs(cache, &structs)) {
                         spin_lock_irqsave(&cache->lock, flags);
                         bio_list_merge(&cache->deferred_bios, &bios);
@@ -1981,7 +1983,6 @@ static void process_deferred_bios(struct cache *cache)
                         process_discard_bio(cache, &structs, bio);
                 else
                         process_bio(cache, &structs, bio);
-                prealloc_used = true;
         }
 
         if (prealloc_used)
@@ -2010,6 +2011,7 @@ static void process_deferred_cells(struct cache *cache)
                  * this bio might require one, we pause until there are some
                  * prepared mappings to process.
                  */
+                prealloc_used = true;
                 if (prealloc_data_structs(cache, &structs)) {
                         spin_lock_irqsave(&cache->lock, flags);
                         list_splice(&cells, &cache->deferred_cells);
@@ -2018,7 +2020,6 @@ static void process_deferred_cells(struct cache *cache)
                 }
 
                 process_cell(cache, &structs, cell);
-                prealloc_used = true;
         }
 
         if (prealloc_used)
@@ -2080,6 +2081,7 @@ static void writeback_some_dirty_blocks(struct cache *cache)
                 if (policy_writeback_work(cache->policy, &oblock, &cblock, busy))
                         break; /* no work to do */
 
+                prealloc_used = true;
                 if (prealloc_data_structs(cache, &structs) ||
                     get_cell(cache, oblock, &structs, &old_ocell)) {
                         policy_set_dirty(cache->policy, oblock);
@@ -2087,7 +2089,6 @@ static void writeback_some_dirty_blocks(struct cache *cache)
                 }
 
                 writeback(cache, &structs, oblock, cblock, old_ocell);
-                prealloc_used = true;
         }
 
         if (prealloc_used)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 1c50c580215c..d2bbe8cc1e97 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -666,16 +666,21 @@ static void requeue_io(struct thin_c *tc)
         requeue_deferred_cells(tc);
 }
 
-static void error_retry_list(struct pool *pool)
+static void error_retry_list_with_code(struct pool *pool, int error)
 {
         struct thin_c *tc;
 
         rcu_read_lock();
         list_for_each_entry_rcu(tc, &pool->active_thins, list)
-                error_thin_bio_list(tc, &tc->retry_on_resume_list, -EIO);
+                error_thin_bio_list(tc, &tc->retry_on_resume_list, error);
         rcu_read_unlock();
 }
 
+static void error_retry_list(struct pool *pool)
+{
+        return error_retry_list_with_code(pool, -EIO);
+}
+
 /*
  * This section of code contains the logic for processing a thin device's IO.
  * Much of the code depends on pool object resources (lists, workqueues, etc)
@@ -2297,7 +2302,7 @@ static void do_no_space_timeout(struct work_struct *ws)
         if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space) {
                 pool->pf.error_if_no_space = true;
                 notify_of_pool_mode_change_to_oods(pool);
-                error_retry_list(pool);
+                error_retry_list_with_code(pool, -ENOSPC);
         }
 }
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index ab37ae114e94..0d7ab20c58df 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1729,7 +1729,8 @@ static int dm_merge_bvec(struct request_queue *q,
         struct mapped_device *md = q->queuedata;
         struct dm_table *map = dm_get_live_table_fast(md);
         struct dm_target *ti;
-        sector_t max_sectors, max_size = 0;
+        sector_t max_sectors;
+        int max_size = 0;
 
         if (unlikely(!map))
                 goto out;
@@ -1742,18 +1743,10 @@ static int dm_merge_bvec(struct request_queue *q,
          * Find maximum amount of I/O that won't need splitting
          */
         max_sectors = min(max_io_len(bvm->bi_sector, ti),
-                          (sector_t) queue_max_sectors(q));
+                          (sector_t) BIO_MAX_SECTORS);
         max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size;
-
-        /*
-         * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t
-         * to the targets' merge function since it holds sectors not bytes).
-         * Just doing this as an interim fix for stable@ because the more
-         * comprehensive cleanup of switching to sector_t will impact every
-         * DM target that implements a ->merge hook.
-         */
-        if (max_size > INT_MAX)
-                max_size = INT_MAX;
+        if (max_size < 0)
+                max_size = 0;
 
         /*
          * merge_bvec_fn() returns number of bytes
@@ -1761,13 +1754,13 @@ static int dm_merge_bvec(struct request_queue *q,
          * max is precomputed maximal io size
          */
         if (max_size && ti->type->merge)
-                max_size = ti->type->merge(ti, bvm, biovec, (int) max_size);
+                max_size = ti->type->merge(ti, bvm, biovec, max_size);
         /*
          * If the target doesn't support merge method and some of the devices
-         * provided their merge_bvec method (we know this by looking for the
-         * max_hw_sectors that dm_set_device_limits may set), then we can't
-         * allow bios with multiple vector entries.  So always set max_size
-         * to 0, and the code below allows just one page.
+         * provided their merge_bvec method (we know this by looking at
+         * queue_max_hw_sectors), then we can't allow bios with multiple vector
+         * entries.  So always set max_size to 0, and the code below allows
+         * just one page.
          */
         else if (queue_max_hw_sectors(q) <= PAGE_SIZE >> 9)
                 max_size = 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0c2a4e8b873c..e25f00f0138a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5759,7 +5759,7 @@ static int get_bitmap_file(struct mddev *mddev, void __user * arg)
         char *ptr;
         int err;
 
-        file = kmalloc(sizeof(*file), GFP_NOIO);
+        file = kzalloc(sizeof(*file), GFP_NOIO);
         if (!file)
                 return -ENOMEM;
 
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index 9836c0ae897c..9ca9eccd512f 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -689,6 +689,7 @@ static int remove_one(struct dm_btree_info *info, dm_block_t root,
                                              value_ptr(n, index));
 
                 delete_at(n, index);
+                keys[last_level] = k + 1ull;
 
         } else
                 r = -ENODATA;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 94f5b55069e0..967a4ed73929 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1476,6 +1476,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
 {
         char b[BDEVNAME_SIZE];
         struct r1conf *conf = mddev->private;
+        unsigned long flags;
 
         /*
          * If it is not operational, then we have already marked it as dead
@@ -1495,14 +1496,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
                 return;
         }
         set_bit(Blocked, &rdev->flags);
+        spin_lock_irqsave(&conf->device_lock, flags);
         if (test_and_clear_bit(In_sync, &rdev->flags)) {
-                unsigned long flags;
-                spin_lock_irqsave(&conf->device_lock, flags);
                 mddev->degraded++;
                 set_bit(Faulty, &rdev->flags);
-                spin_unlock_irqrestore(&conf->device_lock, flags);
         } else
                 set_bit(Faulty, &rdev->flags);
+        spin_unlock_irqrestore(&conf->device_lock, flags);
         /*
          * if recovery is running, make sure it aborts.
          */
@@ -1568,7 +1568,10 @@ static int raid1_spare_active(struct mddev *mddev)
          * Find all failed disks within the RAID1 configuration
          * and mark them readable.
          * Called under mddev lock, so rcu protection not needed.
+         * device_lock used to avoid races with raid1_end_read_request
+         * which expects 'In_sync' flags and ->degraded to be consistent.
          */
+        spin_lock_irqsave(&conf->device_lock, flags);
         for (i = 0; i < conf->raid_disks; i++) {
                 struct md_rdev *rdev = conf->mirrors[i].rdev;
                 struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev;
@@ -1599,7 +1602,6 @@ static int raid1_spare_active(struct mddev *mddev)
                         sysfs_notify_dirent_safe(rdev->sysfs_state);
                 }
         }
-        spin_lock_irqsave(&conf->device_lock, flags);
         mddev->degraded -= count;
         spin_unlock_irqrestore(&conf->device_lock, flags);
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 643d217bfa13..f757023fc458 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2256,7 +2256,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 static int drop_one_stripe(struct r5conf *conf)
 {
         struct stripe_head *sh;
-        int hash = (conf->max_nr_stripes - 1) % NR_STRIPE_HASH_LOCKS;
+        int hash = (conf->max_nr_stripes - 1) & STRIPE_HASH_LOCKS_MASK;
 
         spin_lock_irq(conf->hash_locks + hash);
         sh = get_free_stripe(conf, hash);
@@ -6388,7 +6388,8 @@ static unsigned long raid5_cache_scan(struct shrinker *shrink,
 
         if (mutex_trylock(&conf->cache_size_mutex)) {
                 ret= 0;
-                while (ret < sc->nr_to_scan) {
+                while (ret < sc->nr_to_scan &&
+                       conf->max_nr_stripes > conf->min_nr_stripes) {
                         if (drop_one_stripe(conf) == 0) {
                                 ret = SHRINK_STOP;
                                 break;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 653815950aa2..3f68dd251ce8 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -115,7 +115,7 @@ config MFD_CROS_EC_I2C
 
 config MFD_CROS_EC_SPI
         tristate "ChromeOS Embedded Controller (SPI)"
-        depends on MFD_CROS_EC && CROS_EC_PROTO && SPI && OF
+        depends on MFD_CROS_EC && CROS_EC_PROTO && SPI
 
         ---help---
           If you say Y here, you get support for talking to the ChromeOS EC
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index bebf58a06a6b..a72ddb295078 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -651,7 +651,7 @@ static int arizona_runtime_suspend(struct device *dev)
 
                 arizona->has_fully_powered_off = true;
 
-                disable_irq(arizona->irq);
+                disable_irq_nosync(arizona->irq);
                 arizona_enable_reset(arizona);
                 regulator_bulk_disable(arizona->num_core_supplies,
                                        arizona->core_supplies);
@@ -1141,10 +1141,6 @@ int arizona_dev_init(struct arizona *arizona)
                              arizona->pdata.gpio_defaults[i]);
         }
 
-        pm_runtime_set_autosuspend_delay(arizona->dev, 100);
-        pm_runtime_use_autosuspend(arizona->dev);
-        pm_runtime_enable(arizona->dev);
-
         /* Chip default */
         if (!arizona->pdata.clk32k_src)
                 arizona->pdata.clk32k_src = ARIZONA_32KZ_MCLK2;
@@ -1245,11 +1241,17 @@ int arizona_dev_init(struct arizona *arizona)
                                            arizona->pdata.spk_fmt[i]);
         }
 
+        pm_runtime_set_active(arizona->dev);
+        pm_runtime_enable(arizona->dev);
+
         /* Set up for interrupts */
         ret = arizona_irq_init(arizona);
         if (ret != 0)
                 goto err_reset;
 
+        pm_runtime_set_autosuspend_delay(arizona->dev, 100);
+        pm_runtime_use_autosuspend(arizona->dev);
+
         arizona_request_irq(arizona, ARIZONA_IRQ_CLKGEN_ERR, "CLKGEN error",
                             arizona_clkgen_err, arizona);
         arizona_request_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, "Overclocked",
@@ -1278,10 +1280,6 @@ int arizona_dev_init(struct arizona *arizona)
                 goto err_irq;
         }
 
-#ifdef CONFIG_PM
-        regulator_disable(arizona->dcvdd);
-#endif
-
         return 0;
 
 err_irq:
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 2d3db81be099..6ded3dc36644 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -438,9 +438,6 @@ static ssize_t at24_bin_write(struct file *filp, struct kobject *kobj,
 {
         struct at24_data *at24;
 
-        if (unlikely(off >= attr->size))
-                return -EFBIG;
-
         at24 = dev_get_drvdata(container_of(kobj, struct device, kobj));
         return at24_write(at24, buf, off, count);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e1ccefce9a9d..a98dd4f1b0e3 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -786,6 +786,7 @@ static bool bond_should_notify_peers(struct bonding *bond)
                    slave ? slave->dev->name : "NULL");
 
         if (!slave || !bond->send_peer_notif ||
+            !netif_carrier_ok(bond->dev) ||
             test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
                 return false;
 
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 2d1ce3c5d0dd..753887d02b46 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -1763,16 +1763,9 @@ vortex_open(struct net_device *dev)
                         vp->rx_ring[i].addr = cpu_to_le32(pci_map_single(VORTEX_PCI(vp), skb->data, PKT_BUF_SZ, PCI_DMA_FROMDEVICE));
                 }
                 if (i != RX_RING_SIZE) {
-                        int j;
                         pr_emerg("%s: no memory for rx ring\n", dev->name);
-                        for (j = 0; j < i; j++) {
-                                if (vp->rx_skbuff[j]) {
-                                        dev_kfree_skb(vp->rx_skbuff[j]);
-                                        vp->rx_skbuff[j] = NULL;
-                                }
-                        }
                         retval = -ENOMEM;
-                        goto err_free_irq;
+                        goto err_free_skb;
                 }
                 /* Wrap the ring. */
                 vp->rx_ring[i-1].next = cpu_to_le32(vp->rx_ring_dma);
@@ -1782,7 +1775,13 @@ vortex_open(struct net_device *dev)
         if (!retval)
                 goto out;
 
-err_free_irq:
+err_free_skb:
+        for (i = 0; i < RX_RING_SIZE; i++) {
+                if (vp->rx_skbuff[i]) {
+                        dev_kfree_skb(vp->rx_skbuff[i]);
+                        vp->rx_skbuff[i] = NULL;
+                }
+        }
         free_irq(dev->irq, dev);
 err:
         if (vortex_debug > 1)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index a90d7364334f..f7fbdc9d1325 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -262,9 +262,9 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         if (likely(skb)) {
                 (*pkts_compl)++;
                 (*bytes_compl) += skb->len;
+                dev_kfree_skb_any(skb);
         }
 
-        dev_kfree_skb_any(skb);
         tx_buf->first_bd = 0;
         tx_buf->skb = NULL;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 76b9052a961c..5907c821d131 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -1718,6 +1718,22 @@ static int bnx2x_nvram_write(struct bnx2x *bp, u32 offset, u8 *data_buf,
                 offset += sizeof(u32);
                 data_buf += sizeof(u32);
                 written_so_far += sizeof(u32);
+
+                /* At end of each 4Kb page, release nvram lock to allow MFW
+                 * chance to take it for its own use.
+                 */
+                if ((cmd_flags & MCPR_NVM_COMMAND_LAST) &&
+                    (written_so_far < buf_size)) {
+                        DP(BNX2X_MSG_ETHTOOL | BNX2X_MSG_NVM,
+                           "Releasing NVM lock after offset 0x%x\n",
+                           (u32)(offset - sizeof(u32)));
+                        bnx2x_release_nvram_lock(bp);
+                        usleep_range(1000, 2000);
+                        rc = bnx2x_acquire_nvram_lock(bp);
+                        if (rc)
+                                return rc;
+                }
+
                 cmd_flags = 0;
         }
 
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 0612b19f6313..506047c38607 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -676,6 +676,7 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                         if (!next_cmpl->valid)
                                 break;
                 }
+                packets++;
 
                 /* TODO: BNA_CQ_EF_LOCAL ? */
                 if (unlikely(flags & (BNA_CQ_EF_MAC_ERROR |
@@ -692,7 +693,6 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                 else
                         bnad_cq_setup_skb_frags(rcb, skb, sop_ci, nvecs, len);
 
-                packets++;
                 rcb->rxq->rx_packets++;
                 rcb->rxq->rx_bytes += totlen;
                 ccb->bytes_per_intr += totlen;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index caeb39561567..bf9eb2ecf960 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -104,6 +104,57 @@ static void *macb_rx_buffer(struct macb *bp, unsigned int index)
         return bp->rx_buffers + bp->rx_buffer_size * macb_rx_ring_wrap(index);
 }
 
+/* I/O accessors */
+static u32 hw_readl_native(struct macb *bp, int offset)
+{
+        return __raw_readl(bp->regs + offset);
+}
+
+static void hw_writel_native(struct macb *bp, int offset, u32 value)
+{
+        __raw_writel(value, bp->regs + offset);
+}
+
+static u32 hw_readl(struct macb *bp, int offset)
+{
+        return readl_relaxed(bp->regs + offset);
+}
+
+static void hw_writel(struct macb *bp, int offset, u32 value)
+{
+        writel_relaxed(value, bp->regs + offset);
+}
+
+/*
+ * Find the CPU endianness by using the loopback bit of NCR register. When the
+ * CPU is in big endian we need to program swaped mode for management
+ * descriptor access.
+ */
+static bool hw_is_native_io(void __iomem *addr)
+{
+        u32 value = MACB_BIT(LLB);
+
+        __raw_writel(value, addr + MACB_NCR);
+        value = __raw_readl(addr + MACB_NCR);
+
+        /* Write 0 back to disable everything */
+        __raw_writel(0, addr + MACB_NCR);
+
+        return value == MACB_BIT(LLB);
+}
+
+static bool hw_is_gem(void __iomem *addr, bool native_io)
+{
+        u32 id;
+
+        if (native_io)
+                id = __raw_readl(addr + MACB_MID);
+        else
+                id = readl_relaxed(addr + MACB_MID);
+
+        return MACB_BFEXT(IDNUM, id) >= 0x2;
+}
+
 static void macb_set_hwaddr(struct macb *bp)
 {
         u32 bottom;
@@ -160,7 +211,7 @@ static void macb_get_hwaddr(struct macb *bp)
                 }
         }
 
-        netdev_info(bp->dev, "invalid hw address, using random\n");
+        dev_info(&bp->pdev->dev, "invalid hw address, using random\n");
         eth_hw_addr_random(bp->dev);
 }
 
@@ -252,7 +303,6 @@ static void macb_handle_link_change(struct net_device *dev)
         struct macb *bp = netdev_priv(dev);
         struct phy_device *phydev = bp->phy_dev;
         unsigned long flags;
-
         int status_change = 0;
 
         spin_lock_irqsave(&bp->lock, flags);
@@ -449,14 +499,14 @@ err_out:
 
 static void macb_update_stats(struct macb *bp)
 {
-        u32 __iomem *reg = bp->regs + MACB_PFR;
         u32 *p = &bp->hw_stats.macb.rx_pause_frames;
         u32 *end = &bp->hw_stats.macb.tx_pause_frames + 1;
+        int offset = MACB_PFR;
 
         WARN_ON((unsigned long)(end - p - 1) != (MACB_TPF - MACB_PFR) / 4);
 
-        for(; p < end; p++, reg++)
-                *p += readl_relaxed(reg);
+        for(; p < end; p++, offset += 4)
+                *p += bp->macb_reg_readl(bp, offset);
 }
 
 static int macb_halt_tx(struct macb *bp)
@@ -1107,12 +1157,6 @@ static void macb_poll_controller(struct net_device *dev)
 }
 #endif
 
-static inline unsigned int macb_count_tx_descriptors(struct macb *bp,
-                                                     unsigned int len)
-{
-        return (len + bp->max_tx_length - 1) / bp->max_tx_length;
-}
-
 static unsigned int macb_tx_map(struct macb *bp,
                                 struct macb_queue *queue,
                                 struct sk_buff *skb)
@@ -1263,11 +1307,11 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * socket buffer: skb fragments of jumbo frames may need to be
          * splitted into many buffer descriptors.
          */
-        count = macb_count_tx_descriptors(bp, skb_headlen(skb));
+        count = DIV_ROUND_UP(skb_headlen(skb), bp->max_tx_length);
         nr_frags = skb_shinfo(skb)->nr_frags;
         for (f = 0; f < nr_frags; f++) {
                 frag_size = skb_frag_size(&skb_shinfo(skb)->frags[f]);
-                count += macb_count_tx_descriptors(bp, frag_size);
+                count += DIV_ROUND_UP(frag_size, bp->max_tx_length);
         }
 
         spin_lock_irqsave(&bp->lock, flags);
@@ -1603,7 +1647,6 @@ static u32 macb_dbw(struct macb *bp)
 static void macb_configure_dma(struct macb *bp)
 {
         u32 dmacfg;
-        u32 tmp, ncr;
 
         if (macb_is_gem(bp)) {
                 dmacfg = gem_readl(bp, DMACFG) & ~GEM_BF(RXBS, -1L);
@@ -1613,22 +1656,11 @@ static void macb_configure_dma(struct macb *bp)
                 dmacfg |= GEM_BIT(TXPBMS) | GEM_BF(RXBMS, -1L);
                 dmacfg &= ~GEM_BIT(ENDIA_PKT);
 
-                /* Find the CPU endianness by using the loopback bit of net_ctrl
-                 * register. save it first. When the CPU is in big endian we
-                 * need to program swaped mode for management descriptor access.
-                 */
-                ncr = macb_readl(bp, NCR);
-                __raw_writel(MACB_BIT(LLB), bp->regs + MACB_NCR);
-                tmp =  __raw_readl(bp->regs + MACB_NCR);
-
-                if (tmp == MACB_BIT(LLB))
+                if (bp->native_io)
                         dmacfg &= ~GEM_BIT(ENDIA_DESC);
                 else
                         dmacfg |= GEM_BIT(ENDIA_DESC); /* CPU in big endian */
 
-                /* Restore net_ctrl */
-                macb_writel(bp, NCR, ncr);
-
                 if (bp->dev->features & NETIF_F_HW_CSUM)
                         dmacfg |= GEM_BIT(TXCOEN);
                 else
@@ -1897,19 +1929,19 @@ static int macb_change_mtu(struct net_device *dev, int new_mtu)
 
 static void gem_update_stats(struct macb *bp)
 {
-        int i;
+        unsigned int i;
         u32 *p = &bp->hw_stats.gem.tx_octets_31_0;
 
         for (i = 0; i < GEM_STATS_LEN; ++i, ++p) {
                 u32 offset = gem_statistics[i].offset;
-                u64 val = readl_relaxed(bp->regs + offset);
+                u64 val = bp->macb_reg_readl(bp, offset);
 
                 bp->ethtool_stats[i] += val;
                 *p += val;
 
                 if (offset == GEM_OCTTXL || offset == GEM_OCTRXL) {
                         /* Add GEM_OCTTXH, GEM_OCTRXH */
-                        val = readl_relaxed(bp->regs + offset + 4);
+                        val = bp->macb_reg_readl(bp, offset + 4);
                         bp->ethtool_stats[i] += ((u64)val) << 32;
                         *(++p) += val;
                 }
@@ -1976,7 +2008,7 @@ static int gem_get_sset_count(struct net_device *dev, int sset)
 
 static void gem_get_ethtool_strings(struct net_device *dev, u32 sset, u8 *p)
 {
-        int i;
+        unsigned int i;
 
         switch (sset) {
         case ETH_SS_STATS:
@@ -2190,7 +2222,7 @@ static void macb_configure_caps(struct macb *bp, const struct macb_config *dt_co
         if (dt_conf)
                 bp->caps = dt_conf->caps;
 
-        if (macb_is_gem_hw(bp->regs)) {
+        if (hw_is_gem(bp->regs, bp->native_io)) {
                 bp->caps |= MACB_CAPS_MACB_IS_GEM;
 
                 dcfg = gem_readl(bp, DCFG1);
@@ -2201,10 +2233,11 @@ static void macb_configure_caps(struct macb *bp, const struct macb_config *dt_co
                         bp->caps |= MACB_CAPS_FIFO_MODE;
         }
 
-        netdev_dbg(bp->dev, "Cadence caps 0x%08x\n", bp->caps);
+        dev_dbg(&bp->pdev->dev, "Cadence caps 0x%08x\n", bp->caps);
 }
 
 static void macb_probe_queues(void __iomem *mem,
+                              bool native_io,
                               unsigned int *queue_mask,
                               unsigned int *num_queues)
 {
@@ -2219,7 +2252,7 @@ static void macb_probe_queues(void __iomem *mem,
          * we are early in the probe process and don't have the
          * MACB_CAPS_MACB_IS_GEM flag positioned
          */
-        if (!macb_is_gem_hw(mem))
+        if (!hw_is_gem(mem, native_io))
                 return;
 
         /* bit 0 is never set but queue 0 always exists */
@@ -2786,6 +2819,7 @@ static int macb_probe(struct platform_device *pdev)
         struct clk *pclk, *hclk, *tx_clk;
         unsigned int queue_mask, num_queues;
         struct macb_platform_data *pdata;
+        bool native_io;
         struct phy_device *phydev;
         struct net_device *dev;
         struct resource *regs;
@@ -2794,6 +2828,11 @@ static int macb_probe(struct platform_device *pdev)
         struct macb *bp;
         int err;
 
+        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        mem = devm_ioremap_resource(&pdev->dev, regs);
+        if (IS_ERR(mem))
+                return PTR_ERR(mem);
+
         if (np) {
                 const struct of_device_id *match;
 
@@ -2809,14 +2848,9 @@ static int macb_probe(struct platform_device *pdev)
         if (err)
                 return err;
 
-        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mem = devm_ioremap_resource(&pdev->dev, regs);
-        if (IS_ERR(mem)) {
-                err = PTR_ERR(mem);
-                goto err_disable_clocks;
-        }
+        native_io = hw_is_native_io(mem);
 
-        macb_probe_queues(mem, &queue_mask, &num_queues);
+        macb_probe_queues(mem, native_io, &queue_mask, &num_queues);
         dev = alloc_etherdev_mq(sizeof(*bp), num_queues);
         if (!dev) {
                 err = -ENOMEM;
@@ -2831,6 +2865,14 @@ static int macb_probe(struct platform_device *pdev)
         bp->pdev = pdev;
         bp->dev = dev;
         bp->regs = mem;
+        bp->native_io = native_io;
+        if (native_io) {
+                bp->macb_reg_readl = hw_readl_native;
+                bp->macb_reg_writel = hw_writel_native;
+        } else {
+                bp->macb_reg_readl = hw_readl;
+                bp->macb_reg_writel = hw_writel;
+        }
         bp->num_queues = num_queues;
         bp->queue_mask = queue_mask;
         if (macb_config)
@@ -2838,9 +2880,8 @@ static int macb_probe(struct platform_device *pdev)
         bp->pclk = pclk;
         bp->hclk = hclk;
         bp->tx_clk = tx_clk;
-        if (macb_config->jumbo_max_len) {
+        if (macb_config)
                 bp->jumbo_max_len = macb_config->jumbo_max_len;
-        }
 
         spin_lock_init(&bp->lock);
 
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index d74655993d4b..1895b6b2addd 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -429,18 +429,12 @@
          | GEM_BF(name, value))
 
 /* Register access macros */
-#define macb_readl(port,reg)                            \
-        readl_relaxed((port)->regs + MACB_##reg)
-#define macb_writel(port,reg,value)                     \
-        writel_relaxed((value), (port)->regs + MACB_##reg)
-#define gem_readl(port, reg)                            \
-        readl_relaxed((port)->regs + GEM_##reg)
-#define gem_writel(port, reg, value)                    \
-        writel_relaxed((value), (port)->regs + GEM_##reg)
-#define queue_readl(queue, reg)                         \
-        readl_relaxed((queue)->bp->regs + (queue)->reg)
-#define queue_writel(queue, reg, value)                 \
-        writel_relaxed((value), (queue)->bp->regs + (queue)->reg)
+#define macb_readl(port, reg)           (port)->macb_reg_readl((port), MACB_##reg)
+#define macb_writel(port, reg, value)   (port)->macb_reg_writel((port), MACB_##reg, (value))
+#define gem_readl(port, reg)            (port)->macb_reg_readl((port), GEM_##reg)
+#define gem_writel(port, reg, value)    (port)->macb_reg_writel((port), GEM_##reg, (value))
+#define queue_readl(queue, reg)         (queue)->bp->macb_reg_readl((queue)->bp, (queue)->reg)
+#define queue_writel(queue, reg, value) (queue)->bp->macb_reg_writel((queue)->bp, (queue)->reg, (value))
 
 /* Conditional GEM/MACB macros.  These perform the operation to the correct
  * register dependent on whether the device is a GEM or a MACB.  For registers
@@ -785,6 +779,11 @@ struct macb_queue {
 
 struct macb {
         void __iomem            *regs;
+        bool                    native_io;
+
+        /* hardware IO accessors */
+        u32     (*macb_reg_readl)(struct macb *bp, int offset);
+        void    (*macb_reg_writel)(struct macb *bp, int offset, u32 value);
 
         unsigned int            rx_tail;
         unsigned int            rx_prepared_head;
@@ -817,9 +816,9 @@ struct macb {
 
         struct mii_bus          *mii_bus;
         struct phy_device       *phy_dev;
-        unsigned int            link;
-        unsigned int            speed;
-        unsigned int            duplex;
+        int                     link;
+        int                     speed;
+        int                     duplex;
 
         u32                     caps;
         unsigned int            dma_burst_length;
@@ -843,9 +842,4 @@ static inline bool macb_is_gem(struct macb *bp)
         return !!(bp->caps & MACB_CAPS_MACB_IS_GEM);
 }
 
-static inline bool macb_is_gem_hw(void __iomem *addr)
-{
-        return !!(MACB_BFEXT(IDNUM, readl_relaxed(addr + MACB_MID)) >= 0x2);
-}
-
 #endif /* _MACB_H */
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index c4d6bbe9458d..02e23e6f1424 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -16,7 +16,6 @@ if NET_VENDOR_CAVIUM
 config THUNDER_NIC_PF
         tristate "Thunder Physical function driver"
         depends on 64BIT
-        default ARCH_THUNDER
         select THUNDER_NIC_BGX
         ---help---
           This driver supports Thunder's NIC physical function.
@@ -29,14 +28,12 @@ config THUNDER_NIC_PF
 config THUNDER_NIC_VF
         tristate "Thunder Virtual function driver"
         depends on 64BIT
-        default ARCH_THUNDER
         ---help---
           This driver supports Thunder's NIC virtual function
 
 config  THUNDER_NIC_BGX
         tristate "Thunder MAC interface driver (BGX)"
         depends on 64BIT
-        default ARCH_THUNDER
         ---help---
           This driver supports programming and controlling of MAC
           interface from NIC physical function driver.
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index dda8a02b7322..8aee250904ec 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -125,6 +125,15 @@
  */
 #define NICPF_CLK_PER_INT_TICK          2
 
+/* Time to wait before we decide that a SQ is stuck.
+ *
+ * Since both pkt rx and tx notifications are done with same CQ,
+ * when packets are being received at very high rate (eg: L2 forwarding)
+ * then freeing transmitted skbs will be delayed and watchdog
+ * will kick in, resetting interface. Hence keeping this value high.
+ */
+#define NICVF_TX_TIMEOUT                (50 * HZ)
+
 struct nicvf_cq_poll {
         u8      cq_idx;         /* Completion queue index */
         struct  napi_struct napi;
@@ -216,8 +225,9 @@ struct nicvf_drv_stats {
         /* Tx */
         u64 tx_frames_ok;
         u64 tx_drops;
-        u64 tx_busy;
         u64 tx_tso;
+        u64 txq_stop;
+        u64 txq_wake;
 };
 
 struct nicvf {
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index 16bd2d772db9..a4228e664567 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -66,9 +66,10 @@ static const struct nicvf_stat nicvf_drv_stats[] = {
         NICVF_DRV_STAT(rx_frames_jumbo),
         NICVF_DRV_STAT(rx_drops),
         NICVF_DRV_STAT(tx_frames_ok),
-        NICVF_DRV_STAT(tx_busy),
         NICVF_DRV_STAT(tx_tso),
         NICVF_DRV_STAT(tx_drops),
+        NICVF_DRV_STAT(txq_stop),
+        NICVF_DRV_STAT(txq_wake),
 };
 
 static const struct nicvf_stat nicvf_queue_stats[] = {
@@ -126,6 +127,7 @@ static void nicvf_set_msglevel(struct net_device *netdev, u32 lvl)
 
 static void nicvf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
 {
+        struct nicvf *nic = netdev_priv(netdev);
         int stats, qidx;
 
         if (sset != ETH_SS_STATS)
@@ -141,7 +143,7 @@ static void nicvf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
                 data += ETH_GSTRING_LEN;
         }
 
-        for (qidx = 0; qidx < MAX_RCV_QUEUES_PER_QS; qidx++) {
+        for (qidx = 0; qidx < nic->qs->rq_cnt; qidx++) {
                 for (stats = 0; stats < nicvf_n_queue_stats; stats++) {
                         sprintf(data, "rxq%d: %s", qidx,
                                 nicvf_queue_stats[stats].name);
@@ -149,7 +151,7 @@ static void nicvf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
                 }
         }
 
-        for (qidx = 0; qidx < MAX_SND_QUEUES_PER_QS; qidx++) {
+        for (qidx = 0; qidx < nic->qs->sq_cnt; qidx++) {
                 for (stats = 0; stats < nicvf_n_queue_stats; stats++) {
                         sprintf(data, "txq%d: %s", qidx,
                                 nicvf_queue_stats[stats].name);
@@ -170,12 +172,14 @@ static void nicvf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
 
 static int nicvf_get_sset_count(struct net_device *netdev, int sset)
 {
+        struct nicvf *nic = netdev_priv(netdev);
+
         if (sset != ETH_SS_STATS)
                 return -EINVAL;
 
         return nicvf_n_hw_stats + nicvf_n_drv_stats +
                 (nicvf_n_queue_stats *
-                 (MAX_RCV_QUEUES_PER_QS + MAX_SND_QUEUES_PER_QS)) +
+                 (nic->qs->rq_cnt + nic->qs->sq_cnt)) +
                 BGX_RX_STATS_COUNT + BGX_TX_STATS_COUNT;
 }
 
@@ -197,13 +201,13 @@ static void nicvf_get_ethtool_stats(struct net_device *netdev,
                 *(data++) = ((u64 *)&nic->drv_stats)
                                 [nicvf_drv_stats[stat].index];
 
-        for (qidx = 0; qidx < MAX_RCV_QUEUES_PER_QS; qidx++) {
+        for (qidx = 0; qidx < nic->qs->rq_cnt; qidx++) {
                 for (stat = 0; stat < nicvf_n_queue_stats; stat++)
                         *(data++) = ((u64 *)&nic->qs->rq[qidx].stats)
                                         [nicvf_queue_stats[stat].index];
         }
 
-        for (qidx = 0; qidx < MAX_SND_QUEUES_PER_QS; qidx++) {
+        for (qidx = 0; qidx < nic->qs->sq_cnt; qidx++) {
                 for (stat = 0; stat < nicvf_n_queue_stats; stat++)
                         *(data++) = ((u64 *)&nic->qs->sq[qidx].stats)
                                         [nicvf_queue_stats[stat].index];
@@ -543,6 +547,7 @@ static int nicvf_set_channels(struct net_device *dev,
 {
         struct nicvf *nic = netdev_priv(dev);
         int err = 0;
+        bool if_up = netif_running(dev);
 
         if (!channel->rx_count || !channel->tx_count)
                 return -EINVAL;
@@ -551,6 +556,9 @@ static int nicvf_set_channels(struct net_device *dev,
         if (channel->tx_count > MAX_SND_QUEUES_PER_QS)
                 return -EINVAL;
 
+        if (if_up)
+                nicvf_stop(dev);
+
         nic->qs->rq_cnt = channel->rx_count;
         nic->qs->sq_cnt = channel->tx_count;
         nic->qs->cq_cnt = max(nic->qs->rq_cnt, nic->qs->sq_cnt);
@@ -559,11 +567,9 @@ static int nicvf_set_channels(struct net_device *dev,
         if (err)
                 return err;
 
-        if (!netif_running(dev))
-                return err;
+        if (if_up)
+                nicvf_open(dev);
 
-        nicvf_stop(dev);
-        nicvf_open(dev);
         netdev_info(dev, "Setting num Tx rings to %d, Rx rings to %d success\n",
                     nic->qs->sq_cnt, nic->qs->rq_cnt);
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 8b119a035b7e..3b90afb8c293 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -234,7 +234,7 @@ static void  nicvf_handle_mbx_intr(struct nicvf *nic)
                                     nic->duplex == DUPLEX_FULL ?
                                 "Full duplex" : "Half duplex");
                         netif_carrier_on(nic->netdev);
-                        netif_tx_wake_all_queues(nic->netdev);
+                        netif_tx_start_all_queues(nic->netdev);
                 } else {
                         netdev_info(nic->netdev, "%s: Link is Down\n",
                                     nic->netdev->name);
@@ -425,6 +425,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
         if (skb) {
                 prefetch(skb);
                 dev_consume_skb_any(skb);
+                sq->skbuff[cqe_tx->sqe_ptr] = (u64)NULL;
         }
 }
 
@@ -476,12 +477,13 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
 static int nicvf_cq_intr_handler(struct net_device *netdev, u8 cq_idx,
                                  struct napi_struct *napi, int budget)
 {
-        int processed_cqe, work_done = 0;
+        int processed_cqe, work_done = 0, tx_done = 0;
         int cqe_count, cqe_head;
         struct nicvf *nic = netdev_priv(netdev);
         struct queue_set *qs = nic->qs;
         struct cmp_queue *cq = &qs->cq[cq_idx];
         struct cqe_rx_t *cq_desc;
+        struct netdev_queue *txq;
 
         spin_lock_bh(&cq->lock);
 loop:
@@ -496,8 +498,8 @@ loop:
         cqe_head = nicvf_queue_reg_read(nic, NIC_QSET_CQ_0_7_HEAD, cq_idx) >> 9;
         cqe_head &= 0xFFFF;
 
-        netdev_dbg(nic->netdev, "%s cqe_count %d cqe_head %d\n",
-                   __func__, cqe_count, cqe_head);
+        netdev_dbg(nic->netdev, "%s CQ%d cqe_count %d cqe_head %d\n",
+                   __func__, cq_idx, cqe_count, cqe_head);
         while (processed_cqe < cqe_count) {
                 /* Get the CQ descriptor */
                 cq_desc = (struct cqe_rx_t *)GET_CQ_DESC(cq, cqe_head);
@@ -511,8 +513,8 @@ loop:
                         break;
                 }
 
-                netdev_dbg(nic->netdev, "cq_desc->cqe_type %d\n",
-                           cq_desc->cqe_type);
+                netdev_dbg(nic->netdev, "CQ%d cq_desc->cqe_type %d\n",
+                           cq_idx, cq_desc->cqe_type);
                 switch (cq_desc->cqe_type) {
                 case CQE_TYPE_RX:
                         nicvf_rcv_pkt_handler(netdev, napi, cq,
@@ -522,6 +524,7 @@ loop:
                 case CQE_TYPE_SEND:
                         nicvf_snd_pkt_handler(netdev, cq,
                                               (void *)cq_desc, CQE_TYPE_SEND);
+                        tx_done++;
                 break;
                 case CQE_TYPE_INVALID:
                 case CQE_TYPE_RX_SPLIT:
@@ -532,8 +535,9 @@ loop:
                 }
                 processed_cqe++;
         }
-        netdev_dbg(nic->netdev, "%s processed_cqe %d work_done %d budget %d\n",
-                   __func__, processed_cqe, work_done, budget);
+        netdev_dbg(nic->netdev,
+                   "%s CQ%d processed_cqe %d work_done %d budget %d\n",
+                   __func__, cq_idx, processed_cqe, work_done, budget);
 
         /* Ring doorbell to inform H/W to reuse processed CQEs */
         nicvf_queue_reg_write(nic, NIC_QSET_CQ_0_7_DOOR,
@@ -543,6 +547,19 @@ loop:
                 goto loop;
 
 done:
+        /* Wakeup TXQ if its stopped earlier due to SQ full */
+        if (tx_done) {
+                txq = netdev_get_tx_queue(netdev, cq_idx);
+                if (netif_tx_queue_stopped(txq)) {
+                        netif_tx_start_queue(txq);
+                        nic->drv_stats.txq_wake++;
+                        if (netif_msg_tx_err(nic))
+                                netdev_warn(netdev,
+                                            "%s: Transmit queue wakeup SQ%d\n",
+                                            netdev->name, cq_idx);
+                }
+        }
+
         spin_unlock_bh(&cq->lock);
         return work_done;
 }
@@ -554,15 +571,10 @@ static int nicvf_poll(struct napi_struct *napi, int budget)
         struct net_device *netdev = napi->dev;
         struct nicvf *nic = netdev_priv(netdev);
         struct nicvf_cq_poll *cq;
-        struct netdev_queue *txq;
 
         cq = container_of(napi, struct nicvf_cq_poll, napi);
         work_done = nicvf_cq_intr_handler(netdev, cq->cq_idx, napi, budget);
 
-        txq = netdev_get_tx_queue(netdev, cq->cq_idx);
-        if (netif_tx_queue_stopped(txq))
-                netif_tx_wake_queue(txq);
-
         if (work_done < budget) {
                 /* Slow packet rate, exit polling */
                 napi_complete(napi);
@@ -833,9 +845,9 @@ static netdev_tx_t nicvf_xmit(struct sk_buff *skb, struct net_device *netdev)
                 return NETDEV_TX_OK;
         }
 
-        if (!nicvf_sq_append_skb(nic, skb) && !netif_tx_queue_stopped(txq)) {
+        if (!netif_tx_queue_stopped(txq) && !nicvf_sq_append_skb(nic, skb)) {
                 netif_tx_stop_queue(txq);
-                nic->drv_stats.tx_busy++;
+                nic->drv_stats.txq_stop++;
                 if (netif_msg_tx_err(nic))
                         netdev_warn(netdev,
                                     "%s: Transmit ring full, stopping SQ%d\n",
@@ -859,7 +871,6 @@ int nicvf_stop(struct net_device *netdev)
         nicvf_send_msg_to_pf(nic, &mbx);
 
         netif_carrier_off(netdev);
-        netif_tx_disable(netdev);
 
         /* Disable RBDR & QS error interrupts */
         for (qidx = 0; qidx < qs->rbdr_cnt; qidx++) {
@@ -894,6 +905,8 @@ int nicvf_stop(struct net_device *netdev)
                 kfree(cq_poll);
         }
 
+        netif_tx_disable(netdev);
+
         /* Free resources */
         nicvf_config_data_transfer(nic, false);
 
@@ -988,6 +1001,9 @@ int nicvf_open(struct net_device *netdev)
         for (qidx = 0; qidx < qs->rbdr_cnt; qidx++)
                 nicvf_enable_intr(nic, NICVF_INTR_RBDR, qidx);
 
+        nic->drv_stats.txq_stop = 0;
+        nic->drv_stats.txq_wake = 0;
+
         netif_carrier_on(netdev);
         netif_tx_start_all_queues(netdev);
 
@@ -1278,6 +1294,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         netdev->hw_features = netdev->features;
 
         netdev->netdev_ops = &nicvf_netdev_ops;
+        netdev->watchdog_timeo = NICVF_TX_TIMEOUT;
 
         INIT_WORK(&nic->reset_task, nicvf_reset_task);
 
@@ -1318,11 +1335,17 @@ static void nicvf_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
+static void nicvf_shutdown(struct pci_dev *pdev)
+{
+        nicvf_remove(pdev);
+}
+
 static struct pci_driver nicvf_driver = {
         .name = DRV_NAME,
         .id_table = nicvf_id_table,
         .probe = nicvf_probe,
         .remove = nicvf_remove,
+        .shutdown = nicvf_shutdown,
 };
 
 static int __init nicvf_init_module(void)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index d69d228d11a0..ca4240aa6d15 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -103,9 +103,11 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
 
         /* Allocate a new page */
         if (!nic->rb_page) {
-                nic->rb_page = alloc_pages(gfp | __GFP_COMP, order);
+                nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
+                                           order);
                 if (!nic->rb_page) {
-                        netdev_err(nic->netdev, "Failed to allocate new rcv buffer\n");
+                        netdev_err(nic->netdev,
+                                   "Failed to allocate new rcv buffer\n");
                         return -ENOMEM;
                 }
                 nic->rb_page_offset = 0;
@@ -382,7 +384,8 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
                 return;
 
         if (sq->tso_hdrs)
-                dma_free_coherent(&nic->pdev->dev, sq->dmem.q_len,
+                dma_free_coherent(&nic->pdev->dev,
+                                  sq->dmem.q_len * TSO_HEADER_SIZE,
                                   sq->tso_hdrs, sq->tso_hdrs_phys);
 
         kfree(sq->skbuff);
@@ -863,10 +866,11 @@ void nicvf_sq_free_used_descs(struct net_device *netdev, struct snd_queue *sq,
                         continue;
                 }
                 skb = (struct sk_buff *)sq->skbuff[sq->head];
+                if (skb)
+                        dev_kfree_skb_any(skb);
                 atomic64_add(1, (atomic64_t *)&netdev->stats.tx_packets);
                 atomic64_add(hdr->tot_len,
                              (atomic64_t *)&netdev->stats.tx_bytes);
-                dev_kfree_skb_any(skb);
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
         }
 }
@@ -992,7 +996,7 @@ static inline void nicvf_sq_add_gather_subdesc(struct snd_queue *sq, int qentry,
 
         memset(gather, 0, SND_QUEUE_DESC_SIZE);
         gather->subdesc_type = SQ_DESC_TYPE_GATHER;
-        gather->ld_type = NIC_SEND_LD_TYPE_E_LDWB;
+        gather->ld_type = NIC_SEND_LD_TYPE_E_LDD;
         gather->size = size;
         gather->addr = data;
 }
@@ -1048,7 +1052,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
                 }
                 nicvf_sq_add_hdr_subdesc(sq, hdr_qentry,
                                          seg_subdescs - 1, skb, seg_len);
-                sq->skbuff[hdr_qentry] = 0;
+                sq->skbuff[hdr_qentry] = (u64)NULL;
                 qentry = nicvf_get_nxt_sqentry(sq, qentry);
 
                 desc_cnt += seg_subdescs;
@@ -1062,6 +1066,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
         /* Inform HW to xmit all TSO segments */
         nicvf_queue_reg_write(nic, NIC_QSET_SQ_0_7_DOOR,
                               skb_get_queue_mapping(skb), desc_cnt);
+        nic->drv_stats.tx_tso++;
         return 1;
 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index 8341bdf755d1..f0937b7bfe9f 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -62,7 +62,7 @@
 #define SND_QUEUE_CNT           8
 #define CMP_QUEUE_CNT           8 /* Max of RCV and SND qcount */
 
-#define SND_QSIZE               SND_QUEUE_SIZE4
+#define SND_QSIZE               SND_QUEUE_SIZE2
 #define SND_QUEUE_LEN           (1ULL << (SND_QSIZE + 10))
 #define MAX_SND_QUEUE_LEN       (1ULL << (SND_QUEUE_SIZE6 + 10))
 #define SND_QUEUE_THRESH        2ULL
@@ -70,7 +70,10 @@
 /* Since timestamp not enabled, otherwise 2 */
 #define MAX_CQE_PER_PKT_XMIT            1
 
-#define CMP_QSIZE               CMP_QUEUE_SIZE4
+/* Keep CQ and SQ sizes same, if timestamping
+ * is enabled this equation will change.
+ */
+#define CMP_QSIZE               CMP_QUEUE_SIZE2
 #define CMP_QUEUE_LEN           (1ULL << (CMP_QSIZE + 10))
 #define CMP_QUEUE_CQE_THRESH    0
 #define CMP_QUEUE_TIMER_THRESH  220 /* 10usec */
@@ -87,7 +90,12 @@
 
 #define MAX_CQES_FOR_TX         ((SND_QUEUE_LEN / MIN_SQ_DESC_PER_PKT_XMIT) * \
                                  MAX_CQE_PER_PKT_XMIT)
-#define RQ_CQ_DROP              ((CMP_QUEUE_LEN - MAX_CQES_FOR_TX) / 256)
+/* Calculate number of CQEs to reserve for all SQEs.
+ * Its 1/256th level of CQ size.
+ * '+ 1' to account for pipelining
+ */
+#define RQ_CQ_DROP              ((256 / (CMP_QUEUE_LEN / \
+                                 (CMP_QUEUE_LEN - MAX_CQES_FOR_TX))) + 1)
 
 /* Descriptor size in bytes */
 #define SND_QUEUE_DESC_SIZE     16
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 633ec05dfe05..b961a89dc626 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -673,7 +673,10 @@ static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
         bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cmrx_cfg);
         bgx_flush_dmac_addrs(bgx, lmacid);
 
-        if (lmac->phydev)
+        if ((bgx->lmac_type != BGX_MODE_XFI) &&
+            (bgx->lmac_type != BGX_MODE_XLAUI) &&
+            (bgx->lmac_type != BGX_MODE_40G_KR) &&
+            (bgx->lmac_type != BGX_MODE_10G_KR) && lmac->phydev)
                 phy_disconnect(lmac->phydev);
 
         lmac->phydev = NULL;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index a11485fbb33f..c3c7db41819d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -2332,10 +2332,11 @@ int t4_setup_debugfs(struct adapter *adap)
                                         EXT_MEM1_SIZE_G(size));
                 }
         } else {
-                if (i & EXT_MEM_ENABLE_F)
+                if (i & EXT_MEM_ENABLE_F) {
                         size = t4_read_reg(adap, MA_EXT_MEMORY_BAR_A);
                         add_debugfs_mem(adap, "mc", MEM_MC,
                                         EXT_MEM_SIZE_G(size));
+                }
         }
 
         de = debugfs_create_file_size("flash", S_IRUSR, adap->debugfs_root, adap,
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 2716e6f30d9a..00e3a6b6b822 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -620,6 +620,11 @@ enum be_if_flags {
                                          BE_IF_FLAGS_VLAN_PROMISCUOUS |\
                                          BE_IF_FLAGS_MCAST_PROMISCUOUS)
 
+#define BE_IF_EN_FLAGS  (BE_IF_FLAGS_BROADCAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |\
+                        BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_UNTAGGED)
+
+#define BE_IF_ALL_FILT_FLAGS    (BE_IF_EN_FLAGS | BE_IF_FLAGS_ALL_PROMISCUOUS)
+
 /* An RX interface is an object with one or more MAC addresses and
  * filtering capabilities. */
 struct be_cmd_req_if_create {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6f642426308c..c28e3bfdccd7 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -273,6 +273,10 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
         if (ether_addr_equal(addr->sa_data, netdev->dev_addr))
                 return 0;
 
+        /* if device is not running, copy MAC to netdev->dev_addr */
+        if (!netif_running(netdev))
+                goto done;
+
         /* The PMAC_ADD cmd may fail if the VF doesn't have FILTMGMT
          * privilege or if PF did not provision the new MAC address.
          * On BE3, this cmd will always fail if the VF doesn't have the
@@ -307,9 +311,9 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
                 status = -EPERM;
                 goto err;
         }
-
-        memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
-        dev_info(dev, "MAC address changed to %pM\n", mac);
+done:
+        ether_addr_copy(netdev->dev_addr, addr->sa_data);
+        dev_info(dev, "MAC address changed to %pM\n", addr->sa_data);
         return 0;
 err:
         dev_warn(dev, "MAC address change to %pM failed\n", addr->sa_data);
@@ -2447,10 +2451,24 @@ static void be_eq_clean(struct be_eq_obj *eqo)
         be_eq_notify(eqo->adapter, eqo->q.id, false, true, num, 0);
 }
 
-static void be_rx_cq_clean(struct be_rx_obj *rxo)
+/* Free posted rx buffers that were not used */
+static void be_rxq_clean(struct be_rx_obj *rxo)
 {
-        struct be_rx_page_info *page_info;
         struct be_queue_info *rxq = &rxo->q;
+        struct be_rx_page_info *page_info;
+
+        while (atomic_read(&rxq->used) > 0) {
+                page_info = get_rx_page_info(rxo);
+                put_page(page_info->page);
+                memset(page_info, 0, sizeof(*page_info));
+        }
+        BUG_ON(atomic_read(&rxq->used));
+        rxq->tail = 0;
+        rxq->head = 0;
+}
+
+static void be_rx_cq_clean(struct be_rx_obj *rxo)
+{
         struct be_queue_info *rx_cq = &rxo->cq;
         struct be_rx_compl_info *rxcp;
         struct be_adapter *adapter = rxo->adapter;
@@ -2487,16 +2505,6 @@ static void be_rx_cq_clean(struct be_rx_obj *rxo)
 
         /* After cleanup, leave the CQ in unarmed state */
         be_cq_notify(adapter, rx_cq->id, false, 0);
-
-        /* Then free posted rx buffers that were not used */
-        while (atomic_read(&rxq->used) > 0) {
-                page_info = get_rx_page_info(rxo);
-                put_page(page_info->page);
-                memset(page_info, 0, sizeof(*page_info));
-        }
-        BUG_ON(atomic_read(&rxq->used));
-        rxq->tail = 0;
-        rxq->head = 0;
 }
 
 static void be_tx_compl_clean(struct be_adapter *adapter)
@@ -2576,8 +2584,8 @@ static void be_evt_queues_destroy(struct be_adapter *adapter)
                         be_cmd_q_destroy(adapter, &eqo->q, QTYPE_EQ);
                         napi_hash_del(&eqo->napi);
                         netif_napi_del(&eqo->napi);
+                        free_cpumask_var(eqo->affinity_mask);
                 }
-                free_cpumask_var(eqo->affinity_mask);
                 be_queue_free(adapter, &eqo->q);
         }
 }
@@ -2594,13 +2602,7 @@ static int be_evt_queues_create(struct be_adapter *adapter)
 
         for_all_evt_queues(adapter, eqo, i) {
                 int numa_node = dev_to_node(&adapter->pdev->dev);
-                if (!zalloc_cpumask_var(&eqo->affinity_mask, GFP_KERNEL))
-                        return -ENOMEM;
-                cpumask_set_cpu(cpumask_local_spread(i, numa_node),
-                                eqo->affinity_mask);
-                netif_napi_add(adapter->netdev, &eqo->napi, be_poll,
-                               BE_NAPI_WEIGHT);
-                napi_hash_add(&eqo->napi);
+
                 aic = &adapter->aic_obj[i];
                 eqo->adapter = adapter;
                 eqo->idx = i;
@@ -2616,6 +2618,14 @@ static int be_evt_queues_create(struct be_adapter *adapter)
                 rc = be_cmd_eq_create(adapter, eqo);
                 if (rc)
                         return rc;
+
+                if (!zalloc_cpumask_var(&eqo->affinity_mask, GFP_KERNEL))
+                        return -ENOMEM;
+                cpumask_set_cpu(cpumask_local_spread(i, numa_node),
+                                eqo->affinity_mask);
+                netif_napi_add(adapter->netdev, &eqo->napi, be_poll,
+                               BE_NAPI_WEIGHT);
+                napi_hash_add(&eqo->napi);
         }
         return 0;
 }
@@ -3354,13 +3364,54 @@ static void be_rx_qs_destroy(struct be_adapter *adapter)
         for_all_rx_queues(adapter, rxo, i) {
                 q = &rxo->q;
                 if (q->created) {
+                        /* If RXQs are destroyed while in an "out of buffer"
+                         * state, there is a possibility of an HW stall on
+                         * Lancer. So, post 64 buffers to each queue to relieve
+                         * the "out of buffer" condition.
+                         * Make sure there's space in the RXQ before posting.
+                         */
+                        if (lancer_chip(adapter)) {
+                                be_rx_cq_clean(rxo);
+                                if (atomic_read(&q->used) == 0)
+                                        be_post_rx_frags(rxo, GFP_KERNEL,
+                                                         MAX_RX_POST);
+                        }
+
                         be_cmd_rxq_destroy(adapter, q);
                         be_rx_cq_clean(rxo);
+                        be_rxq_clean(rxo);
                 }
                 be_queue_free(adapter, q);
         }
 }
 
+static void be_disable_if_filters(struct be_adapter *adapter)
+{
+        be_cmd_pmac_del(adapter, adapter->if_handle,
+                        adapter->pmac_id[0], 0);
+
+        be_clear_uc_list(adapter);
+
+        /* The IFACE flags are enabled in the open path and cleared
+         * in the close path. When a VF gets detached from the host and
+         * assigned to a VM the following happens:
+         *      - VF's IFACE flags get cleared in the detach path
+         *      - IFACE create is issued by the VF in the attach path
+         * Due to a bug in the BE3/Skyhawk-R FW
+         * (Lancer FW doesn't have the bug), the IFACE capability flags
+         * specified along with the IFACE create cmd issued by a VF are not
+         * honoured by FW.  As a consequence, if a *new* driver
+         * (that enables/disables IFACE flags in open/close)
+         * is loaded in the host and an *old* driver is * used by a VM/VF,
+         * the IFACE gets created *without* the needed flags.
+         * To avoid this, disable RX-filter flags only for Lancer.
+         */
+        if (lancer_chip(adapter)) {
+                be_cmd_rx_filter(adapter, BE_IF_ALL_FILT_FLAGS, OFF);
+                adapter->if_flags &= ~BE_IF_ALL_FILT_FLAGS;
+        }
+}
+
 static int be_close(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -3373,6 +3424,8 @@ static int be_close(struct net_device *netdev)
         if (!(adapter->flags & BE_FLAGS_SETUP_DONE))
                 return 0;
 
+        be_disable_if_filters(adapter);
+
         be_roce_dev_close(adapter);
 
         if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
@@ -3392,7 +3445,6 @@ static int be_close(struct net_device *netdev)
         be_tx_compl_clean(adapter);
 
         be_rx_qs_destroy(adapter);
-        be_clear_uc_list(adapter);
 
         for_all_evt_queues(adapter, eqo, i) {
                 if (msix_enabled(adapter))
@@ -3477,6 +3529,31 @@ static int be_rx_qs_create(struct be_adapter *adapter)
         return 0;
 }
 
+static int be_enable_if_filters(struct be_adapter *adapter)
+{
+        int status;
+
+        status = be_cmd_rx_filter(adapter, BE_IF_EN_FLAGS, ON);
+        if (status)
+                return status;
+
+        /* For BE3 VFs, the PF programs the initial MAC address */
+        if (!(BEx_chip(adapter) && be_virtfn(adapter))) {
+                status = be_cmd_pmac_add(adapter, adapter->netdev->dev_addr,
+                                         adapter->if_handle,
+                                         &adapter->pmac_id[0], 0);
+                if (status)
+                        return status;
+        }
+
+        if (adapter->vlans_added)
+                be_vid_config(adapter);
+
+        be_set_rx_mode(adapter->netdev);
+
+        return 0;
+}
+
 static int be_open(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -3490,6 +3567,10 @@ static int be_open(struct net_device *netdev)
         if (status)
                 goto err;
 
+        status = be_enable_if_filters(adapter);
+        if (status)
+                goto err;
+
         status = be_irq_register(adapter);
         if (status)
                 goto err;
@@ -3686,16 +3767,6 @@ static void be_cancel_err_detection(struct be_adapter *adapter)
         }
 }
 
-static void be_mac_clear(struct be_adapter *adapter)
-{
-        if (adapter->pmac_id) {
-                be_cmd_pmac_del(adapter, adapter->if_handle,
-                                adapter->pmac_id[0], 0);
-                kfree(adapter->pmac_id);
-                adapter->pmac_id = NULL;
-        }
-}
-
 #ifdef CONFIG_BE2NET_VXLAN
 static void be_disable_vxlan_offloads(struct be_adapter *adapter)
 {
@@ -3770,8 +3841,8 @@ static int be_clear(struct be_adapter *adapter)
 #ifdef CONFIG_BE2NET_VXLAN
         be_disable_vxlan_offloads(adapter);
 #endif
-        /* delete the primary mac along with the uc-mac list */
-        be_mac_clear(adapter);
+        kfree(adapter->pmac_id);
+        adapter->pmac_id = NULL;
 
         be_cmd_if_destroy(adapter, adapter->if_handle,  0);
 
@@ -3782,25 +3853,11 @@ static int be_clear(struct be_adapter *adapter)
         return 0;
 }
 
-static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
-                        u32 cap_flags, u32 vf)
-{
-        u32 en_flags;
-
-        en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
-                   BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
-                   BE_IF_FLAGS_RSS | BE_IF_FLAGS_DEFQ_RSS;
-
-        en_flags &= cap_flags;
-
-        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
-}
-
 static int be_vfs_if_create(struct be_adapter *adapter)
 {
         struct be_resources res = {0};
+        u32 cap_flags, en_flags, vf;
         struct be_vf_cfg *vf_cfg;
-        u32 cap_flags, vf;
         int status;
 
         /* If a FW profile exists, then cap_flags are updated */
@@ -3821,8 +3878,12 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                         }
                 }
 
-                status = be_if_create(adapter, &vf_cfg->if_handle,
-                                      cap_flags, vf + 1);
+                en_flags = cap_flags & (BE_IF_FLAGS_UNTAGGED |
+                                        BE_IF_FLAGS_BROADCAST |
+                                        BE_IF_FLAGS_MULTICAST |
+                                        BE_IF_FLAGS_PASS_L3L4_ERRORS);
+                status = be_cmd_if_create(adapter, cap_flags, en_flags,
+                                          &vf_cfg->if_handle, vf + 1);
                 if (status)
                         return status;
         }
@@ -4194,15 +4255,8 @@ static int be_mac_setup(struct be_adapter *adapter)
 
                 memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
                 memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
-        } else {
-                /* Maybe the HW was reset; dev_addr must be re-programmed */
-                memcpy(mac, adapter->netdev->dev_addr, ETH_ALEN);
         }
 
-        /* For BE3-R VFs, the PF programs the initial MAC address */
-        if (!(BEx_chip(adapter) && be_virtfn(adapter)))
-                be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-                                &adapter->pmac_id[0], 0);
         return 0;
 }
 
@@ -4342,6 +4396,7 @@ static int be_func_init(struct be_adapter *adapter)
 static int be_setup(struct be_adapter *adapter)
 {
         struct device *dev = &adapter->pdev->dev;
+        u32 en_flags;
         int status;
 
         status = be_func_init(adapter);
@@ -4364,8 +4419,11 @@ static int be_setup(struct be_adapter *adapter)
         if (status)
                 goto err;
 
-        status = be_if_create(adapter, &adapter->if_handle,
-                              be_if_cap_flags(adapter), 0);
+        /* will enable all the needed filter flags in be_open() */
+        en_flags = BE_IF_FLAGS_RSS | BE_IF_FLAGS_DEFQ_RSS;
+        en_flags = en_flags & be_if_cap_flags(adapter);
+        status = be_cmd_if_create(adapter, be_if_cap_flags(adapter), en_flags,
+                                  &adapter->if_handle, 0);
         if (status)
                 goto err;
 
@@ -4391,11 +4449,6 @@ static int be_setup(struct be_adapter *adapter)
                 dev_err(dev, "Please upgrade firmware to version >= 4.0\n");
         }
 
-        if (adapter->vlans_added)
-                be_vid_config(adapter);
-
-        be_set_rx_mode(adapter->netdev);
-
         status = be_cmd_set_flow_control(adapter, adapter->tx_fc,
                                          adapter->rx_fc);
         if (status)
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 1eee73cccdf5..99d33e2d35e6 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -562,6 +562,7 @@ struct fec_enet_private {
 };
 
 void fec_ptp_init(struct platform_device *pdev);
+void fec_ptp_stop(struct platform_device *pdev);
 void fec_ptp_start_cyclecounter(struct net_device *ndev);
 int fec_ptp_set(struct net_device *ndev, struct ifreq *ifr);
 int fec_ptp_get(struct net_device *ndev, struct ifreq *ifr);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 1f89c59b4353..271bb5862346 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -24,6 +24,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/pm_runtime.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
 #include <linux/ioport.h>
@@ -77,6 +78,7 @@ static void fec_enet_itr_coal_init(struct net_device *ndev);
 #define FEC_ENET_RAEM_V 0x8
 #define FEC_ENET_RAFL_V 0x8
 #define FEC_ENET_OPD_V  0xFFF0
+#define FEC_MDIO_PM_TIMEOUT  100 /* ms */
 
 static struct platform_device_id fec_devtype[] = {
         {
@@ -1767,7 +1769,13 @@ static void fec_enet_adjust_link(struct net_device *ndev)
 static int fec_enet_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
         struct fec_enet_private *fep = bus->priv;
+        struct device *dev = &fep->pdev->dev;
         unsigned long time_left;
+        int ret = 0;
+
+        ret = pm_runtime_get_sync(dev);
+        if (IS_ERR_VALUE(ret))
+                return ret;
 
         fep->mii_timeout = 0;
         init_completion(&fep->mdio_done);
@@ -1783,18 +1791,30 @@ static int fec_enet_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         if (time_left == 0) {
                 fep->mii_timeout = 1;
                 netdev_err(fep->netdev, "MDIO read timeout\n");
-                return -ETIMEDOUT;
+                ret = -ETIMEDOUT;
+                goto out;
         }
 
-        /* return value */
-        return FEC_MMFR_DATA(readl(fep->hwp + FEC_MII_DATA));
+        ret = FEC_MMFR_DATA(readl(fep->hwp + FEC_MII_DATA));
+
+out:
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
+
+        return ret;
 }
 
 static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                            u16 value)
 {
         struct fec_enet_private *fep = bus->priv;
+        struct device *dev = &fep->pdev->dev;
         unsigned long time_left;
+        int ret = 0;
+
+        ret = pm_runtime_get_sync(dev);
+        if (IS_ERR_VALUE(ret))
+                return ret;
 
         fep->mii_timeout = 0;
         init_completion(&fep->mdio_done);
@@ -1811,10 +1831,13 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         if (time_left == 0) {
                 fep->mii_timeout = 1;
                 netdev_err(fep->netdev, "MDIO write timeout\n");
-                return -ETIMEDOUT;
+                ret  = -ETIMEDOUT;
         }
 
-        return 0;
+        pm_runtime_mark_last_busy(dev);
+        pm_runtime_put_autosuspend(dev);
+
+        return ret;
 }
 
 static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
@@ -1826,9 +1849,6 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
                 ret = clk_prepare_enable(fep->clk_ahb);
                 if (ret)
                         return ret;
-                ret = clk_prepare_enable(fep->clk_ipg);
-                if (ret)
-                        goto failed_clk_ipg;
                 if (fep->clk_enet_out) {
                         ret = clk_prepare_enable(fep->clk_enet_out);
                         if (ret)
@@ -1852,7 +1872,6 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
                 }
         } else {
                 clk_disable_unprepare(fep->clk_ahb);
-                clk_disable_unprepare(fep->clk_ipg);
                 if (fep->clk_enet_out)
                         clk_disable_unprepare(fep->clk_enet_out);
                 if (fep->clk_ptp) {
@@ -1874,8 +1893,6 @@ failed_clk_ptp:
         if (fep->clk_enet_out)
                 clk_disable_unprepare(fep->clk_enet_out);
 failed_clk_enet_out:
-                clk_disable_unprepare(fep->clk_ipg);
-failed_clk_ipg:
                 clk_disable_unprepare(fep->clk_ahb);
 
         return ret;
@@ -2847,10 +2864,14 @@ fec_enet_open(struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         int ret;
 
+        ret = pm_runtime_get_sync(&fep->pdev->dev);
+        if (IS_ERR_VALUE(ret))
+                return ret;
+
         pinctrl_pm_select_default_state(&fep->pdev->dev);
         ret = fec_enet_clk_enable(ndev, true);
         if (ret)
-                return ret;
+                goto clk_enable;
 
         /* I should reset the ring buffers here, but I don't yet know
          * a simple way to do that.
@@ -2881,6 +2902,9 @@ err_enet_mii_probe:
         fec_enet_free_buffers(ndev);
 err_enet_alloc:
         fec_enet_clk_enable(ndev, false);
+clk_enable:
+        pm_runtime_mark_last_busy(&fep->pdev->dev);
+        pm_runtime_put_autosuspend(&fep->pdev->dev);
         pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         return ret;
 }
@@ -2903,6 +2927,9 @@ fec_enet_close(struct net_device *ndev)
 
         fec_enet_clk_enable(ndev, false);
         pinctrl_pm_select_sleep_state(&fep->pdev->dev);
+        pm_runtime_mark_last_busy(&fep->pdev->dev);
+        pm_runtime_put_autosuspend(&fep->pdev->dev);
+
         fec_enet_free_buffers(ndev);
 
         return 0;
@@ -3115,8 +3142,8 @@ static int fec_enet_init(struct net_device *ndev)
                         fep->bufdesc_size;
 
         /* Allocate memory for buffer descriptors. */
-        cbd_base = dma_alloc_coherent(NULL, bd_size, &bd_dma,
-                                      GFP_KERNEL);
+        cbd_base = dmam_alloc_coherent(&fep->pdev->dev, bd_size, &bd_dma,
+                                       GFP_KERNEL);
         if (!cbd_base) {
                 return -ENOMEM;
         }
@@ -3388,6 +3415,10 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_clk;
 
+        ret = clk_prepare_enable(fep->clk_ipg);
+        if (ret)
+                goto failed_clk_ipg;
+
         fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
         if (!IS_ERR(fep->reg_phy)) {
                 ret = regulator_enable(fep->reg_phy);
@@ -3400,6 +3431,12 @@ fec_probe(struct platform_device *pdev)
                 fep->reg_phy = NULL;
         }
 
+        pm_runtime_set_autosuspend_delay(&pdev->dev, FEC_MDIO_PM_TIMEOUT);
+        pm_runtime_use_autosuspend(&pdev->dev);
+        pm_runtime_get_noresume(&pdev->dev);
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
         fec_reset_phy(pdev);
 
         if (fep->bufdesc_ex)
@@ -3447,6 +3484,10 @@ fec_probe(struct platform_device *pdev)
 
         fep->rx_copybreak = COPYBREAK_DEFAULT;
         INIT_WORK(&fep->tx_timeout_work, fec_enet_timeout_work);
+
+        pm_runtime_mark_last_busy(&pdev->dev);
+        pm_runtime_put_autosuspend(&pdev->dev);
+
         return 0;
 
 failed_register:
@@ -3454,9 +3495,12 @@ failed_register:
 failed_mii_init:
 failed_irq:
 failed_init:
+        fec_ptp_stop(pdev);
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
 failed_regulator:
+        clk_disable_unprepare(fep->clk_ipg);
+failed_clk_ipg:
         fec_enet_clk_enable(ndev, false);
 failed_clk:
 failed_phy:
@@ -3473,14 +3517,12 @@ fec_drv_remove(struct platform_device *pdev)
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct fec_enet_private *fep = netdev_priv(ndev);
 
-        cancel_delayed_work_sync(&fep->time_keep);
         cancel_work_sync(&fep->tx_timeout_work);
+        fec_ptp_stop(pdev);
         unregister_netdev(ndev);
         fec_enet_mii_remove(fep);
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
-        if (fep->ptp_clock)
-                ptp_clock_unregister(fep->ptp_clock);
         of_node_put(fep->phy_node);
         free_netdev(ndev);
 
@@ -3568,7 +3610,28 @@ failed_clk:
         return ret;
 }
 
-static SIMPLE_DEV_PM_OPS(fec_pm_ops, fec_suspend, fec_resume);
+static int __maybe_unused fec_runtime_suspend(struct device *dev)
+{
+        struct net_device *ndev = dev_get_drvdata(dev);
+        struct fec_enet_private *fep = netdev_priv(ndev);
+
+        clk_disable_unprepare(fep->clk_ipg);
+
+        return 0;
+}
+
+static int __maybe_unused fec_runtime_resume(struct device *dev)
+{
+        struct net_device *ndev = dev_get_drvdata(dev);
+        struct fec_enet_private *fep = netdev_priv(ndev);
+
+        return clk_prepare_enable(fep->clk_ipg);
+}
+
+static const struct dev_pm_ops fec_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(fec_suspend, fec_resume)
+        SET_RUNTIME_PM_OPS(fec_runtime_suspend, fec_runtime_resume, NULL)
+};
 
 static struct platform_driver fec_driver = {
         .driver = {
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index a15663ad7f5e..f457a23d0bfb 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -604,6 +604,16 @@ void fec_ptp_init(struct platform_device *pdev)
         schedule_delayed_work(&fep->time_keep, HZ);
 }
 
+void fec_ptp_stop(struct platform_device *pdev)
+{
+        struct net_device *ndev = platform_get_drvdata(pdev);
+        struct fec_enet_private *fep = netdev_priv(ndev);
+
+        cancel_delayed_work_sync(&fep->time_keep);
+        if (fep->ptp_clock)
+                ptp_clock_unregister(fep->ptp_clock);
+}
+
 /**
  * fec_ptp_check_pps_event
  * @fep: the fec_enet_private structure handle
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index 56316db6c5a6..cf8e54652df9 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -586,7 +586,8 @@ static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         frag = skb_shinfo(skb)->frags;
         while (nr_frags) {
                 CBDC_SC(bdp,
-                        BD_ENET_TX_STATS | BD_ENET_TX_LAST | BD_ENET_TX_TC);
+                        BD_ENET_TX_STATS | BD_ENET_TX_INTR | BD_ENET_TX_LAST |
+                        BD_ENET_TX_TC);
                 CBDS_SC(bdp, BD_ENET_TX_READY);
 
                 if ((CBDR_SC(bdp) & BD_ENET_TX_WRAP) == 0)
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
index b34214e2df5f..016743e355de 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
@@ -110,7 +110,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
 }
 
 #define FEC_NAPI_RX_EVENT_MSK   (FEC_ENET_RXF | FEC_ENET_RXB)
-#define FEC_NAPI_TX_EVENT_MSK   (FEC_ENET_TXF | FEC_ENET_TXB)
+#define FEC_NAPI_TX_EVENT_MSK   (FEC_ENET_TXF)
 #define FEC_RX_EVENT            (FEC_ENET_RXF)
 #define FEC_TX_EVENT            (FEC_ENET_TXF)
 #define FEC_ERR_EVENT_MSK       (FEC_ENET_HBERR | FEC_ENET_BABR | \
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index ff875028fdff..2b7610f341b0 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -565,22 +565,6 @@ static void gfar_ints_enable(struct gfar_private *priv)
         }
 }
 
-static void lock_tx_qs(struct gfar_private *priv)
-{
-        int i;
-
-        for (i = 0; i < priv->num_tx_queues; i++)
-                spin_lock(&priv->tx_queue[i]->txlock);
-}
-
-static void unlock_tx_qs(struct gfar_private *priv)
-{
-        int i;
-
-        for (i = 0; i < priv->num_tx_queues; i++)
-                spin_unlock(&priv->tx_queue[i]->txlock);
-}
-
 static int gfar_alloc_tx_queues(struct gfar_private *priv)
 {
         int i;
@@ -1376,7 +1360,6 @@ static int gfar_probe(struct platform_device *ofdev)
         priv->dev = &ofdev->dev;
         SET_NETDEV_DEV(dev, &ofdev->dev);
 
-        spin_lock_init(&priv->bflock);
         INIT_WORK(&priv->reset_task, gfar_reset_task);
 
         platform_set_drvdata(ofdev, priv);
@@ -1470,9 +1453,8 @@ static int gfar_probe(struct platform_device *ofdev)
                 goto register_fail;
         }
 
-        device_init_wakeup(&dev->dev,
-                           priv->device_flags &
-                           FSL_GIANFAR_DEV_HAS_MAGIC_PACKET);
+        device_set_wakeup_capable(&dev->dev, priv->device_flags &
+                                  FSL_GIANFAR_DEV_HAS_MAGIC_PACKET);
 
         /* fill out IRQ number and name fields */
         for (i = 0; i < priv->num_grps; i++) {
@@ -1540,48 +1522,37 @@ static int gfar_suspend(struct device *dev)
         struct gfar_private *priv = dev_get_drvdata(dev);
         struct net_device *ndev = priv->ndev;
         struct gfar __iomem *regs = priv->gfargrp[0].regs;
-        unsigned long flags;
         u32 tempval;
-
         int magic_packet = priv->wol_en &&
                            (priv->device_flags &
                             FSL_GIANFAR_DEV_HAS_MAGIC_PACKET);
 
+        if (!netif_running(ndev))
+                return 0;
+
+        disable_napi(priv);
+        netif_tx_lock(ndev);
         netif_device_detach(ndev);
+        netif_tx_unlock(ndev);
 
-        if (netif_running(ndev)) {
+        gfar_halt(priv);
 
-                local_irq_save(flags);
-                lock_tx_qs(priv);
+        if (magic_packet) {
+                /* Enable interrupt on Magic Packet */
+                gfar_write(&regs->imask, IMASK_MAG);
 
-                gfar_halt_nodisable(priv);
+                /* Enable Magic Packet mode */
+                tempval = gfar_read(&regs->maccfg2);
+                tempval |= MACCFG2_MPEN;
+                gfar_write(&regs->maccfg2, tempval);
 
-                /* Disable Tx, and Rx if wake-on-LAN is disabled. */
+                /* re-enable the Rx block */
                 tempval = gfar_read(&regs->maccfg1);
-
-                tempval &= ~MACCFG1_TX_EN;
-
-                if (!magic_packet)
-                        tempval &= ~MACCFG1_RX_EN;
-
+                tempval |= MACCFG1_RX_EN;
                 gfar_write(&regs->maccfg1, tempval);
 
-                unlock_tx_qs(priv);
-                local_irq_restore(flags);
-
-                disable_napi(priv);
-
-                if (magic_packet) {
-                        /* Enable interrupt on Magic Packet */
-                        gfar_write(&regs->imask, IMASK_MAG);
-
-                        /* Enable Magic Packet mode */
-                        tempval = gfar_read(&regs->maccfg2);
-                        tempval |= MACCFG2_MPEN;
-                        gfar_write(&regs->maccfg2, tempval);
-                } else {
-                        phy_stop(priv->phydev);
-                }
+        } else {
+                phy_stop(priv->phydev);
         }
 
         return 0;
@@ -1592,37 +1563,26 @@ static int gfar_resume(struct device *dev)
         struct gfar_private *priv = dev_get_drvdata(dev);
         struct net_device *ndev = priv->ndev;
         struct gfar __iomem *regs = priv->gfargrp[0].regs;
-        unsigned long flags;
         u32 tempval;
         int magic_packet = priv->wol_en &&
                            (priv->device_flags &
                             FSL_GIANFAR_DEV_HAS_MAGIC_PACKET);
 
-        if (!netif_running(ndev)) {
-                netif_device_attach(ndev);
+        if (!netif_running(ndev))
                 return 0;
-        }
 
-        if (!magic_packet && priv->phydev)
+        if (magic_packet) {
+                /* Disable Magic Packet mode */
+                tempval = gfar_read(&regs->maccfg2);
+                tempval &= ~MACCFG2_MPEN;
+                gfar_write(&regs->maccfg2, tempval);
+        } else {
                 phy_start(priv->phydev);
-
-        /* Disable Magic Packet mode, in case something
-         * else woke us up.
-         */
-        local_irq_save(flags);
-        lock_tx_qs(priv);
-
-        tempval = gfar_read(&regs->maccfg2);
-        tempval &= ~MACCFG2_MPEN;
-        gfar_write(&regs->maccfg2, tempval);
+        }
 
         gfar_start(priv);
 
-        unlock_tx_qs(priv);
-        local_irq_restore(flags);
-
         netif_device_attach(ndev);
-
         enable_napi(priv);
 
         return 0;
@@ -2045,7 +2005,8 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
                 /* Install our interrupt handlers for Error,
                  * Transmit, and Receive
                  */
-                err = request_irq(gfar_irq(grp, ER)->irq, gfar_error, 0,
+                err = request_irq(gfar_irq(grp, ER)->irq, gfar_error,
+                                  IRQF_NO_SUSPEND,
                                   gfar_irq(grp, ER)->name, grp);
                 if (err < 0) {
                         netif_err(priv, intr, dev, "Can't get IRQ %d\n",
@@ -2068,7 +2029,8 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
                         goto rx_irq_fail;
                 }
         } else {
-                err = request_irq(gfar_irq(grp, TX)->irq, gfar_interrupt, 0,
+                err = request_irq(gfar_irq(grp, TX)->irq, gfar_interrupt,
+                                  IRQF_NO_SUSPEND,
                                   gfar_irq(grp, TX)->name, grp);
                 if (err < 0) {
                         netif_err(priv, intr, dev, "Can't get IRQ %d\n",
@@ -2169,8 +2131,6 @@ static int gfar_enet_open(struct net_device *dev)
         if (err)
                 return err;
 
-        device_set_wakeup_enable(&dev->dev, priv->wol_en);
-
         return err;
 }
 
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index daa1d37de642..5545e4103368 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -1145,9 +1145,6 @@ struct gfar_private {
         int oldduplex;
         int oldlink;
 
-        /* Bitfield update lock */
-        spinlock_t bflock;
-
         uint32_t msg_enable;
 
         struct work_struct reset_task;
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index fda12fb32ec7..5b90fcf96265 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -653,7 +653,6 @@ static void gfar_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 static int gfar_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct gfar_private *priv = netdev_priv(dev);
-        unsigned long flags;
 
         if (!(priv->device_flags & FSL_GIANFAR_DEV_HAS_MAGIC_PACKET) &&
             wol->wolopts != 0)
@@ -664,9 +663,7 @@ static int gfar_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 
         device_set_wakeup_enable(&dev->dev, wol->wolopts & WAKE_MAGIC);
 
-        spin_lock_irqsave(&priv->bflock, flags);
-        priv->wol_en =  !!device_may_wakeup(&dev->dev);
-        spin_unlock_irqrestore(&priv->bflock, flags);
+        priv->wol_en = !!device_may_wakeup(&dev->dev);
 
         return 0;
 }
@@ -903,27 +900,6 @@ static int gfar_check_filer_hardware(struct gfar_private *priv)
         return 0;
 }
 
-static int gfar_comp_asc(const void *a, const void *b)
-{
-        return memcmp(a, b, 4);
-}
-
-static int gfar_comp_desc(const void *a, const void *b)
-{
-        return -memcmp(a, b, 4);
-}
-
-static void gfar_swap(void *a, void *b, int size)
-{
-        u32 *_a = a;
-        u32 *_b = b;
-
-        swap(_a[0], _b[0]);
-        swap(_a[1], _b[1]);
-        swap(_a[2], _b[2]);
-        swap(_a[3], _b[3]);
-}
-
 /* Write a mask to filer cache */
 static void gfar_set_mask(u32 mask, struct filer_table *tab)
 {
@@ -1273,310 +1249,6 @@ static int gfar_convert_to_filer(struct ethtool_rx_flow_spec *rule,
         return 0;
 }
 
-/* Copy size filer entries */
-static void gfar_copy_filer_entries(struct gfar_filer_entry dst[0],
-                                    struct gfar_filer_entry src[0], s32 size)
-{
-        while (size > 0) {
-                size--;
-                dst[size].ctrl = src[size].ctrl;
-                dst[size].prop = src[size].prop;
-        }
-}
-
-/* Delete the contents of the filer-table between start and end
- * and collapse them
- */
-static int gfar_trim_filer_entries(u32 begin, u32 end, struct filer_table *tab)
-{
-        int length;
-
-        if (end > MAX_FILER_CACHE_IDX || end < begin)
-                return -EINVAL;
-
-        end++;
-        length = end - begin;
-
-        /* Copy */
-        while (end < tab->index) {
-                tab->fe[begin].ctrl = tab->fe[end].ctrl;
-                tab->fe[begin++].prop = tab->fe[end++].prop;
-
-        }
-        /* Fill up with don't cares */
-        while (begin < tab->index) {
-                tab->fe[begin].ctrl = 0x60;
-                tab->fe[begin].prop = 0xFFFFFFFF;
-                begin++;
-        }
-
-        tab->index -= length;
-        return 0;
-}
-
-/* Make space on the wanted location */
-static int gfar_expand_filer_entries(u32 begin, u32 length,
-                                     struct filer_table *tab)
-{
-        if (length == 0 || length + tab->index > MAX_FILER_CACHE_IDX ||
-            begin > MAX_FILER_CACHE_IDX)
-                return -EINVAL;
-
-        gfar_copy_filer_entries(&(tab->fe[begin + length]), &(tab->fe[begin]),
-                                tab->index - length + 1);
-
-        tab->index += length;
-        return 0;
-}
-
-static int gfar_get_next_cluster_start(int start, struct filer_table *tab)
-{
-        for (; (start < tab->index) && (start < MAX_FILER_CACHE_IDX - 1);
-             start++) {
-                if ((tab->fe[start].ctrl & (RQFCR_AND | RQFCR_CLE)) ==
-                    (RQFCR_AND | RQFCR_CLE))
-                        return start;
-        }
-        return -1;
-}
-
-static int gfar_get_next_cluster_end(int start, struct filer_table *tab)
-{
-        for (; (start < tab->index) && (start < MAX_FILER_CACHE_IDX - 1);
-             start++) {
-                if ((tab->fe[start].ctrl & (RQFCR_AND | RQFCR_CLE)) ==
-                    (RQFCR_CLE))
-                        return start;
-        }
-        return -1;
-}
-
-/* Uses hardwares clustering option to reduce
- * the number of filer table entries
- */
-static void gfar_cluster_filer(struct filer_table *tab)
-{
-        s32 i = -1, j, iend, jend;
-
-        while ((i = gfar_get_next_cluster_start(++i, tab)) != -1) {
-                j = i;
-                while ((j = gfar_get_next_cluster_start(++j, tab)) != -1) {
-                        /* The cluster entries self and the previous one
-                         * (a mask) must be identical!
-                         */
-                        if (tab->fe[i].ctrl != tab->fe[j].ctrl)
-                                break;
-                        if (tab->fe[i].prop != tab->fe[j].prop)
-                                break;
-                        if (tab->fe[i - 1].ctrl != tab->fe[j - 1].ctrl)
-                                break;
-                        if (tab->fe[i - 1].prop != tab->fe[j - 1].prop)
-                                break;
-                        iend = gfar_get_next_cluster_end(i, tab);
-                        jend = gfar_get_next_cluster_end(j, tab);
-                        if (jend == -1 || iend == -1)
-                                break;
-
-                        /* First we make some free space, where our cluster
-                         * element should be. Then we copy it there and finally
-                         * delete in from its old location.
-                         */
-                        if (gfar_expand_filer_entries(iend, (jend - j), tab) ==
-                            -EINVAL)
-                                break;
-
-                        gfar_copy_filer_entries(&(tab->fe[iend + 1]),
-                                                &(tab->fe[jend + 1]), jend - j);
-
-                        if (gfar_trim_filer_entries(jend - 1,
-                                                    jend + (jend - j),
-                                                    tab) == -EINVAL)
-                                return;
-
-                        /* Mask out cluster bit */
-                        tab->fe[iend].ctrl &= ~(RQFCR_CLE);
-                }
-        }
-}
-
-/* Swaps the masked bits of a1<>a2 and b1<>b2 */
-static void gfar_swap_bits(struct gfar_filer_entry *a1,
-                           struct gfar_filer_entry *a2,
-                           struct gfar_filer_entry *b1,
-                           struct gfar_filer_entry *b2, u32 mask)
-{
-        u32 temp[4];
-        temp[0] = a1->ctrl & mask;
-        temp[1] = a2->ctrl & mask;
-        temp[2] = b1->ctrl & mask;
-        temp[3] = b2->ctrl & mask;
-
-        a1->ctrl &= ~mask;
-        a2->ctrl &= ~mask;
-        b1->ctrl &= ~mask;
-        b2->ctrl &= ~mask;
-
-        a1->ctrl |= temp[1];
-        a2->ctrl |= temp[0];
-        b1->ctrl |= temp[3];
-        b2->ctrl |= temp[2];
-}
-
-/* Generate a list consisting of masks values with their start and
- * end of validity and block as indicator for parts belonging
- * together (glued by ANDs) in mask_table
- */
-static u32 gfar_generate_mask_table(struct gfar_mask_entry *mask_table,
-                                    struct filer_table *tab)
-{
-        u32 i, and_index = 0, block_index = 1;
-
-        for (i = 0; i < tab->index; i++) {
-
-                /* LSByte of control = 0 sets a mask */
-                if (!(tab->fe[i].ctrl & 0xF)) {
-                        mask_table[and_index].mask = tab->fe[i].prop;
-                        mask_table[and_index].start = i;
-                        mask_table[and_index].block = block_index;
-                        if (and_index >= 1)
-                                mask_table[and_index - 1].end = i - 1;
-                        and_index++;
-                }
-                /* cluster starts and ends will be separated because they should
-                 * hold their position
-                 */
-                if (tab->fe[i].ctrl & RQFCR_CLE)
-                        block_index++;
-                /* A not set AND indicates the end of a depended block */
-                if (!(tab->fe[i].ctrl & RQFCR_AND))
-                        block_index++;
-        }
-
-        mask_table[and_index - 1].end = i - 1;
-
-        return and_index;
-}
-
-/* Sorts the entries of mask_table by the values of the masks.
- * Important: The 0xFF80 flags of the first and last entry of a
- * block must hold their position (which queue, CLusterEnable, ReJEct,
- * AND)
- */
-static void gfar_sort_mask_table(struct gfar_mask_entry *mask_table,
-                                 struct filer_table *temp_table, u32 and_index)
-{
-        /* Pointer to compare function (_asc or _desc) */
-        int (*gfar_comp)(const void *, const void *);
-
-        u32 i, size = 0, start = 0, prev = 1;
-        u32 old_first, old_last, new_first, new_last;
-
-        gfar_comp = &gfar_comp_desc;
-
-        for (i = 0; i < and_index; i++) {
-                if (prev != mask_table[i].block) {
-                        old_first = mask_table[start].start + 1;
-                        old_last = mask_table[i - 1].end;
-                        sort(mask_table + start, size,
-                             sizeof(struct gfar_mask_entry),
-                             gfar_comp, &gfar_swap);
-
-                        /* Toggle order for every block. This makes the
-                         * thing more efficient!
-                         */
-                        if (gfar_comp == gfar_comp_desc)
-                                gfar_comp = &gfar_comp_asc;
-                        else
-                                gfar_comp = &gfar_comp_desc;
-
-                        new_first = mask_table[start].start + 1;
-                        new_last = mask_table[i - 1].end;
-
-                        gfar_swap_bits(&temp_table->fe[new_first],
-                                       &temp_table->fe[old_first],
-                                       &temp_table->fe[new_last],
-                                       &temp_table->fe[old_last],
-                                       RQFCR_QUEUE | RQFCR_CLE |
-                                       RQFCR_RJE | RQFCR_AND);
-
-                        start = i;
-                        size = 0;
-                }
-                size++;
-                prev = mask_table[i].block;
-        }
-}
-
-/* Reduces the number of masks needed in the filer table to save entries
- * This is done by sorting the masks of a depended block. A depended block is
- * identified by gluing ANDs or CLE. The sorting order toggles after every
- * block. Of course entries in scope of a mask must change their location with
- * it.
- */
-static int gfar_optimize_filer_masks(struct filer_table *tab)
-{
-        struct filer_table *temp_table;
-        struct gfar_mask_entry *mask_table;
-
-        u32 and_index = 0, previous_mask = 0, i = 0, j = 0, size = 0;
-        s32 ret = 0;
-
-        /* We need a copy of the filer table because
-         * we want to change its order
-         */
-        temp_table = kmemdup(tab, sizeof(*temp_table), GFP_KERNEL);
-        if (temp_table == NULL)
-                return -ENOMEM;
-
-        mask_table = kcalloc(MAX_FILER_CACHE_IDX / 2 + 1,
-                             sizeof(struct gfar_mask_entry), GFP_KERNEL);
-
-        if (mask_table == NULL) {
-                ret = -ENOMEM;
-                goto end;
-        }
-
-        and_index = gfar_generate_mask_table(mask_table, tab);
-
-        gfar_sort_mask_table(mask_table, temp_table, and_index);
-
-        /* Now we can copy the data from our duplicated filer table to
-         * the real one in the order the mask table says
-         */
-        for (i = 0; i < and_index; i++) {
-                size = mask_table[i].end - mask_table[i].start + 1;
-                gfar_copy_filer_entries(&(tab->fe[j]),
-                                &(temp_table->fe[mask_table[i].start]), size);
-                j += size;
-        }
-
-        /* And finally we just have to check for duplicated masks and drop the
-         * second ones
-         */
-        for (i = 0; i < tab->index && i < MAX_FILER_CACHE_IDX; i++) {
-                if (tab->fe[i].ctrl == 0x80) {
-                        previous_mask = i++;
-                        break;
-                }
-        }
-        for (; i < tab->index && i < MAX_FILER_CACHE_IDX; i++) {
-                if (tab->fe[i].ctrl == 0x80) {
-                        if (tab->fe[i].prop == tab->fe[previous_mask].prop) {
-                                /* Two identical ones found!
-                                 * So drop the second one!
-                                 */
-                                gfar_trim_filer_entries(i, i, tab);
-                        } else
-                                /* Not identical! */
-                                previous_mask = i;
-                }
-        }
-
-        kfree(mask_table);
-end:    kfree(temp_table);
-        return ret;
-}
-
 /* Write the bit-pattern from software's buffer to hardware registers */
 static int gfar_write_filer_table(struct gfar_private *priv,
                                   struct filer_table *tab)
@@ -1586,11 +1258,10 @@ static int gfar_write_filer_table(struct gfar_private *priv,
                 return -EBUSY;
 
         /* Fill regular entries */
-        for (; i < MAX_FILER_IDX - 1 && (tab->fe[i].ctrl | tab->fe[i].prop);
-             i++)
+        for (; i < MAX_FILER_IDX && (tab->fe[i].ctrl | tab->fe[i].prop); i++)
                 gfar_write_filer(priv, i, tab->fe[i].ctrl, tab->fe[i].prop);
         /* Fill the rest with fall-troughs */
-        for (; i < MAX_FILER_IDX - 1; i++)
+        for (; i < MAX_FILER_IDX; i++)
                 gfar_write_filer(priv, i, 0x60, 0xFFFFFFFF);
         /* Last entry must be default accept
          * because that's what people expect
@@ -1624,7 +1295,6 @@ static int gfar_process_filer_changes(struct gfar_private *priv)
 {
         struct ethtool_flow_spec_container *j;
         struct filer_table *tab;
-        s32 i = 0;
         s32 ret = 0;
 
         /* So index is set to zero, too! */
@@ -1649,17 +1319,6 @@ static int gfar_process_filer_changes(struct gfar_private *priv)
                 }
         }
 
-        i = tab->index;
-
-        /* Optimizations to save entries */
-        gfar_cluster_filer(tab);
-        gfar_optimize_filer_masks(tab);
-
-        pr_debug("\tSummary:\n"
-                 "\tData on hardware: %d\n"
-                 "\tCompression rate: %d%%\n",
-                 tab->index, 100 - (100 * tab->index) / i);
-
         /* Write everything to hardware */
         ret = gfar_write_filer_table(priv, tab);
         if (ret == -EBUSY) {
@@ -1725,13 +1384,14 @@ static int gfar_add_cls(struct gfar_private *priv,
         }
 
 process:
+        priv->rx_list.count++;
         ret = gfar_process_filer_changes(priv);
         if (ret)
                 goto clean_list;
-        priv->rx_list.count++;
         return ret;
 
 clean_list:
+        priv->rx_list.count--;
         list_del(&temp->list);
 clean_mem:
         kfree(temp);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 3e8b1bfb1f2e..d9884fd15b45 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -27,6 +27,8 @@
 #include <linux/of_address.h>
 #include <linux/phy.h>
 #include <linux/clk.h>
+#include <linux/hrtimer.h>
+#include <linux/ktime.h>
 #include <uapi/linux/ppp_defs.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -299,6 +301,7 @@
 
 /* Coalescing */
 #define MVPP2_TXDONE_COAL_PKTS_THRESH   15
+#define MVPP2_TXDONE_HRTIMER_PERIOD_NS  1000000UL
 #define MVPP2_RX_COAL_PKTS              32
 #define MVPP2_RX_COAL_USEC              100
 
@@ -660,6 +663,14 @@ struct mvpp2_pcpu_stats {
         u64     tx_bytes;
 };
 
+/* Per-CPU port control */
+struct mvpp2_port_pcpu {
+        struct hrtimer tx_done_timer;
+        bool timer_scheduled;
+        /* Tasklet for egress finalization */
+        struct tasklet_struct tx_done_tasklet;
+};
+
 struct mvpp2_port {
         u8 id;
 
@@ -679,6 +690,9 @@ struct mvpp2_port {
         u32 pending_cause_rx;
         struct napi_struct napi;
 
+        /* Per-CPU port control */
+        struct mvpp2_port_pcpu __percpu *pcpu;
+
         /* Flags */
         unsigned long flags;
 
@@ -776,6 +790,9 @@ struct mvpp2_txq_pcpu {
         /* Array of transmitted skb */
         struct sk_buff **tx_skb;
 
+        /* Array of transmitted buffers' physical addresses */
+        dma_addr_t *tx_buffs;
+
         /* Index of last TX DMA descriptor that was inserted */
         int txq_put_index;
 
@@ -913,8 +930,6 @@ struct mvpp2_bm_pool {
         /* Occupied buffers indicator */
         atomic_t in_use;
         int in_use_thresh;
-
-        spinlock_t lock;
 };
 
 struct mvpp2_buff_hdr {
@@ -963,9 +978,13 @@ static void mvpp2_txq_inc_get(struct mvpp2_txq_pcpu *txq_pcpu)
 }
 
 static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu,
-                              struct sk_buff *skb)
+                              struct sk_buff *skb,
+                              struct mvpp2_tx_desc *tx_desc)
 {
         txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb;
+        if (skb)
+                txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] =
+                                                         tx_desc->buf_phys_addr;
         txq_pcpu->txq_put_index++;
         if (txq_pcpu->txq_put_index == txq_pcpu->size)
                 txq_pcpu->txq_put_index = 0;
@@ -3376,7 +3395,6 @@ static int mvpp2_bm_pool_create(struct platform_device *pdev,
         bm_pool->pkt_size = 0;
         bm_pool->buf_num = 0;
         atomic_set(&bm_pool->in_use, 0);
-        spin_lock_init(&bm_pool->lock);
 
         return 0;
 }
@@ -3647,7 +3665,6 @@ static struct mvpp2_bm_pool *
 mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
                   int pkt_size)
 {
-        unsigned long flags = 0;
         struct mvpp2_bm_pool *new_pool = &port->priv->bm_pools[pool];
         int num;
 
@@ -3656,8 +3673,6 @@ mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
                 return NULL;
         }
 
-        spin_lock_irqsave(&new_pool->lock, flags);
-
         if (new_pool->type == MVPP2_BM_FREE)
                 new_pool->type = type;
 
@@ -3686,8 +3701,6 @@ mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
                 if (num != pkts_num) {
                         WARN(1, "pool %d: %d of %d allocated\n",
                              new_pool->id, num, pkts_num);
-                        /* We need to undo the bufs_add() allocations */
-                        spin_unlock_irqrestore(&new_pool->lock, flags);
                         return NULL;
                 }
         }
@@ -3695,15 +3708,12 @@ mvpp2_bm_pool_use(struct mvpp2_port *port, int pool, enum mvpp2_bm_type type,
         mvpp2_bm_pool_bufsize_set(port->priv, new_pool,
                                   MVPP2_RX_BUF_SIZE(new_pool->pkt_size));
 
-        spin_unlock_irqrestore(&new_pool->lock, flags);
-
         return new_pool;
 }
 
 /* Initialize pools for swf */
 static int mvpp2_swf_bm_pool_init(struct mvpp2_port *port)
 {
-        unsigned long flags = 0;
         int rxq;
 
         if (!port->pool_long) {
@@ -3714,9 +3724,7 @@ static int mvpp2_swf_bm_pool_init(struct mvpp2_port *port)
                 if (!port->pool_long)
                         return -ENOMEM;
 
-                spin_lock_irqsave(&port->pool_long->lock, flags);
                 port->pool_long->port_map |= (1 << port->id);
-                spin_unlock_irqrestore(&port->pool_long->lock, flags);
 
                 for (rxq = 0; rxq < rxq_number; rxq++)
                         mvpp2_rxq_long_pool_set(port, rxq, port->pool_long->id);
@@ -3730,9 +3738,7 @@ static int mvpp2_swf_bm_pool_init(struct mvpp2_port *port)
                 if (!port->pool_short)
                         return -ENOMEM;
 
-                spin_lock_irqsave(&port->pool_short->lock, flags);
                 port->pool_short->port_map |= (1 << port->id);
-                spin_unlock_irqrestore(&port->pool_short->lock, flags);
 
                 for (rxq = 0; rxq < rxq_number; rxq++)
                         mvpp2_rxq_short_pool_set(port, rxq,
@@ -3806,7 +3812,6 @@ static void mvpp2_interrupts_unmask(void *arg)
 
         mvpp2_write(port->priv, MVPP2_ISR_RX_TX_MASK_REG(port->id),
                     (MVPP2_CAUSE_MISC_SUM_MASK |
-                     MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK |
                      MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK));
 }
 
@@ -4382,23 +4387,6 @@ static void mvpp2_rx_time_coal_set(struct mvpp2_port *port,
         rxq->time_coal = usec;
 }
 
-/* Set threshold for TX_DONE pkts coalescing */
-static void mvpp2_tx_done_pkts_coal_set(void *arg)
-{
-        struct mvpp2_port *port = arg;
-        int queue;
-        u32 val;
-
-        for (queue = 0; queue < txq_number; queue++) {
-                struct mvpp2_tx_queue *txq = port->txqs[queue];
-
-                val = (txq->done_pkts_coal << MVPP2_TRANSMITTED_THRESH_OFFSET) &
-                       MVPP2_TRANSMITTED_THRESH_MASK;
-                mvpp2_write(port->priv, MVPP2_TXQ_NUM_REG, txq->id);
-                mvpp2_write(port->priv, MVPP2_TXQ_THRESH_REG, val);
-        }
-}
-
 /* Free Tx queue skbuffs */
 static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
                                 struct mvpp2_tx_queue *txq,
@@ -4407,8 +4395,8 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
         int i;
 
         for (i = 0; i < num; i++) {
-                struct mvpp2_tx_desc *tx_desc = txq->descs +
-                                                        txq_pcpu->txq_get_index;
+                dma_addr_t buf_phys_addr =
+                                    txq_pcpu->tx_buffs[txq_pcpu->txq_get_index];
                 struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index];
 
                 mvpp2_txq_inc_get(txq_pcpu);
@@ -4416,8 +4404,8 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
                 if (!skb)
                         continue;
 
-                dma_unmap_single(port->dev->dev.parent, tx_desc->buf_phys_addr,
-                                 tx_desc->data_size, DMA_TO_DEVICE);
+                dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
+                                 skb_headlen(skb), DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
         }
 }
@@ -4433,7 +4421,7 @@ static inline struct mvpp2_rx_queue *mvpp2_get_rx_queue(struct mvpp2_port *port,
 static inline struct mvpp2_tx_queue *mvpp2_get_tx_queue(struct mvpp2_port *port,
                                                         u32 cause)
 {
-        int queue = fls(cause >> 16) - 1;
+        int queue = fls(cause) - 1;
 
         return port->txqs[queue];
 }
@@ -4460,6 +4448,29 @@ static void mvpp2_txq_done(struct mvpp2_port *port, struct mvpp2_tx_queue *txq,
                         netif_tx_wake_queue(nq);
 }
 
+static unsigned int mvpp2_tx_done(struct mvpp2_port *port, u32 cause)
+{
+        struct mvpp2_tx_queue *txq;
+        struct mvpp2_txq_pcpu *txq_pcpu;
+        unsigned int tx_todo = 0;
+
+        while (cause) {
+                txq = mvpp2_get_tx_queue(port, cause);
+                if (!txq)
+                        break;
+
+                txq_pcpu = this_cpu_ptr(txq->pcpu);
+
+                if (txq_pcpu->count) {
+                        mvpp2_txq_done(port, txq, txq_pcpu);
+                        tx_todo += txq_pcpu->count;
+                }
+
+                cause &= ~(1 << txq->log_id);
+        }
+        return tx_todo;
+}
+
 /* Rx/Tx queue initialization/cleanup methods */
 
 /* Allocate and initialize descriptors for aggr TXQ */
@@ -4649,12 +4660,13 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
                 txq_pcpu->tx_skb = kmalloc(txq_pcpu->size *
                                            sizeof(*txq_pcpu->tx_skb),
                                            GFP_KERNEL);
-                if (!txq_pcpu->tx_skb) {
-                        dma_free_coherent(port->dev->dev.parent,
-                                          txq->size * MVPP2_DESC_ALIGNED_SIZE,
-                                          txq->descs, txq->descs_phys);
-                        return -ENOMEM;
-                }
+                if (!txq_pcpu->tx_skb)
+                        goto error;
+
+                txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size *
+                                             sizeof(dma_addr_t), GFP_KERNEL);
+                if (!txq_pcpu->tx_buffs)
+                        goto error;
 
                 txq_pcpu->count = 0;
                 txq_pcpu->reserved_num = 0;
@@ -4663,6 +4675,19 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         }
 
         return 0;
+
+error:
+        for_each_present_cpu(cpu) {
+                txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
+                kfree(txq_pcpu->tx_skb);
+                kfree(txq_pcpu->tx_buffs);
+        }
+
+        dma_free_coherent(port->dev->dev.parent,
+                          txq->size * MVPP2_DESC_ALIGNED_SIZE,
+                          txq->descs, txq->descs_phys);
+
+        return -ENOMEM;
 }
 
 /* Free allocated TXQ resources */
@@ -4675,6 +4700,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
         for_each_present_cpu(cpu) {
                 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
                 kfree(txq_pcpu->tx_skb);
+                kfree(txq_pcpu->tx_buffs);
         }
 
         if (txq->descs)
@@ -4805,7 +4831,6 @@ static int mvpp2_setup_txqs(struct mvpp2_port *port)
                         goto err_cleanup;
         }
 
-        on_each_cpu(mvpp2_tx_done_pkts_coal_set, port, 1);
         on_each_cpu(mvpp2_txq_sent_counter_clear, port, 1);
         return 0;
 
@@ -4887,6 +4912,49 @@ static void mvpp2_link_event(struct net_device *dev)
         }
 }
 
+static void mvpp2_timer_set(struct mvpp2_port_pcpu *port_pcpu)
+{
+        ktime_t interval;
+
+        if (!port_pcpu->timer_scheduled) {
+                port_pcpu->timer_scheduled = true;
+                interval = ktime_set(0, MVPP2_TXDONE_HRTIMER_PERIOD_NS);
+                hrtimer_start(&port_pcpu->tx_done_timer, interval,
+                              HRTIMER_MODE_REL_PINNED);
+        }
+}
+
+static void mvpp2_tx_proc_cb(unsigned long data)
+{
+        struct net_device *dev = (struct net_device *)data;
+        struct mvpp2_port *port = netdev_priv(dev);
+        struct mvpp2_port_pcpu *port_pcpu = this_cpu_ptr(port->pcpu);
+        unsigned int tx_todo, cause;
+
+        if (!netif_running(dev))
+                return;
+        port_pcpu->timer_scheduled = false;
+
+        /* Process all the Tx queues */
+        cause = (1 << txq_number) - 1;
+        tx_todo = mvpp2_tx_done(port, cause);
+
+        /* Set the timer in case not all the packets were processed */
+        if (tx_todo)
+                mvpp2_timer_set(port_pcpu);
+}
+
+static enum hrtimer_restart mvpp2_hr_timer_cb(struct hrtimer *timer)
+{
+        struct mvpp2_port_pcpu *port_pcpu = container_of(timer,
+                                                         struct mvpp2_port_pcpu,
+                                                         tx_done_timer);
+
+        tasklet_schedule(&port_pcpu->tx_done_tasklet);
+
+        return HRTIMER_NORESTART;
+}
+
 /* Main RX/TX processing routines */
 
 /* Display more error info */
@@ -5144,11 +5212,11 @@ static int mvpp2_tx_frag_process(struct mvpp2_port *port, struct sk_buff *skb,
                 if (i == (skb_shinfo(skb)->nr_frags - 1)) {
                         /* Last descriptor */
                         tx_desc->command = MVPP2_TXD_L_DESC;
-                        mvpp2_txq_inc_put(txq_pcpu, skb);
+                        mvpp2_txq_inc_put(txq_pcpu, skb, tx_desc);
                 } else {
                         /* Descriptor in the middle: Not First, Not Last */
                         tx_desc->command = 0;
-                        mvpp2_txq_inc_put(txq_pcpu, NULL);
+                        mvpp2_txq_inc_put(txq_pcpu, NULL, tx_desc);
                 }
         }
 
@@ -5214,12 +5282,12 @@ static int mvpp2_tx(struct sk_buff *skb, struct net_device *dev)
                 /* First and Last descriptor */
                 tx_cmd |= MVPP2_TXD_F_DESC | MVPP2_TXD_L_DESC;
                 tx_desc->command = tx_cmd;
-                mvpp2_txq_inc_put(txq_pcpu, skb);
+                mvpp2_txq_inc_put(txq_pcpu, skb, tx_desc);
         } else {
                 /* First but not Last */
                 tx_cmd |= MVPP2_TXD_F_DESC | MVPP2_TXD_PADDING_DISABLE;
                 tx_desc->command = tx_cmd;
-                mvpp2_txq_inc_put(txq_pcpu, NULL);
+                mvpp2_txq_inc_put(txq_pcpu, NULL, tx_desc);
 
                 /* Continue with other skb fragments */
                 if (mvpp2_tx_frag_process(port, skb, aggr_txq, txq)) {
@@ -5255,6 +5323,17 @@ out:
                 dev_kfree_skb_any(skb);
         }
 
+        /* Finalize TX processing */
+        if (txq_pcpu->count >= txq->done_pkts_coal)
+                mvpp2_txq_done(port, txq, txq_pcpu);
+
+        /* Set the timer in case not all frags were processed */
+        if (txq_pcpu->count <= frags && txq_pcpu->count > 0) {
+                struct mvpp2_port_pcpu *port_pcpu = this_cpu_ptr(port->pcpu);
+
+                mvpp2_timer_set(port_pcpu);
+        }
+
         return NETDEV_TX_OK;
 }
 
@@ -5268,10 +5347,11 @@ static inline void mvpp2_cause_error(struct net_device *dev, int cause)
                 netdev_err(dev, "tx fifo underrun error\n");
 }
 
-static void mvpp2_txq_done_percpu(void *arg)
+static int mvpp2_poll(struct napi_struct *napi, int budget)
 {
-        struct mvpp2_port *port = arg;
-        u32 cause_rx_tx, cause_tx, cause_misc;
+        u32 cause_rx_tx, cause_rx, cause_misc;
+        int rx_done = 0;
+        struct mvpp2_port *port = netdev_priv(napi->dev);
 
         /* Rx/Tx cause register
          *
@@ -5285,7 +5365,7 @@ static void mvpp2_txq_done_percpu(void *arg)
          */
         cause_rx_tx = mvpp2_read(port->priv,
                                  MVPP2_ISR_RX_TX_CAUSE_REG(port->id));
-        cause_tx = cause_rx_tx & MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
+        cause_rx_tx &= ~MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
         cause_misc = cause_rx_tx & MVPP2_CAUSE_MISC_SUM_MASK;
 
         if (cause_misc) {
@@ -5297,26 +5377,6 @@ static void mvpp2_txq_done_percpu(void *arg)
                             cause_rx_tx & ~MVPP2_CAUSE_MISC_SUM_MASK);
         }
 
-        /* Release TX descriptors */
-        if (cause_tx) {
-                struct mvpp2_tx_queue *txq = mvpp2_get_tx_queue(port, cause_tx);
-                struct mvpp2_txq_pcpu *txq_pcpu = this_cpu_ptr(txq->pcpu);
-
-                if (txq_pcpu->count)
-                        mvpp2_txq_done(port, txq, txq_pcpu);
-        }
-}
-
-static int mvpp2_poll(struct napi_struct *napi, int budget)
-{
-        u32 cause_rx_tx, cause_rx;
-        int rx_done = 0;
-        struct mvpp2_port *port = netdev_priv(napi->dev);
-
-        on_each_cpu(mvpp2_txq_done_percpu, port, 1);
-
-        cause_rx_tx = mvpp2_read(port->priv,
-                                 MVPP2_ISR_RX_TX_CAUSE_REG(port->id));
         cause_rx = cause_rx_tx & MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
 
         /* Process RX packets */
@@ -5561,6 +5621,8 @@ err_cleanup_rxqs:
 static int mvpp2_stop(struct net_device *dev)
 {
         struct mvpp2_port *port = netdev_priv(dev);
+        struct mvpp2_port_pcpu *port_pcpu;
+        int cpu;
 
         mvpp2_stop_dev(port);
         mvpp2_phy_disconnect(port);
@@ -5569,6 +5631,13 @@ static int mvpp2_stop(struct net_device *dev)
         on_each_cpu(mvpp2_interrupts_mask, port, 1);
 
         free_irq(port->irq, port);
+        for_each_present_cpu(cpu) {
+                port_pcpu = per_cpu_ptr(port->pcpu, cpu);
+
+                hrtimer_cancel(&port_pcpu->tx_done_timer);
+                port_pcpu->timer_scheduled = false;
+                tasklet_kill(&port_pcpu->tx_done_tasklet);
+        }
         mvpp2_cleanup_rxqs(port);
         mvpp2_cleanup_txqs(port);
 
@@ -5784,7 +5853,6 @@ static int mvpp2_ethtool_set_coalesce(struct net_device *dev,
                 txq->done_pkts_coal = c->tx_max_coalesced_frames;
         }
 
-        on_each_cpu(mvpp2_tx_done_pkts_coal_set, port, 1);
         return 0;
 }
 
@@ -6035,6 +6103,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
 {
         struct device_node *phy_node;
         struct mvpp2_port *port;
+        struct mvpp2_port_pcpu *port_pcpu;
         struct net_device *dev;
         struct resource *res;
         const char *dt_mac_addr;
@@ -6044,7 +6113,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         int features;
         int phy_mode;
         int priv_common_regs_num = 2;
-        int err, i;
+        int err, i, cpu;
 
         dev = alloc_etherdev_mqs(sizeof(struct mvpp2_port), txq_number,
                                  rxq_number);
@@ -6135,6 +6204,24 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         }
         mvpp2_port_power_up(port);
 
+        port->pcpu = alloc_percpu(struct mvpp2_port_pcpu);
+        if (!port->pcpu) {
+                err = -ENOMEM;
+                goto err_free_txq_pcpu;
+        }
+
+        for_each_present_cpu(cpu) {
+                port_pcpu = per_cpu_ptr(port->pcpu, cpu);
+
+                hrtimer_init(&port_pcpu->tx_done_timer, CLOCK_MONOTONIC,
+                             HRTIMER_MODE_REL_PINNED);
+                port_pcpu->tx_done_timer.function = mvpp2_hr_timer_cb;
+                port_pcpu->timer_scheduled = false;
+
+                tasklet_init(&port_pcpu->tx_done_tasklet, mvpp2_tx_proc_cb,
+                             (unsigned long)dev);
+        }
+
         netif_napi_add(dev, &port->napi, mvpp2_poll, NAPI_POLL_WEIGHT);
         features = NETIF_F_SG | NETIF_F_IP_CSUM;
         dev->features = features | NETIF_F_RXCSUM;
@@ -6144,7 +6231,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         err = register_netdev(dev);
         if (err < 0) {
                 dev_err(&pdev->dev, "failed to register netdev\n");
-                goto err_free_txq_pcpu;
+                goto err_free_port_pcpu;
         }
         netdev_info(dev, "Using %s mac address %pM\n", mac_from, dev->dev_addr);
 
@@ -6153,6 +6240,8 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         priv->port_list[id] = port;
         return 0;
 
+err_free_port_pcpu:
+        free_percpu(port->pcpu);
 err_free_txq_pcpu:
         for (i = 0; i < txq_number; i++)
                 free_percpu(port->txqs[i]->pcpu);
@@ -6171,6 +6260,7 @@ static void mvpp2_port_remove(struct mvpp2_port *port)
         int i;
 
         unregister_netdev(port->dev);
+        free_percpu(port->pcpu);
         free_percpu(port->stats);
         for (i = 0; i < txq_number; i++)
                 free_percpu(port->txqs[i]->pcpu);
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 82040137d7d9..0a3202047569 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -686,6 +686,7 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
 {
         struct mlx4_cmd *cmd = &mlx4_priv(dev)->cmd;
         struct mlx4_cmd_context *context;
+        long ret_wait;
         int err = 0;
 
         down(&cmd->event_sem);
@@ -711,8 +712,20 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
         if (err)
                 goto out_reset;
 
-        if (!wait_for_completion_timeout(&context->done,
-                                         msecs_to_jiffies(timeout))) {
+        if (op == MLX4_CMD_SENSE_PORT) {
+                ret_wait =
+                        wait_for_completion_interruptible_timeout(&context->done,
+                                                                  msecs_to_jiffies(timeout));
+                if (ret_wait < 0) {
+                        context->fw_status = 0;
+                        context->out_param = 0;
+                        context->result = 0;
+                }
+        } else {
+                ret_wait = (long)wait_for_completion_timeout(&context->done,
+                                                             msecs_to_jiffies(timeout));
+        }
+        if (!ret_wait) {
                 mlx4_warn(dev, "command 0x%x timed out (go bit not cleared)\n",
                           op);
                 if (op == MLX4_CMD_NOP) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 7a4f20bb7fcb..9c145dddd717 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -246,7 +246,6 @@ static int mlx4_en_prepare_rx_desc(struct mlx4_en_priv *priv,
 
 static inline bool mlx4_en_is_ring_empty(struct mlx4_en_rx_ring *ring)
 {
-        BUG_ON((u32)(ring->prod - ring->cons) > ring->actual_size);
         return ring->prod == ring->cons;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index aae13adfb492..8e81e53c370e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -601,7 +601,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
                                                         continue;
                                                 mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN to slave: %d, port:%d\n",
                                                          __func__, i, port);
-                                                s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
+                                                s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
                                                 if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
                                                         eqe->event.port_change.port =
                                                                 cpu_to_be32(
@@ -640,7 +640,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
                                                         continue;
                                                 if (i == mlx4_master_func_num(dev))
                                                         continue;
-                                                s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
+                                                s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
                                                 if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
                                                         eqe->event.port_change.port =
                                                                 cpu_to_be32(
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 12fbfcb44d8a..29c2a017a450 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2273,6 +2273,11 @@ static int mlx4_allocate_default_counters(struct mlx4_dev *dev)
                 } else if (err == -ENOENT) {
                         err = 0;
                         continue;
+                } else if (mlx4_is_slave(dev) && err == -EINVAL) {
+                        priv->def_counter[port] = MLX4_SINK_COUNTER_INDEX(dev);
+                        mlx4_warn(dev, "can't allocate counter from old PF driver, using index %d\n",
+                                  MLX4_SINK_COUNTER_INDEX(dev));
+                        err = 0;
                 } else {
                         mlx4_err(dev, "%s: failed to allocate default counter port %d err %d\n",
                                  __func__, port + 1, err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index afad529838de..06e3e1e54c35 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -391,6 +391,8 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         /* disable cmdif checksum */
         MLX5_SET(cmd_hca_cap, set_hca_cap, cmdif_checksum, 0);
 
+        MLX5_SET(cmd_hca_cap, set_hca_cap, log_uar_page_sz, PAGE_SHIFT - 12);
+
         err = set_caps(dev, set_ctx, set_sz);
 
 query_ex:
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 33669c29b341..753ea8bad953 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -1415,7 +1415,7 @@ static int qlcnic_83xx_copy_fw_file(struct qlcnic_adapter *adapter)
         if (fw->size & 0xF) {
                 addr = dest + size;
                 for (i = 0; i < (fw->size & 0xF); i++)
-                        data[i] = temp[size + i];
+                        data[i] = ((u8 *)temp)[size + i];
                 for (; i < 16; i++)
                         data[i] = 0;
                 ret = qlcnic_ms_mem_write128(adapter, addr,
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 3df51faf18ae..f790f61ea78a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4875,10 +4875,12 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
         case RTL_GIGA_MAC_VER_46:
         case RTL_GIGA_MAC_VER_47:
         case RTL_GIGA_MAC_VER_48:
+                RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF);
+                break;
         case RTL_GIGA_MAC_VER_49:
         case RTL_GIGA_MAC_VER_50:
         case RTL_GIGA_MAC_VER_51:
-                RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF);
+                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
                 break;
         default:
                 RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
index 2d8578cade03..2e7f9a2834be 100644
--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -4821,6 +4821,7 @@ static void rocker_remove_ports(const struct rocker *rocker)
                 rocker_port_ig_tbl(rocker_port, SWITCHDEV_TRANS_NONE,
                                    ROCKER_OP_FLAG_REMOVE);
                 unregister_netdev(rocker_port->dev);
+                free_netdev(rocker_port->dev);
         }
         kfree(rocker->ports);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 7e3129e7f143..f0e4bb4e3ec5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -42,7 +42,7 @@
 #define NSS_COMMON_CLK_DIV_MASK                 0x7f
 
 #define NSS_COMMON_CLK_SRC_CTRL                 0x14
-#define NSS_COMMON_CLK_SRC_CTRL_OFFSET(x)       (1 << x)
+#define NSS_COMMON_CLK_SRC_CTRL_OFFSET(x)       (x)
 /* Mode is coded on 1 bit but is different depending on the MAC ID:
  * MAC0: QSGMII=0 RGMII=1
  * MAC1: QSGMII=0 SGMII=0 RGMII=1
@@ -291,7 +291,7 @@ static void *ipq806x_gmac_setup(struct platform_device *pdev)
 
         /* Configure the clock src according to the mode */
         regmap_read(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, &val);
-        val &= ~NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id);
+        val &= ~(1 << NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id));
         switch (gmac->phy_mode) {
         case PHY_INTERFACE_MODE_RGMII:
                 val |= NSS_COMMON_CLK_SRC_CTRL_RGMII(gmac->id) <<
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index f3918c7e7eeb..bcdc8955c719 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -413,3 +413,7 @@ static int stmmac_pltfr_resume(struct device *dev)
 SIMPLE_DEV_PM_OPS(stmmac_pltfr_pm_ops, stmmac_pltfr_suspend,
                                        stmmac_pltfr_resume);
 EXPORT_SYMBOL_GPL(stmmac_pltfr_pm_ops);
+
+MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet platform support");
+MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 0c5842aeb807..ab6051a43134 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -6658,10 +6658,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb,
                 struct sk_buff *skb_new;
 
                 skb_new = skb_realloc_headroom(skb, len);
-                if (!skb_new) {
-                        rp->tx_errors++;
+                if (!skb_new)
                         goto out_drop;
-                }
                 kfree_skb(skb);
                 skb = skb_new;
         } else
diff --git a/drivers/net/ethernet/ti/netcp.h b/drivers/net/ethernet/ti/netcp.h
index bbacf5cccec2..bb1bb72121c0 100644
--- a/drivers/net/ethernet/ti/netcp.h
+++ b/drivers/net/ethernet/ti/netcp.h
@@ -85,7 +85,6 @@ struct netcp_intf {
         struct list_head        rxhook_list_head;
         unsigned int            rx_queue_id;
         void                    *rx_fdq[KNAV_DMA_FDQ_PER_CHAN];
-        u32                     rx_buffer_sizes[KNAV_DMA_FDQ_PER_CHAN];
         struct napi_struct      rx_napi;
         struct napi_struct      tx_napi;
 
@@ -223,6 +222,7 @@ void *netcp_device_find_module(struct netcp_device *netcp_device,
 
 /* SGMII functions */
 int netcp_sgmii_reset(void __iomem *sgmii_ofs, int port);
+bool netcp_sgmii_rtreset(void __iomem *sgmii_ofs, int port, bool set);
 int netcp_sgmii_get_port_link(void __iomem *sgmii_ofs, int port);
 int netcp_sgmii_config(void __iomem *sgmii_ofs, int port, u32 interface);
 
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index ec8ed30196f3..4755838c6137 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -34,6 +34,7 @@
 #define NETCP_SOP_OFFSET        (NET_IP_ALIGN + NET_SKB_PAD)
 #define NETCP_NAPI_WEIGHT       64
 #define NETCP_TX_TIMEOUT        (5 * HZ)
+#define NETCP_PACKET_SIZE       (ETH_FRAME_LEN + ETH_FCS_LEN)
 #define NETCP_MIN_PACKET_SIZE   ETH_ZLEN
 #define NETCP_MAX_MCAST_ADDR    16
 
@@ -804,30 +805,28 @@ static void netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
         if (likely(fdq == 0)) {
                 unsigned int primary_buf_len;
                 /* Allocate a primary receive queue entry */
-                buf_len = netcp->rx_buffer_sizes[0] + NETCP_SOP_OFFSET;
+                buf_len = NETCP_PACKET_SIZE + NETCP_SOP_OFFSET;
                 primary_buf_len = SKB_DATA_ALIGN(buf_len) +
                                 SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
-                if (primary_buf_len <= PAGE_SIZE) {
-                        bufptr = netdev_alloc_frag(primary_buf_len);
-                        pad[1] = primary_buf_len;
-                } else {
-                        bufptr = kmalloc(primary_buf_len, GFP_ATOMIC |
-                                         GFP_DMA32 | __GFP_COLD);
-                        pad[1] = 0;
-                }
+                bufptr = netdev_alloc_frag(primary_buf_len);
+                pad[1] = primary_buf_len;
 
                 if (unlikely(!bufptr)) {
-                        dev_warn_ratelimited(netcp->ndev_dev, "Primary RX buffer alloc failed\n");
+                        dev_warn_ratelimited(netcp->ndev_dev,
+                                             "Primary RX buffer alloc failed\n");
                         goto fail;
                 }
                 dma = dma_map_single(netcp->dev, bufptr, buf_len,
                                      DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(netcp->dev, dma)))
+                        goto fail;
+
                 pad[0] = (u32)bufptr;
 
         } else {
                 /* Allocate a secondary receive queue entry */
-                page = alloc_page(GFP_ATOMIC | GFP_DMA32 | __GFP_COLD);
+                page = alloc_page(GFP_ATOMIC | GFP_DMA | __GFP_COLD);
                 if (unlikely(!page)) {
                         dev_warn_ratelimited(netcp->ndev_dev, "Secondary page alloc failed\n");
                         goto fail;
@@ -1010,7 +1009,7 @@ netcp_tx_map_skb(struct sk_buff *skb, struct netcp_intf *netcp)
 
         /* Map the linear buffer */
         dma_addr = dma_map_single(dev, skb->data, pkt_len, DMA_TO_DEVICE);
-        if (unlikely(!dma_addr)) {
+        if (unlikely(dma_mapping_error(dev, dma_addr))) {
                 dev_err(netcp->ndev_dev, "Failed to map skb buffer\n");
                 return NULL;
         }
@@ -1546,8 +1545,8 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
         knav_queue_disable_notify(netcp->rx_queue);
 
         /* open Rx FDQs */
-        for (i = 0; i < KNAV_DMA_FDQ_PER_CHAN &&
-             netcp->rx_queue_depths[i] && netcp->rx_buffer_sizes[i]; ++i) {
+        for (i = 0; i < KNAV_DMA_FDQ_PER_CHAN && netcp->rx_queue_depths[i];
+             ++i) {
                 snprintf(name, sizeof(name), "rx-fdq-%s-%d", ndev->name, i);
                 netcp->rx_fdq[i] = knav_queue_open(name, KNAV_QUEUE_GP, 0);
                 if (IS_ERR_OR_NULL(netcp->rx_fdq[i])) {
@@ -1941,14 +1940,6 @@ static int netcp_create_interface(struct netcp_device *netcp_device,
                 netcp->rx_queue_depths[0] = 128;
         }
 
-        ret = of_property_read_u32_array(node_interface, "rx-buffer-size",
-                                         netcp->rx_buffer_sizes,
-                                         KNAV_DMA_FDQ_PER_CHAN);
-        if (ret) {
-                dev_err(dev, "missing \"rx-buffer-size\" parameter\n");
-                netcp->rx_buffer_sizes[0] = 1536;
-        }
-
         ret = of_property_read_u32_array(node_interface, "rx-pool", temp, 2);
         if (ret < 0) {
                 dev_err(dev, "missing \"rx-pool\" parameter\n");
@@ -2112,6 +2103,7 @@ probe_quit:
 static int netcp_remove(struct platform_device *pdev)
 {
         struct netcp_device *netcp_device = platform_get_drvdata(pdev);
+        struct netcp_intf *netcp_intf, *netcp_tmp;
         struct netcp_inst_modpriv *inst_modpriv, *tmp;
         struct netcp_module *module;
 
@@ -2123,10 +2115,17 @@ static int netcp_remove(struct platform_device *pdev)
                 list_del(&inst_modpriv->inst_list);
                 kfree(inst_modpriv);
         }
-        WARN(!list_empty(&netcp_device->interface_head), "%s interface list not empty!\n",
-             pdev->name);
 
-        devm_kfree(&pdev->dev, netcp_device);
+        /* now that all modules are removed, clean up the interfaces */
+        list_for_each_entry_safe(netcp_intf, netcp_tmp,
+                                 &netcp_device->interface_head,
+                                 interface_list) {
+                netcp_delete_interface(netcp_device, netcp_intf->ndev);
+        }
+
+        WARN(!list_empty(&netcp_device->interface_head),
+             "%s interface list not empty!\n", pdev->name);
+
         pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
         platform_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 9b7e0a34c98b..1974a8ae764a 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -1901,11 +1901,28 @@ static void gbe_port_config(struct gbe_priv *gbe_dev, struct gbe_slave *slave,
         writel(slave->mac_control, GBE_REG_ADDR(slave, emac_regs, mac_control));
 }
 
+static void gbe_sgmii_rtreset(struct gbe_priv *priv,
+                              struct gbe_slave *slave, bool set)
+{
+        void __iomem *sgmii_port_regs;
+
+        if (SLAVE_LINK_IS_XGMII(slave))
+                return;
+
+        if ((priv->ss_version == GBE_SS_VERSION_14) && (slave->slave_num >= 2))
+                sgmii_port_regs = priv->sgmii_port34_regs;
+        else
+                sgmii_port_regs = priv->sgmii_port_regs;
+
+        netcp_sgmii_rtreset(sgmii_port_regs, slave->slave_num, set);
+}
+
 static void gbe_slave_stop(struct gbe_intf *intf)
 {
         struct gbe_priv *gbe_dev = intf->gbe_dev;
         struct gbe_slave *slave = intf->slave;
 
+        gbe_sgmii_rtreset(gbe_dev, slave, true);
         gbe_port_reset(slave);
         /* Disable forwarding */
         cpsw_ale_control_set(gbe_dev->ale, slave->port_num,
@@ -1947,6 +1964,7 @@ static int gbe_slave_open(struct gbe_intf *gbe_intf)
 
         gbe_sgmii_config(priv, slave);
         gbe_port_reset(slave);
+        gbe_sgmii_rtreset(priv, slave, false);
         gbe_port_config(priv, slave, priv->rx_packet_max);
         gbe_set_slave_mac(slave, gbe_intf);
         /* enable forwarding */
@@ -2490,10 +2508,9 @@ static void free_secondary_ports(struct gbe_priv *gbe_dev)
 {
         struct gbe_slave *slave;
 
-        for (;;) {
+        while (!list_empty(&gbe_dev->secondary_slaves)) {
                 slave = first_sec_slave(gbe_dev);
-                if (!slave)
-                        break;
+
                 if (slave->phy)
                         phy_disconnect(slave->phy);
                 list_del(&slave->slave_list);
@@ -2839,14 +2856,13 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
                                       &gbe_dev->dma_chan_name);
         if (ret < 0) {
                 dev_err(dev, "missing \"tx-channel\" parameter\n");
-                ret = -ENODEV;
-                goto quit;
+                return -EINVAL;
         }
 
         if (!strcmp(node->name, "gbe")) {
                 ret = get_gbe_resource_version(gbe_dev, node);
                 if (ret)
-                        goto quit;
+                        return ret;
 
                 dev_dbg(dev, "ss_version: 0x%08x\n", gbe_dev->ss_version);
 
@@ -2857,22 +2873,20 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
                 else
                         ret = -ENODEV;
 
-                if (ret)
-                        goto quit;
         } else if (!strcmp(node->name, "xgbe")) {
                 ret = set_xgbe_ethss10_priv(gbe_dev, node);
                 if (ret)
-                        goto quit;
+                        return ret;
                 ret = netcp_xgbe_serdes_init(gbe_dev->xgbe_serdes_regs,
                                              gbe_dev->ss_regs);
-                if (ret)
-                        goto quit;
         } else {
                 dev_err(dev, "unknown GBE node(%s)\n", node->name);
                 ret = -ENODEV;
-                goto quit;
         }
 
+        if (ret)
+                return ret;
+
         interfaces = of_get_child_by_name(node, "interfaces");
         if (!interfaces)
                 dev_err(dev, "could not find interfaces\n");
@@ -2880,11 +2894,11 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
         ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device,
                                 gbe_dev->dma_chan_name, gbe_dev->tx_queue_id);
         if (ret)
-                goto quit;
+                return ret;
 
         ret = netcp_txpipe_open(&gbe_dev->tx_pipe);
         if (ret)
-                goto quit;
+                return ret;
 
         /* Create network interfaces */
         INIT_LIST_HEAD(&gbe_dev->gbe_intf_head);
@@ -2899,6 +2913,7 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
                 if (gbe_dev->num_slaves >= gbe_dev->max_num_slaves)
                         break;
         }
+        of_node_put(interfaces);
 
         if (!gbe_dev->num_slaves)
                 dev_warn(dev, "No network interface configured\n");
@@ -2911,9 +2926,10 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
         of_node_put(secondary_ports);
 
         if (!gbe_dev->num_slaves) {
-                dev_err(dev, "No network interface or secondary ports configured\n");
+                dev_err(dev,
+                        "No network interface or secondary ports configured\n");
                 ret = -ENODEV;
-                goto quit;
+                goto free_sec_ports;
         }
 
         memset(&ale_params, 0, sizeof(ale_params));
@@ -2927,7 +2943,7 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
         if (!gbe_dev->ale) {
                 dev_err(gbe_dev->dev, "error initializing ale engine\n");
                 ret = -ENODEV;
-                goto quit;
+                goto free_sec_ports;
         } else {
                 dev_dbg(gbe_dev->dev, "Created a gbe ale engine\n");
         }
@@ -2943,14 +2959,8 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
         *inst_priv = gbe_dev;
         return 0;
 
-quit:
-        if (gbe_dev->hw_stats)
-                devm_kfree(dev, gbe_dev->hw_stats);
-        cpsw_ale_destroy(gbe_dev->ale);
-        if (gbe_dev->ss_regs)
-                devm_iounmap(dev, gbe_dev->ss_regs);
-        of_node_put(interfaces);
-        devm_kfree(dev, gbe_dev);
+free_sec_ports:
+        free_secondary_ports(gbe_dev);
         return ret;
 }
 
@@ -3023,12 +3033,9 @@ static int gbe_remove(struct netcp_device *netcp_device, void *inst_priv)
         free_secondary_ports(gbe_dev);
 
         if (!list_empty(&gbe_dev->gbe_intf_head))
-                dev_alert(gbe_dev->dev, "unreleased ethss interfaces present\n");
+                dev_alert(gbe_dev->dev,
+                          "unreleased ethss interfaces present\n");
 
-        devm_kfree(gbe_dev->dev, gbe_dev->hw_stats);
-        devm_iounmap(gbe_dev->dev, gbe_dev->ss_regs);
-        memset(gbe_dev, 0x00, sizeof(*gbe_dev));
-        devm_kfree(gbe_dev->dev, gbe_dev);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/ti/netcp_sgmii.c b/drivers/net/ethernet/ti/netcp_sgmii.c
index dbeb14266e2f..5d8419f658d0 100644
--- a/drivers/net/ethernet/ti/netcp_sgmii.c
+++ b/drivers/net/ethernet/ti/netcp_sgmii.c
@@ -18,6 +18,9 @@
 
 #include "netcp.h"
 
+#define SGMII_SRESET_RESET              BIT(0)
+#define SGMII_SRESET_RTRESET            BIT(1)
+
 #define SGMII_REG_STATUS_LOCK           BIT(4)
 #define SGMII_REG_STATUS_LINK           BIT(0)
 #define SGMII_REG_STATUS_AUTONEG        BIT(2)
@@ -51,12 +54,35 @@ static void sgmii_write_reg_bit(void __iomem *base, int reg, u32 val)
 int netcp_sgmii_reset(void __iomem *sgmii_ofs, int port)
 {
         /* Soft reset */
-        sgmii_write_reg_bit(sgmii_ofs, SGMII_SRESET_REG(port), 0x1);
-        while (sgmii_read_reg(sgmii_ofs, SGMII_SRESET_REG(port)) != 0x0)
+        sgmii_write_reg_bit(sgmii_ofs, SGMII_SRESET_REG(port),
+                            SGMII_SRESET_RESET);
+
+        while ((sgmii_read_reg(sgmii_ofs, SGMII_SRESET_REG(port)) &
+                SGMII_SRESET_RESET) != 0x0)
                 ;
+
         return 0;
 }
 
+/* port is 0 based */
+bool netcp_sgmii_rtreset(void __iomem *sgmii_ofs, int port, bool set)
+{
+        u32 reg;
+        bool oldval;
+
+        /* Initiate a soft reset */
+        reg = sgmii_read_reg(sgmii_ofs, SGMII_SRESET_REG(port));
+        oldval = (reg & SGMII_SRESET_RTRESET) != 0x0;
+        if (set)
+                reg |= SGMII_SRESET_RTRESET;
+        else
+                reg &= ~SGMII_SRESET_RTRESET;
+        sgmii_write_reg(sgmii_ofs, SGMII_SRESET_REG(port), reg);
+        wmb();
+
+        return oldval;
+}
+
 int netcp_sgmii_get_port_link(void __iomem *sgmii_ofs, int port)
 {
         u32 status = 0, link = 0;
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 2ffbf13471d0..216bfd350169 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -728,11 +728,12 @@ static int mkiss_open(struct tty_struct *tty)
         dev->type = ARPHRD_AX25;
 
         /* Perform the low-level AX25 initialization. */
-        if ((err = ax_open(ax->dev))) {
+        err = ax_open(ax->dev);
+        if (err)
                 goto out_free_netdev;
-        }
 
-        if (register_netdev(dev))
+        err = register_netdev(dev);
+        if (err)
                 goto out_free_buffers;
 
         /* after register_netdev() - because else printk smashes the kernel */
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 3b933bb5a8d5..edd77342773a 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -719,6 +719,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
         struct virtio_net_hdr vnet_hdr = { 0 };
         int vnet_hdr_len = 0;
         int copylen = 0;
+        int depth;
         bool zerocopy = false;
         size_t linear;
         ssize_t n;
@@ -804,6 +805,12 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 
         skb_probe_transport_header(skb, ETH_HLEN);
 
+        /* Move network header to the right position for VLAN tagged packets */
+        if ((skb->protocol == htons(ETH_P_8021Q) ||
+             skb->protocol == htons(ETH_P_8021AD)) &&
+            __vlan_get_protocol(skb, skb->protocol, &depth) != 0)
+                skb_set_network_header(skb, depth);
+
         rcu_read_lock();
         vlan = rcu_dereference(q->vlan);
         /* copy skb_ubuf_info for callback when skb has no error */
diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
index 3cc316cb7e6b..d8757bf9ad75 100644
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -102,6 +102,12 @@ static void ntb_netdev_rx_handler(struct ntb_transport_qp *qp, void *qp_data,
 
         netdev_dbg(ndev, "%s: %d byte payload received\n", __func__, len);
 
+        if (len < 0) {
+                ndev->stats.rx_errors++;
+                ndev->stats.rx_length_errors++;
+                goto enqueue_again;
+        }
+
         skb_put(skb, len);
         skb->protocol = eth_type_trans(skb, ndev);
         skb->ip_summed = CHECKSUM_NONE;
@@ -121,6 +127,7 @@ static void ntb_netdev_rx_handler(struct ntb_transport_qp *qp, void *qp_data,
                 return;
         }
 
+enqueue_again:
         rc = ntb_transport_rx_enqueue(qp, skb, skb->data, ndev->mtu + ETH_HLEN);
         if (rc) {
                 dev_kfree_skb(skb);
@@ -184,7 +191,7 @@ static int ntb_netdev_open(struct net_device *ndev)
 
                 rc = ntb_transport_rx_enqueue(dev->qp, skb, skb->data,
                                               ndev->mtu + ETH_HLEN);
-                if (rc == -EINVAL) {
+                if (rc) {
                         dev_kfree_skb(skb);
                         goto err;
                 }
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 7f6419ebb5e1..ad8cbc6c9ee7 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -27,7 +27,7 @@
 #include <linux/usb/cdc.h>
 
 /* Version Information */
-#define DRIVER_VERSION "v1.08.0 (2015/01/13)"
+#define DRIVER_VERSION "v1.08.1 (2015/07/28)"
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
 #define DRIVER_DESC "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters"
 #define MODULENAME "r8152"
@@ -1902,11 +1902,10 @@ static void rtl_drop_queued_tx(struct r8152 *tp)
 static void rtl8152_tx_timeout(struct net_device *netdev)
 {
         struct r8152 *tp = netdev_priv(netdev);
-        int i;
 
         netif_warn(tp, tx_err, netdev, "Tx timeout\n");
-        for (i = 0; i < RTL8152_MAX_TX; i++)
-                usb_unlink_urb(tp->tx_info[i].urb);
+
+        usb_queue_reset_device(tp->intf);
 }
 
 static void rtl8152_set_rx_mode(struct net_device *netdev)
@@ -2075,7 +2074,6 @@ static int rtl_start_rx(struct r8152 *tp)
 {
         int i, ret = 0;
 
-        napi_disable(&tp->napi);
         INIT_LIST_HEAD(&tp->rx_done);
         for (i = 0; i < RTL8152_MAX_RX; i++) {
                 INIT_LIST_HEAD(&tp->rx_info[i].list);
@@ -2083,7 +2081,6 @@ static int rtl_start_rx(struct r8152 *tp)
                 if (ret)
                         break;
         }
-        napi_enable(&tp->napi);
 
         if (ret && ++i < RTL8152_MAX_RX) {
                 struct list_head rx_queue;
@@ -2166,6 +2163,7 @@ static int rtl8153_enable(struct r8152 *tp)
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return -ENODEV;
 
+        usb_disable_lpm(tp->udev);
         set_tx_qlen(tp);
         rtl_set_eee_plus(tp);
         r8153_set_rx_early_timeout(tp);
@@ -2337,11 +2335,61 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)
                 device_set_wakeup_enable(&tp->udev->dev, false);
 }
 
+static void r8153_u1u2en(struct r8152 *tp, bool enable)
+{
+        u8 u1u2[8];
+
+        if (enable)
+                memset(u1u2, 0xff, sizeof(u1u2));
+        else
+                memset(u1u2, 0x00, sizeof(u1u2));
+
+        usb_ocp_write(tp, USB_TOLERANCE, BYTE_EN_SIX_BYTES, sizeof(u1u2), u1u2);
+}
+
+static void r8153_u2p3en(struct r8152 *tp, bool enable)
+{
+        u32 ocp_data;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_U2P3_CTRL);
+        if (enable && tp->version != RTL_VER_03 && tp->version != RTL_VER_04)
+                ocp_data |= U2P3_ENABLE;
+        else
+                ocp_data &= ~U2P3_ENABLE;
+        ocp_write_word(tp, MCU_TYPE_USB, USB_U2P3_CTRL, ocp_data);
+}
+
+static void r8153_power_cut_en(struct r8152 *tp, bool enable)
+{
+        u32 ocp_data;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_POWER_CUT);
+        if (enable)
+                ocp_data |= PWR_EN | PHASE2_EN;
+        else
+                ocp_data &= ~(PWR_EN | PHASE2_EN);
+        ocp_write_word(tp, MCU_TYPE_USB, USB_POWER_CUT, ocp_data);
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_MISC_0);
+        ocp_data &= ~PCUT_STATUS;
+        ocp_write_word(tp, MCU_TYPE_USB, USB_MISC_0, ocp_data);
+}
+
+static bool rtl_can_wakeup(struct r8152 *tp)
+{
+        struct usb_device *udev = tp->udev;
+
+        return (udev->actconfig->desc.bmAttributes & USB_CONFIG_ATT_WAKEUP);
+}
+
 static void rtl_runtime_suspend_enable(struct r8152 *tp, bool enable)
 {
         if (enable) {
                 u32 ocp_data;
 
+                r8153_u1u2en(tp, false);
+                r8153_u2p3en(tp, false);
+
                 __rtl_set_wol(tp, WAKE_ANY);
 
                 ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CRWECR, CRWECR_CONFIG);
@@ -2353,6 +2401,8 @@ static void rtl_runtime_suspend_enable(struct r8152 *tp, bool enable)
                 ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CRWECR, CRWECR_NORAML);
         } else {
                 __rtl_set_wol(tp, tp->saved_wolopts);
+                r8153_u2p3en(tp, true);
+                r8153_u1u2en(tp, true);
         }
 }
 
@@ -2599,46 +2649,6 @@ static void r8153_hw_phy_cfg(struct r8152 *tp)
         set_bit(PHY_RESET, &tp->flags);
 }
 
-static void r8153_u1u2en(struct r8152 *tp, bool enable)
-{
-        u8 u1u2[8];
-
-        if (enable)
-                memset(u1u2, 0xff, sizeof(u1u2));
-        else
-                memset(u1u2, 0x00, sizeof(u1u2));
-
-        usb_ocp_write(tp, USB_TOLERANCE, BYTE_EN_SIX_BYTES, sizeof(u1u2), u1u2);
-}
-
-static void r8153_u2p3en(struct r8152 *tp, bool enable)
-{
-        u32 ocp_data;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_U2P3_CTRL);
-        if (enable)
-                ocp_data |= U2P3_ENABLE;
-        else
-                ocp_data &= ~U2P3_ENABLE;
-        ocp_write_word(tp, MCU_TYPE_USB, USB_U2P3_CTRL, ocp_data);
-}
-
-static void r8153_power_cut_en(struct r8152 *tp, bool enable)
-{
-        u32 ocp_data;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_POWER_CUT);
-        if (enable)
-                ocp_data |= PWR_EN | PHASE2_EN;
-        else
-                ocp_data &= ~(PWR_EN | PHASE2_EN);
-        ocp_write_word(tp, MCU_TYPE_USB, USB_POWER_CUT, ocp_data);
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_MISC_0);
-        ocp_data &= ~PCUT_STATUS;
-        ocp_write_word(tp, MCU_TYPE_USB, USB_MISC_0, ocp_data);
-}
-
 static void r8153_first_init(struct r8152 *tp)
 {
         u32 ocp_data;
@@ -2781,6 +2791,7 @@ static void rtl8153_disable(struct r8152 *tp)
         r8153_disable_aldps(tp);
         rtl_disable(tp);
         r8153_enable_aldps(tp);
+        usb_enable_lpm(tp->udev);
 }
 
 static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u16 speed, u8 duplex)
@@ -2901,9 +2912,13 @@ static void rtl8153_up(struct r8152 *tp)
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
+        r8153_u1u2en(tp, false);
         r8153_disable_aldps(tp);
         r8153_first_init(tp);
         r8153_enable_aldps(tp);
+        r8153_u2p3en(tp, true);
+        r8153_u1u2en(tp, true);
+        usb_enable_lpm(tp->udev);
 }
 
 static void rtl8153_down(struct r8152 *tp)
@@ -2914,6 +2929,7 @@ static void rtl8153_down(struct r8152 *tp)
         }
 
         r8153_u1u2en(tp, false);
+        r8153_u2p3en(tp, false);
         r8153_power_cut_en(tp, false);
         r8153_disable_aldps(tp);
         r8153_enter_oob(tp);
@@ -2932,8 +2948,10 @@ static void set_carrier(struct r8152 *tp)
                 if (!netif_carrier_ok(netdev)) {
                         tp->rtl_ops.enable(tp);
                         set_bit(RTL8152_SET_RX_MODE, &tp->flags);
+                        napi_disable(&tp->napi);
                         netif_carrier_on(netdev);
                         rtl_start_rx(tp);
+                        napi_enable(&tp->napi);
                 }
         } else {
                 if (netif_carrier_ok(netdev)) {
@@ -3252,6 +3270,7 @@ static void r8153_init(struct r8152 *tp)
                 msleep(20);
         }
 
+        usb_disable_lpm(tp->udev);
         r8153_u2p3en(tp, false);
 
         if (tp->version == RTL_VER_04) {
@@ -3319,6 +3338,59 @@ static void r8153_init(struct r8152 *tp)
         r8153_enable_aldps(tp);
         r8152b_enable_fc(tp);
         rtl_tally_reset(tp);
+        r8153_u2p3en(tp, true);
+}
+
+static int rtl8152_pre_reset(struct usb_interface *intf)
+{
+        struct r8152 *tp = usb_get_intfdata(intf);
+        struct net_device *netdev;
+
+        if (!tp)
+                return 0;
+
+        netdev = tp->netdev;
+        if (!netif_running(netdev))
+                return 0;
+
+        napi_disable(&tp->napi);
+        clear_bit(WORK_ENABLE, &tp->flags);
+        usb_kill_urb(tp->intr_urb);
+        cancel_delayed_work_sync(&tp->schedule);
+        if (netif_carrier_ok(netdev)) {
+                netif_stop_queue(netdev);
+                mutex_lock(&tp->control);
+                tp->rtl_ops.disable(tp);
+                mutex_unlock(&tp->control);
+        }
+
+        return 0;
+}
+
+static int rtl8152_post_reset(struct usb_interface *intf)
+{
+        struct r8152 *tp = usb_get_intfdata(intf);
+        struct net_device *netdev;
+
+        if (!tp)
+                return 0;
+
+        netdev = tp->netdev;
+        if (!netif_running(netdev))
+                return 0;
+
+        set_bit(WORK_ENABLE, &tp->flags);
+        if (netif_carrier_ok(netdev)) {
+                mutex_lock(&tp->control);
+                tp->rtl_ops.enable(tp);
+                rtl8152_set_rx_mode(netdev);
+                mutex_unlock(&tp->control);
+                netif_wake_queue(netdev);
+        }
+
+        napi_enable(&tp->napi);
+
+        return 0;
 }
 
 static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
@@ -3374,9 +3446,11 @@ static int rtl8152_resume(struct usb_interface *intf)
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
                         rtl_runtime_suspend_enable(tp, false);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+                        napi_disable(&tp->napi);
                         set_bit(WORK_ENABLE, &tp->flags);
                         if (netif_carrier_ok(tp->netdev))
                                 rtl_start_rx(tp);
+                        napi_enable(&tp->napi);
                 } else {
                         tp->rtl_ops.up(tp);
                         rtl8152_set_speed(tp, AUTONEG_ENABLE,
@@ -3403,12 +3477,15 @@ static void rtl8152_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         if (usb_autopm_get_interface(tp->intf) < 0)
                 return;
 
-        mutex_lock(&tp->control);
-
-        wol->supported = WAKE_ANY;
-        wol->wolopts = __rtl_get_wol(tp);
-
-        mutex_unlock(&tp->control);
+        if (!rtl_can_wakeup(tp)) {
+                wol->supported = 0;
+                wol->wolopts = 0;
+        } else {
+                mutex_lock(&tp->control);
+                wol->supported = WAKE_ANY;
+                wol->wolopts = __rtl_get_wol(tp);
+                mutex_unlock(&tp->control);
+        }
 
         usb_autopm_put_interface(tp->intf);
 }
@@ -3418,6 +3495,9 @@ static int rtl8152_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct r8152 *tp = netdev_priv(dev);
         int ret;
 
+        if (!rtl_can_wakeup(tp))
+                return -EOPNOTSUPP;
+
         ret = usb_autopm_get_interface(tp->intf);
         if (ret < 0)
                 goto out_set_wol;
@@ -4059,6 +4139,9 @@ static int rtl8152_probe(struct usb_interface *intf,
                 goto out1;
         }
 
+        if (!rtl_can_wakeup(tp))
+                __rtl_set_wol(tp, 0);
+
         tp->saved_wolopts = __rtl_get_wol(tp);
         if (tp->saved_wolopts)
                 device_set_wakeup_enable(&udev->dev, true);
@@ -4132,6 +4215,8 @@ static struct usb_driver rtl8152_driver = {
         .suspend =      rtl8152_suspend,
         .resume =       rtl8152_resume,
         .reset_resume = rtl8152_resume,
+        .pre_reset =    rtl8152_pre_reset,
+        .post_reset =   rtl8152_post_reset,
         .supports_autosuspend = 1,
         .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7fbca37a1adf..237f8e5e493d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1756,9 +1756,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* Do we support "hardware" checksums? */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
                 /* This opens up the world of extra features. */
-                dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
+                dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
                 if (csum)
-                        dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
+                        dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
 
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
                         dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 7193b7304fdd..848ea6a399f2 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -589,7 +589,8 @@ static int cosa_probe(int base, int irq, int dma)
                 chan->netdev->base_addr = chan->cosa->datareg;
                 chan->netdev->irq = chan->cosa->irq;
                 chan->netdev->dma = chan->cosa->dma;
-                if (register_hdlc_device(chan->netdev)) {
+                err = register_hdlc_device(chan->netdev);
+                if (err) {
                         netdev_warn(chan->netdev,
                                     "register_hdlc_device() failed\n");
                         free_netdev(chan->netdev);
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index 25d1cbd34306..b2f0d245bcf3 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -3728,7 +3728,7 @@ const u32 *b43_nphy_get_tx_gain_table(struct b43_wldev *dev)
                 switch (phy->rev) {
                 case 6:
                 case 5:
-                        if (sprom->fem.ghz5.extpa_gain == 3)
+                        if (sprom->fem.ghz2.extpa_gain == 3)
                                 return b43_ntab_tx_gain_epa_rev3_hi_pwr_2g;
                         /* fall through */
                 case 4:
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 5000bfcded61..5514ad6d4e54 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1023,7 +1023,7 @@ static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
         cmd->scan_priority =
                 iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_6);
 
-        if (iwl_mvm_scan_total_iterations(params) == 0)
+        if (iwl_mvm_scan_total_iterations(params) == 1)
                 cmd->ooc_priority =
                         iwl_mvm_scan_priority(mvm, IWL_SCAN_PRIORITY_EXT_6);
         else
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 6203c4ad9bba..9e144e71da0b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -478,10 +478,16 @@ static void iwl_pcie_apm_stop(struct iwl_trans *trans, bool op_mode_leave)
                 if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000)
                         iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
                                           APMG_PCIDEV_STT_VAL_WAKE_ME);
-                else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
+                        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                                    CSR_RESET_LINK_PWR_MGMT_DISABLED);
                         iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
                                     CSR_HW_IF_CONFIG_REG_PREPARE |
                                     CSR_HW_IF_CONFIG_REG_ENABLE_PME);
+                        mdelay(1);
+                        iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                                      CSR_RESET_LINK_PWR_MGMT_DISABLED);
+                }
                 mdelay(5);
         }
 
@@ -575,6 +581,10 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
         if (ret >= 0)
                 return 0;
 
+        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                    CSR_RESET_LINK_PWR_MGMT_DISABLED);
+        msleep(1);
+
         for (iter = 0; iter < 10; iter++) {
                 /* If HW is not ready, prepare the conditions to check again */
                 iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
@@ -582,8 +592,10 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
 
                 do {
                         ret = iwl_pcie_set_hw_ready(trans);
-                        if (ret >= 0)
-                                return 0;
+                        if (ret >= 0) {
+                                ret = 0;
+                                goto out;
+                        }
 
                         usleep_range(200, 1000);
                         t += 200;
@@ -593,6 +605,10 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
 
         IWL_ERR(trans, "Couldn't prepare the card\n");
 
+out:
+        iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                      CSR_RESET_LINK_PWR_MGMT_DISABLED);
+
         return ret;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 2b86c2135de3..607acb53c847 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1875,8 +1875,19 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
 
         /* start timer if queue currently empty */
         if (q->read_ptr == q->write_ptr) {
-                if (txq->wd_timeout)
-                        mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
+                if (txq->wd_timeout) {
+                        /*
+                         * If the TXQ is active, then set the timer, if not,
+                         * set the timer in remainder so that the timer will
+                         * be armed with the right value when the station will
+                         * wake up.
+                         */
+                        if (!txq->frozen)
+                                mod_timer(&txq->stuck_timer,
+                                          jiffies + txq->wd_timeout);
+                        else
+                                txq->frozen_expiry_remainder = txq->wd_timeout;
+                }
                 IWL_DEBUG_RPM(trans, "Q: %d first tx - take ref\n", q->id);
                 iwl_trans_pcie_ref(trans);
         }
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index b6cc9ff47fc2..1c6788aecc62 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -172,6 +172,7 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 (struct rsi_91x_sdiodev *)adapter->rsi_dev;
         u32 len;
         u32 num_blocks;
+        const u8 *fw;
         const struct firmware *fw_entry = NULL;
         u32 block_size = dev->tx_blk_size;
         int status = 0;
@@ -200,6 +201,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 return status;
         }
 
+        /* Copy firmware into DMA-accessible memory */
+        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+        if (!fw)
+                return -ENOMEM;
         len = fw_entry->size;
 
         if (len % 4)
@@ -210,7 +215,8 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
         rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);
         rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
 
-        status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks);
+        status = rsi_copy_to_card(common, fw, len, num_blocks);
+        kfree(fw);
         release_firmware(fw_entry);
         return status;
 }
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
index 1106ce76707e..30c2cf7fa93b 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c
@@ -146,7 +146,10 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 return status;
         }
 
+        /* Copy firmware into DMA-accessible memory */
         fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+        if (!fw)
+                return -ENOMEM;
         len = fw_entry->size;
 
         if (len % 4)
@@ -158,6 +161,7 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
         rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
 
         status = rsi_copy_to_card(common, fw, len, num_blocks);
+        kfree(fw);
         release_firmware(fw_entry);
         return status;
 }
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 3b3a88b53b11..585d0883c7e5 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct ieee80211_hw *hw,
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+        struct rtl_tcb_desc tcb_desc;
 
-        if (skb)
-                rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL);
+        if (skb) {
+                memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+                rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc);
+        }
 }
 
 static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index 1017f02d7bf7..7bf88d9dcdc3 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -385,6 +385,7 @@ module_param_named(debug, rtl8723be_mod_params.debug, int, 0444);
 module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
 module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
                    bool, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 1a83e190fc15..28577a31549d 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -61,6 +61,12 @@ void xenvif_skb_zerocopy_prepare(struct xenvif_queue *queue,
 void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
 {
         atomic_dec(&queue->inflight_packets);
+
+        /* Wake the dealloc thread _after_ decrementing inflight_packets so
+         * that if kthread_stop() has already been called, the dealloc thread
+         * does not wait forever with nothing to wake it.
+         */
+        wake_up(&queue->dealloc_wq);
 }
 
 int xenvif_schedulable(struct xenvif *vif)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 7d50711476fe..3f44b522b831 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -810,23 +810,17 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
 static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue,
                                                         struct sk_buff *skb,
                                                         struct xen_netif_tx_request *txp,
-                                                        struct gnttab_map_grant_ref *gop)
+                                                        struct gnttab_map_grant_ref *gop,
+                                                        unsigned int frag_overflow,
+                                                        struct sk_buff *nskb)
 {
         struct skb_shared_info *shinfo = skb_shinfo(skb);
         skb_frag_t *frags = shinfo->frags;
         u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
         int start;
         pending_ring_idx_t index;
-        unsigned int nr_slots, frag_overflow = 0;
+        unsigned int nr_slots;
 
-        /* At this point shinfo->nr_frags is in fact the number of
-         * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
-         */
-        if (shinfo->nr_frags > MAX_SKB_FRAGS) {
-                frag_overflow = shinfo->nr_frags - MAX_SKB_FRAGS;
-                BUG_ON(frag_overflow > MAX_SKB_FRAGS);
-                shinfo->nr_frags = MAX_SKB_FRAGS;
-        }
         nr_slots = shinfo->nr_frags;
 
         /* Skip first skb fragment if it is on same page as header fragment. */
@@ -841,13 +835,6 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *que
         }
 
         if (frag_overflow) {
-                struct sk_buff *nskb = xenvif_alloc_skb(0);
-                if (unlikely(nskb == NULL)) {
-                        if (net_ratelimit())
-                                netdev_err(queue->vif->dev,
-                                           "Can't allocate the frag_list skb.\n");
-                        return NULL;
-                }
 
                 shinfo = skb_shinfo(nskb);
                 frags = shinfo->frags;
@@ -1175,9 +1162,10 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                                      unsigned *copy_ops,
                                      unsigned *map_ops)
 {
-        struct gnttab_map_grant_ref *gop = queue->tx_map_ops, *request_gop;
-        struct sk_buff *skb;
+        struct gnttab_map_grant_ref *gop = queue->tx_map_ops;
+        struct sk_buff *skb, *nskb;
         int ret;
+        unsigned int frag_overflow;
 
         while (skb_queue_len(&queue->tx_queue) < budget) {
                 struct xen_netif_tx_request txreq;
@@ -1265,6 +1253,29 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                         break;
                 }
 
+                skb_shinfo(skb)->nr_frags = ret;
+                if (data_len < txreq.size)
+                        skb_shinfo(skb)->nr_frags++;
+                /* At this point shinfo->nr_frags is in fact the number of
+                 * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
+                 */
+                frag_overflow = 0;
+                nskb = NULL;
+                if (skb_shinfo(skb)->nr_frags > MAX_SKB_FRAGS) {
+                        frag_overflow = skb_shinfo(skb)->nr_frags - MAX_SKB_FRAGS;
+                        BUG_ON(frag_overflow > MAX_SKB_FRAGS);
+                        skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
+                        nskb = xenvif_alloc_skb(0);
+                        if (unlikely(nskb == NULL)) {
+                                kfree_skb(skb);
+                                xenvif_tx_err(queue, &txreq, idx);
+                                if (net_ratelimit())
+                                        netdev_err(queue->vif->dev,
+                                                   "Can't allocate the frag_list skb.\n");
+                                break;
+                        }
+                }
+
                 if (extras[XEN_NETIF_EXTRA_TYPE_GSO - 1].type) {
                         struct xen_netif_extra_info *gso;
                         gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
@@ -1272,6 +1283,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                         if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
                                 /* Failure in xenvif_set_skb_gso is fatal. */
                                 kfree_skb(skb);
+                                kfree_skb(nskb);
                                 break;
                         }
                 }
@@ -1294,9 +1306,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
                 (*copy_ops)++;
 
-                skb_shinfo(skb)->nr_frags = ret;
                 if (data_len < txreq.size) {
-                        skb_shinfo(skb)->nr_frags++;
                         frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
                                              pending_idx);
                         xenvif_tx_create_map_op(queue, pending_idx, &txreq, gop);
@@ -1310,13 +1320,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 
                 queue->pending_cons++;
 
-                request_gop = xenvif_get_requests(queue, skb, txfrags, gop);
-                if (request_gop == NULL) {
-                        kfree_skb(skb);
-                        xenvif_tx_err(queue, &txreq, idx);
-                        break;
-                }
-                gop = request_gop;
+                gop = xenvif_get_requests(queue, skb, txfrags, gop,
+                                          frag_overflow, nskb);
 
                 __skb_queue_tail(&queue->tx_queue, skb);
 
@@ -1536,7 +1541,6 @@ void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success)
                 smp_wmb();
                 queue->dealloc_prod++;
         } while (ubuf);
-        wake_up(&queue->dealloc_wq);
         spin_unlock_irqrestore(&queue->callback_lock, flags);
 
         if (likely(zerocopy_success))
diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c
index 23435f2a5486..2e2530743831 100644
--- a/drivers/ntb/ntb.c
+++ b/drivers/ntb/ntb.c
@@ -114,7 +114,7 @@ int ntb_register_device(struct ntb_dev *ntb)
         ntb->dev.bus = &ntb_bus;
         ntb->dev.parent = &ntb->pdev->dev;
         ntb->dev.release = ntb_dev_release;
-        dev_set_name(&ntb->dev, pci_name(ntb->pdev));
+        dev_set_name(&ntb->dev, "%s", pci_name(ntb->pdev));
 
         ntb->ctx = NULL;
         ntb->ctx_ops = NULL;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index efe3ad4122f2..1c6386d5f79c 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -142,10 +142,11 @@ struct ntb_transport_qp {
 
         void (*rx_handler)(struct ntb_transport_qp *qp, void *qp_data,
                            void *data, int len);
+        struct list_head rx_post_q;
         struct list_head rx_pend_q;
         struct list_head rx_free_q;
-        spinlock_t ntb_rx_pend_q_lock;
-        spinlock_t ntb_rx_free_q_lock;
+        /* ntb_rx_q_lock: synchronize access to rx_XXXX_q */
+        spinlock_t ntb_rx_q_lock;
         void *rx_buff;
         unsigned int rx_index;
         unsigned int rx_max_entry;
@@ -211,6 +212,8 @@ struct ntb_transport_ctx {
         bool link_is_up;
         struct delayed_work link_work;
         struct work_struct link_cleanup;
+
+        struct dentry *debugfs_node_dir;
 };
 
 enum {
@@ -436,13 +439,17 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         char *buf;
         ssize_t ret, out_offset, out_count;
 
+        qp = filp->private_data;
+
+        if (!qp || !qp->link_is_up)
+                return 0;
+
         out_count = 1000;
 
         buf = kmalloc(out_count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
-        qp = filp->private_data;
         out_offset = 0;
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "NTB QP stats\n");
@@ -534,6 +541,27 @@ out:
         return entry;
 }
 
+static struct ntb_queue_entry *ntb_list_mv(spinlock_t *lock,
+                                           struct list_head *list,
+                                           struct list_head *to_list)
+{
+        struct ntb_queue_entry *entry;
+        unsigned long flags;
+
+        spin_lock_irqsave(lock, flags);
+
+        if (list_empty(list)) {
+                entry = NULL;
+        } else {
+                entry = list_first_entry(list, struct ntb_queue_entry, entry);
+                list_move_tail(&entry->entry, to_list);
+        }
+
+        spin_unlock_irqrestore(lock, flags);
+
+        return entry;
+}
+
 static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
                                      unsigned int qp_num)
 {
@@ -601,13 +629,16 @@ static void ntb_free_mw(struct ntb_transport_ctx *nt, int num_mw)
 }
 
 static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
-                      unsigned int size)
+                      resource_size_t size)
 {
         struct ntb_transport_mw *mw = &nt->mw_vec[num_mw];
         struct pci_dev *pdev = nt->ndev->pdev;
-        unsigned int xlat_size, buff_size;
+        size_t xlat_size, buff_size;
         int rc;
 
+        if (!size)
+                return -EINVAL;
+
         xlat_size = round_up(size, mw->xlat_align_size);
         buff_size = round_up(size, mw->xlat_align);
 
@@ -627,7 +658,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
         if (!mw->virt_addr) {
                 mw->xlat_size = 0;
                 mw->buff_size = 0;
-                dev_err(&pdev->dev, "Unable to alloc MW buff of size %d\n",
+                dev_err(&pdev->dev, "Unable to alloc MW buff of size %zu\n",
                         buff_size);
                 return -ENOMEM;
         }
@@ -867,6 +898,8 @@ static void ntb_qp_link_work(struct work_struct *work)
 
                 if (qp->event_handler)
                         qp->event_handler(qp->cb_data, qp->link_is_up);
+
+                tasklet_schedule(&qp->rxc_db_work);
         } else if (nt->link_is_up)
                 schedule_delayed_work(&qp->link_work,
                                       msecs_to_jiffies(NTB_LINK_DOWN_TIMEOUT));
@@ -923,12 +956,12 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         qp->tx_max_frame = min(transport_mtu, tx_size / 2);
         qp->tx_max_entry = tx_size / qp->tx_max_frame;
 
-        if (nt_debugfs_dir) {
+        if (nt->debugfs_node_dir) {
                 char debugfs_name[4];
 
                 snprintf(debugfs_name, 4, "qp%d", qp_num);
                 qp->debugfs_dir = debugfs_create_dir(debugfs_name,
-                                                     nt_debugfs_dir);
+                                                     nt->debugfs_node_dir);
 
                 qp->debugfs_stats = debugfs_create_file("stats", S_IRUSR,
                                                         qp->debugfs_dir, qp,
@@ -941,10 +974,10 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         INIT_DELAYED_WORK(&qp->link_work, ntb_qp_link_work);
         INIT_WORK(&qp->link_cleanup, ntb_qp_link_cleanup_work);
 
-        spin_lock_init(&qp->ntb_rx_pend_q_lock);
-        spin_lock_init(&qp->ntb_rx_free_q_lock);
+        spin_lock_init(&qp->ntb_rx_q_lock);
         spin_lock_init(&qp->ntb_tx_free_q_lock);
 
+        INIT_LIST_HEAD(&qp->rx_post_q);
         INIT_LIST_HEAD(&qp->rx_pend_q);
         INIT_LIST_HEAD(&qp->rx_free_q);
         INIT_LIST_HEAD(&qp->tx_free_q);
@@ -1031,6 +1064,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
                 goto err2;
         }
 
+        if (nt_debugfs_dir) {
+                nt->debugfs_node_dir =
+                        debugfs_create_dir(pci_name(ndev->pdev),
+                                           nt_debugfs_dir);
+        }
+
         for (i = 0; i < qp_count; i++) {
                 rc = ntb_transport_init_queue(nt, i);
                 if (rc)
@@ -1107,22 +1146,47 @@ static void ntb_transport_free(struct ntb_client *self, struct ntb_dev *ndev)
         kfree(nt);
 }
 
-static void ntb_rx_copy_callback(void *data)
+static void ntb_complete_rxc(struct ntb_transport_qp *qp)
 {
-        struct ntb_queue_entry *entry = data;
-        struct ntb_transport_qp *qp = entry->qp;
-        void *cb_data = entry->cb_data;
-        unsigned int len = entry->len;
-        struct ntb_payload_header *hdr = entry->rx_hdr;
+        struct ntb_queue_entry *entry;
+        void *cb_data;
+        unsigned int len;
+        unsigned long irqflags;
+
+        spin_lock_irqsave(&qp->ntb_rx_q_lock, irqflags);
+
+        while (!list_empty(&qp->rx_post_q)) {
+                entry = list_first_entry(&qp->rx_post_q,
+                                         struct ntb_queue_entry, entry);
+                if (!(entry->flags & DESC_DONE_FLAG))
+                        break;
+
+                entry->rx_hdr->flags = 0;
+                iowrite32(entry->index, &qp->rx_info->entry);
 
-        hdr->flags = 0;
+                cb_data = entry->cb_data;
+                len = entry->len;
 
-        iowrite32(entry->index, &qp->rx_info->entry);
+                list_move_tail(&entry->entry, &qp->rx_free_q);
 
-        ntb_list_add(&qp->ntb_rx_free_q_lock, &entry->entry, &qp->rx_free_q);
+                spin_unlock_irqrestore(&qp->ntb_rx_q_lock, irqflags);
 
-        if (qp->rx_handler && qp->client_ready)
-                qp->rx_handler(qp, qp->cb_data, cb_data, len);
+                if (qp->rx_handler && qp->client_ready)
+                        qp->rx_handler(qp, qp->cb_data, cb_data, len);
+
+                spin_lock_irqsave(&qp->ntb_rx_q_lock, irqflags);
+        }
+
+        spin_unlock_irqrestore(&qp->ntb_rx_q_lock, irqflags);
+}
+
+static void ntb_rx_copy_callback(void *data)
+{
+        struct ntb_queue_entry *entry = data;
+
+        entry->flags |= DESC_DONE_FLAG;
+
+        ntb_complete_rxc(entry->qp);
 }
 
 static void ntb_memcpy_rx(struct ntb_queue_entry *entry, void *offset)
@@ -1138,19 +1202,18 @@ static void ntb_memcpy_rx(struct ntb_queue_entry *entry, void *offset)
         ntb_rx_copy_callback(entry);
 }
 
-static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset,
-                         size_t len)
+static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset)
 {
         struct dma_async_tx_descriptor *txd;
         struct ntb_transport_qp *qp = entry->qp;
         struct dma_chan *chan = qp->dma_chan;
         struct dma_device *device;
-        size_t pay_off, buff_off;
+        size_t pay_off, buff_off, len;
         struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         void *buf = entry->buf;
 
-        entry->len = len;
+        len = entry->len;
 
         if (!chan)
                 goto err;
@@ -1226,7 +1289,6 @@ static int ntb_process_rxc(struct ntb_transport_qp *qp)
         struct ntb_payload_header *hdr;
         struct ntb_queue_entry *entry;
         void *offset;
-        int rc;
 
         offset = qp->rx_buff + qp->rx_max_frame * qp->rx_index;
         hdr = offset + qp->rx_max_frame - sizeof(struct ntb_payload_header);
@@ -1255,65 +1317,43 @@ static int ntb_process_rxc(struct ntb_transport_qp *qp)
                 return -EIO;
         }
 
-        entry = ntb_list_rm(&qp->ntb_rx_pend_q_lock, &qp->rx_pend_q);
+        entry = ntb_list_mv(&qp->ntb_rx_q_lock, &qp->rx_pend_q, &qp->rx_post_q);
         if (!entry) {
                 dev_dbg(&qp->ndev->pdev->dev, "no receive buffer\n");
                 qp->rx_err_no_buf++;
-
-                rc = -ENOMEM;
-                goto err;
+                return -EAGAIN;
         }
 
+        entry->rx_hdr = hdr;
+        entry->index = qp->rx_index;
+
         if (hdr->len > entry->len) {
                 dev_dbg(&qp->ndev->pdev->dev,
                         "receive buffer overflow! Wanted %d got %d\n",
                         hdr->len, entry->len);
                 qp->rx_err_oflow++;
 
-                rc = -EIO;
-                goto err;
-        }
+                entry->len = -EIO;
+                entry->flags |= DESC_DONE_FLAG;
 
-        dev_dbg(&qp->ndev->pdev->dev,
-                "RX OK index %u ver %u size %d into buf size %d\n",
-                qp->rx_index, hdr->ver, hdr->len, entry->len);
+                ntb_complete_rxc(qp);
+        } else {
+                dev_dbg(&qp->ndev->pdev->dev,
+                        "RX OK index %u ver %u size %d into buf size %d\n",
+                        qp->rx_index, hdr->ver, hdr->len, entry->len);
 
-        qp->rx_bytes += hdr->len;
-        qp->rx_pkts++;
+                qp->rx_bytes += hdr->len;
+                qp->rx_pkts++;
 
-        entry->index = qp->rx_index;
-        entry->rx_hdr = hdr;
+                entry->len = hdr->len;
 
-        ntb_async_rx(entry, offset, hdr->len);
+                ntb_async_rx(entry, offset);
+        }
 
         qp->rx_index++;
         qp->rx_index %= qp->rx_max_entry;
 
         return 0;
-
-err:
-        /* FIXME: if this syncrhonous update of the rx_index gets ahead of
-         * asyncrhonous ntb_rx_copy_callback of previous entry, there are three
-         * scenarios:
-         *
-         * 1) The peer might miss this update, but observe the update
-         * from the memcpy completion callback.  In this case, the buffer will
-         * not be freed on the peer to be reused for a different packet.  The
-         * successful rx of a later packet would clear the condition, but the
-         * condition could persist if several rx fail in a row.
-         *
-         * 2) The peer may observe this update before the asyncrhonous copy of
-         * prior packets is completed.  The peer may overwrite the buffers of
-         * the prior packets before they are copied.
-         *
-         * 3) Both: the peer may observe the update, and then observe the index
-         * decrement by the asynchronous completion callback.  Who knows what
-         * badness that will cause.
-         */
-        hdr->flags = 0;
-        iowrite32(qp->rx_index, &qp->rx_info->entry);
-
-        return rc;
 }
 
 static void ntb_transport_rxc_db(unsigned long data)
@@ -1333,7 +1373,7 @@ static void ntb_transport_rxc_db(unsigned long data)
                         break;
         }
 
-        if (qp->dma_chan)
+        if (i && qp->dma_chan)
                 dma_async_issue_pending(qp->dma_chan);
 
         if (i == qp->rx_max_entry) {
@@ -1609,7 +1649,7 @@ ntb_transport_create_queue(void *data, struct device *client_dev,
                         goto err1;
 
                 entry->qp = qp;
-                ntb_list_add(&qp->ntb_rx_free_q_lock, &entry->entry,
+                ntb_list_add(&qp->ntb_rx_q_lock, &entry->entry,
                              &qp->rx_free_q);
         }
 
@@ -1634,7 +1674,7 @@ err2:
         while ((entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q)))
                 kfree(entry);
 err1:
-        while ((entry = ntb_list_rm(&qp->ntb_rx_free_q_lock, &qp->rx_free_q)))
+        while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_free_q)))
                 kfree(entry);
         if (qp->dma_chan)
                 dma_release_channel(qp->dma_chan);
@@ -1652,7 +1692,6 @@ EXPORT_SYMBOL_GPL(ntb_transport_create_queue);
  */
 void ntb_transport_free_queue(struct ntb_transport_qp *qp)
 {
-        struct ntb_transport_ctx *nt = qp->transport;
         struct pci_dev *pdev;
         struct ntb_queue_entry *entry;
         u64 qp_bit;
@@ -1689,18 +1728,23 @@ void ntb_transport_free_queue(struct ntb_transport_qp *qp)
         qp->tx_handler = NULL;
         qp->event_handler = NULL;
 
-        while ((entry = ntb_list_rm(&qp->ntb_rx_free_q_lock, &qp->rx_free_q)))
+        while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_free_q)))
                 kfree(entry);
 
-        while ((entry = ntb_list_rm(&qp->ntb_rx_pend_q_lock, &qp->rx_pend_q))) {
-                dev_warn(&pdev->dev, "Freeing item from a non-empty queue\n");
+        while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_pend_q))) {
+                dev_warn(&pdev->dev, "Freeing item from non-empty rx_pend_q\n");
+                kfree(entry);
+        }
+
+        while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_post_q))) {
+                dev_warn(&pdev->dev, "Freeing item from non-empty rx_post_q\n");
                 kfree(entry);
         }
 
         while ((entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q)))
                 kfree(entry);
 
-        nt->qp_bitmap_free |= qp_bit;
+        qp->transport->qp_bitmap_free |= qp_bit;
 
         dev_info(&pdev->dev, "NTB Transport QP %d freed\n", qp->qp_num);
 }
@@ -1724,14 +1768,14 @@ void *ntb_transport_rx_remove(struct ntb_transport_qp *qp, unsigned int *len)
         if (!qp || qp->client_ready)
                 return NULL;
 
-        entry = ntb_list_rm(&qp->ntb_rx_pend_q_lock, &qp->rx_pend_q);
+        entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_pend_q);
         if (!entry)
                 return NULL;
 
         buf = entry->cb_data;
         *len = entry->len;
 
-        ntb_list_add(&qp->ntb_rx_free_q_lock, &entry->entry, &qp->rx_free_q);
+        ntb_list_add(&qp->ntb_rx_q_lock, &entry->entry, &qp->rx_free_q);
 
         return buf;
 }
@@ -1757,15 +1801,18 @@ int ntb_transport_rx_enqueue(struct ntb_transport_qp *qp, void *cb, void *data,
         if (!qp)
                 return -EINVAL;
 
-        entry = ntb_list_rm(&qp->ntb_rx_free_q_lock, &qp->rx_free_q);
+        entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_free_q);
         if (!entry)
                 return -ENOMEM;
 
         entry->cb_data = cb;
         entry->buf = data;
         entry->len = len;
+        entry->flags = 0;
+
+        ntb_list_add(&qp->ntb_rx_q_lock, &entry->entry, &qp->rx_pend_q);
 
-        ntb_list_add(&qp->ntb_rx_pend_q_lock, &entry->entry, &qp->rx_pend_q);
+        tasklet_schedule(&qp->rxc_db_work);
 
         return 0;
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 8df1b1777745..59bb8556e43a 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -47,7 +47,7 @@ config OF_DYNAMIC
 
 config OF_ADDRESS
         def_bool y
-        depends on !SPARC
+        depends on !SPARC && HAS_IOMEM
         select OF_ADDRESS_PCI if PCI
 
 config OF_ADDRESS_PCI
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 18016341d5a9..9f71770b6226 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -979,7 +979,6 @@ static struct platform_driver unittest_driver = {
         .remove                 = unittest_remove,
         .driver = {
                 .name           = "unittest",
-                .owner          = THIS_MODULE,
                 .of_match_table = of_match_ptr(unittest_match),
         },
 };
@@ -1666,7 +1665,6 @@ static const struct i2c_device_id unittest_i2c_dev_id[] = {
 static struct i2c_driver unittest_i2c_dev_driver = {
         .driver = {
                 .name = "unittest-i2c-dev",
-                .owner = THIS_MODULE,
         },
         .probe = unittest_i2c_dev_probe,
         .remove = unittest_i2c_dev_remove,
@@ -1761,7 +1759,6 @@ static const struct i2c_device_id unittest_i2c_mux_id[] = {
 static struct i2c_driver unittest_i2c_mux_driver = {
         .driver = {
                 .name = "unittest-i2c-mux",
-                .owner = THIS_MODULE,
         },
         .probe = unittest_i2c_mux_probe,
         .remove = unittest_i2c_mux_remove,
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index e17c539e4f6f..2dad7e820ff0 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -212,6 +212,7 @@ void sun4i_usb_phy_set_squelch_detect(struct phy *_phy, bool enabled)
 
         sun4i_usb_phy_write(phy, PHY_SQUELCH_DETECT, enabled ? 0 : 2, 2);
 }
+EXPORT_SYMBOL_GPL(sun4i_usb_phy_set_squelch_detect);
 
 static struct phy_ops sun4i_usb_phy_ops = {
         .init           = sun4i_usb_phy_init,
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 3510b81db3fa..08020dc2c7c8 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -28,6 +28,8 @@
 #include <linux/delay.h>
 #include <linux/phy/omap_control_phy.h>
 #include <linux/of_platform.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
 
 #define PLL_STATUS              0x00000004
 #define PLL_GO                  0x00000008
@@ -52,6 +54,8 @@
 #define PLL_LOCK                0x2
 #define PLL_IDLE                0x1
 
+#define SATA_PLL_SOFT_RESET     BIT(18)
+
 /*
  * This is an Empirical value that works, need to confirm the actual
  * value required for the PIPE3PHY_PLL_CONFIGURATION2.PLL_IDLE status
@@ -82,6 +86,9 @@ struct ti_pipe3 {
         struct clk              *refclk;
         struct clk              *div_clk;
         struct pipe3_dpll_map   *dpll_map;
+        struct regmap           *dpll_reset_syscon; /* ctrl. reg. acces */
+        unsigned int            dpll_reset_reg; /* reg. index within syscon */
+        bool                    sata_refclk_enabled;
 };
 
 static struct pipe3_dpll_map dpll_map_usb[] = {
@@ -249,8 +256,11 @@ static int ti_pipe3_exit(struct phy *x)
         u32 val;
         unsigned long timeout;
 
-        /* SATA DPLL can't be powered down due to Errata i783 */
-        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata"))
+        /* If dpll_reset_syscon is not present we wont power down SATA DPLL
+         * due to Errata i783
+         */
+        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata") &&
+            !phy->dpll_reset_syscon)
                 return 0;
 
         /* PCIe doesn't have internal DPLL */
@@ -276,6 +286,14 @@ static int ti_pipe3_exit(struct phy *x)
                 }
         }
 
+        /* i783: SATA needs control bit toggle after PLL unlock */
+        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata")) {
+                regmap_update_bits(phy->dpll_reset_syscon, phy->dpll_reset_reg,
+                                   SATA_PLL_SOFT_RESET, SATA_PLL_SOFT_RESET);
+                regmap_update_bits(phy->dpll_reset_syscon, phy->dpll_reset_reg,
+                                   SATA_PLL_SOFT_RESET, 0);
+        }
+
         ti_pipe3_disable_clocks(phy);
 
         return 0;
@@ -350,6 +368,21 @@ static int ti_pipe3_probe(struct platform_device *pdev)
                 }
         } else {
                 phy->wkupclk = ERR_PTR(-ENODEV);
+                phy->dpll_reset_syscon = syscon_regmap_lookup_by_phandle(node,
+                                                        "syscon-pllreset");
+                if (IS_ERR(phy->dpll_reset_syscon)) {
+                        dev_info(&pdev->dev,
+                                 "can't get syscon-pllreset, sata dpll won't idle\n");
+                        phy->dpll_reset_syscon = NULL;
+                } else {
+                        if (of_property_read_u32_index(node,
+                                                       "syscon-pllreset", 1,
+                                                       &phy->dpll_reset_reg)) {
+                                dev_err(&pdev->dev,
+                                        "couldn't get pllreset reg. offset\n");
+                                return -EINVAL;
+                        }
+                }
         }
 
         if (of_device_is_compatible(node, "ti,phy-pipe3-pcie")) {
@@ -402,10 +435,16 @@ static int ti_pipe3_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, phy);
         pm_runtime_enable(phy->dev);
-        /* Prevent auto-disable of refclk for SATA PHY due to Errata i783 */
-        if (of_device_is_compatible(node, "ti,phy-pipe3-sata"))
-                if (!IS_ERR(phy->refclk))
+
+        /*
+         * Prevent auto-disable of refclk for SATA PHY due to Errata i783
+         */
+        if (of_device_is_compatible(node, "ti,phy-pipe3-sata")) {
+                if (!IS_ERR(phy->refclk)) {
                         clk_prepare_enable(phy->refclk);
+                        phy->sata_refclk_enabled = true;
+                }
+        }
 
         generic_phy = devm_phy_create(phy->dev, NULL, &ops);
         if (IS_ERR(generic_phy))
@@ -472,8 +511,18 @@ static void ti_pipe3_disable_clocks(struct ti_pipe3 *phy)
 {
         if (!IS_ERR(phy->wkupclk))
                 clk_disable_unprepare(phy->wkupclk);
-        if (!IS_ERR(phy->refclk))
+        if (!IS_ERR(phy->refclk)) {
                 clk_disable_unprepare(phy->refclk);
+                /*
+                 * SATA refclk needs an additional disable as we left it
+                 * on in probe to avoid Errata i783
+                 */
+                if (phy->sata_refclk_enabled) {
+                        clk_disable_unprepare(phy->refclk);
+                        phy->sata_refclk_enabled = false;
+                }
+        }
+
         if (!IS_ERR(phy->div_clk))
                 clk_disable_unprepare(phy->div_clk);
 }
diff --git a/drivers/platform/chrome/Kconfig b/drivers/platform/chrome/Kconfig
index cb1329919527..3271cd1abe7c 100644
--- a/drivers/platform/chrome/Kconfig
+++ b/drivers/platform/chrome/Kconfig
@@ -4,7 +4,6 @@
 
 menuconfig CHROME_PLATFORMS
         bool "Platform support for Chrome hardware"
-        depends on X86 || ARM
         ---help---
           Say Y here to get to see options for platform support for
           various Chromebooks and Chromeboxes. This option alone does
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 882744852aac..a9aa38903efe 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -599,9 +599,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd,
 {
         struct ipr_trace_entry *trace_entry;
         struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+        unsigned int trace_index;
 
-        trace_entry = &ioa_cfg->trace[atomic_add_return
-                        (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
+        trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
+        trace_entry = &ioa_cfg->trace[trace_index];
         trace_entry->time = jiffies;
         trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
         trace_entry->type = type;
@@ -1051,10 +1052,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd,
 
 static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg)
 {
+        unsigned int hrrq;
+
         if (ioa_cfg->hrrq_num == 1)
-                return 0;
-        else
-                return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1;
+                hrrq = 0;
+        else {
+                hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index);
+                hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1;
+        }
+        return hrrq;
 }
 
 /**
@@ -6263,21 +6269,23 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd)
         struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
         struct scsi_cmnd *scsi_cmd = ipr_cmd->scsi_cmd;
         u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc);
-        unsigned long hrrq_flags;
+        unsigned long lock_flags;
 
         scsi_set_resid(scsi_cmd, be32_to_cpu(ipr_cmd->s.ioasa.hdr.residual_data_len));
 
         if (likely(IPR_IOASC_SENSE_KEY(ioasc) == 0)) {
                 scsi_dma_unmap(scsi_cmd);
 
-                spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags);
+                spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags);
                 list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
                 scsi_cmd->scsi_done(scsi_cmd);
-                spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags);
+                spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags);
         } else {
-                spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                spin_lock(&ipr_cmd->hrrq->_lock);
                 ipr_erp_start(ioa_cfg, ipr_cmd);
-                spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags);
+                spin_unlock(&ipr_cmd->hrrq->_lock);
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
         }
 }
 
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index 73790a1d0969..6b97ee45c7b4 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1486,6 +1486,7 @@ struct ipr_ioa_cfg {
 
 #define IPR_NUM_TRACE_INDEX_BITS        8
 #define IPR_NUM_TRACE_ENTRIES           (1 << IPR_NUM_TRACE_INDEX_BITS)
+#define IPR_TRACE_INDEX_MASK            (IPR_NUM_TRACE_ENTRIES - 1)
 #define IPR_TRACE_SIZE  (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
         char trace_start[8];
 #define IPR_TRACE_START_LABEL                   "trace"
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 82b92c414a9c..437254e1c4de 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -738,7 +738,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
                 ql_log(ql_log_info, vha, 0x706f,
                     "Issuing MPI reset.\n");
 
-                if (IS_QLA83XX(ha)) {
+                if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                         uint32_t idc_control;
 
                         qla83xx_idc_lock(vha, 0);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 0e6ee3ca30e6..8b011aef12bd 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -67,10 +67,10 @@
  * |                              |                    | 0xd031-0xd0ff  |
  * |                              |                    | 0xd101-0xd1fe  |
  * |                              |                    | 0xd214-0xd2fe  |
- * | Target Mode                  |       0xe079       |                |
- * | Target Mode Management       |       0xf072       | 0xf002         |
+ * | Target Mode                  |       0xe080       |                |
+ * | Target Mode Management       |       0xf096       | 0xf002         |
  * |                              |                    | 0xf046-0xf049  |
- * | Target Mode Task Management  |       0x1000b      |                |
+ * | Target Mode Task Management  |       0x1000d      |                |
  * ----------------------------------------------------------------------
  */
 
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index e86201d3b8c6..9ad819edcd67 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -274,6 +274,7 @@
 #define RESPONSE_ENTRY_CNT_FX00         256     /* Number of response entries.*/
 
 struct req_que;
+struct qla_tgt_sess;
 
 /*
  * (sd.h is not exported, hence local inclusion)
@@ -2026,6 +2027,7 @@ typedef struct fc_port {
         uint16_t port_id;
 
         unsigned long retry_delay_timestamp;
+        struct qla_tgt_sess *tgt_session;
 } fc_port_t;
 
 #include "qla_mr.h"
@@ -3154,13 +3156,13 @@ struct qla_hw_data {
 /* Bit 21 of fw_attributes decides the MCTP capabilities */
 #define IS_MCTP_CAPABLE(ha)     (IS_QLA2031(ha) && \
                                 ((ha)->fw_attributes_ext[0] & BIT_0))
-#define IS_PI_UNINIT_CAPABLE(ha)        (IS_QLA83XX(ha))
-#define IS_PI_IPGUARD_CAPABLE(ha)       (IS_QLA83XX(ha))
+#define IS_PI_UNINIT_CAPABLE(ha)        (IS_QLA83XX(ha) || IS_QLA27XX(ha))
+#define IS_PI_IPGUARD_CAPABLE(ha)       (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_PI_DIFB_DIX0_CAPABLE(ha)     (0)
-#define IS_PI_SPLIT_DET_CAPABLE_HBA(ha) (IS_QLA83XX(ha))
+#define IS_PI_SPLIT_DET_CAPABLE_HBA(ha) (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_PI_SPLIT_DET_CAPABLE(ha)     (IS_PI_SPLIT_DET_CAPABLE_HBA(ha) && \
     (((ha)->fw_attributes_h << 16 | (ha)->fw_attributes) & BIT_22))
-#define IS_ATIO_MSIX_CAPABLE(ha) (IS_QLA83XX(ha))
+#define IS_ATIO_MSIX_CAPABLE(ha) (IS_QLA83XX(ha) || IS_QLA27XX(ha))
 #define IS_TGT_MODE_CAPABLE(ha) (ha->tgt.atio_q_length)
 #define IS_SHADOW_REG_CAPABLE(ha)  (IS_QLA27XX(ha))
 #define IS_DPORT_CAPABLE(ha)  (IS_QLA83XX(ha) || IS_QLA27XX(ha))
@@ -3579,6 +3581,16 @@ typedef struct scsi_qla_host {
         uint16_t        fcoe_fcf_idx;
         uint8_t         fcoe_vn_port_mac[6];
 
+        /* list of commands waiting on workqueue */
+        struct list_head        qla_cmd_list;
+        struct list_head        qla_sess_op_cmd_list;
+        spinlock_t              cmd_list_lock;
+
+        /* Counter to detect races between ELS and RSCN events */
+        atomic_t                generation_tick;
+        /* Time when global fcport update has been scheduled */
+        int                     total_fcport_update_gen;
+
         uint32_t        vp_abort_cnt;
 
         struct fc_vport *fc_vport;      /* holds fc_vport * for each vport */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 664013115c9d..11f2f3279eab 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data)
                         QLA_LOGIO_LOGIN_RETRIED : 0;
                 qla2x00_post_async_login_done_work(fcport->vha, fcport,
                         lio->u.logio.data);
+        } else if (sp->type == SRB_LOGOUT_CMD) {
+                qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
         }
 }
 
@@ -497,7 +499,10 @@ void
 qla2x00_async_logout_done(struct scsi_qla_host *vha, fc_port_t *fcport,
     uint16_t *data)
 {
-        qla2x00_mark_device_lost(vha, fcport, 1, 0);
+        /* Don't re-login in target mode */
+        if (!fcport->tgt_session)
+                qla2x00_mark_device_lost(vha, fcport, 1, 0);
+        qlt_logo_completion_handler(fcport, data[0]);
         return;
 }
 
@@ -1538,7 +1543,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                 mem_size = (ha->fw_memory_size - 0x11000 + 1) *
                     sizeof(uint16_t);
         } else if (IS_FWI2_CAPABLE(ha)) {
-                if (IS_QLA83XX(ha))
+                if (IS_QLA83XX(ha) || IS_QLA27XX(ha))
                         fixed_size = offsetof(struct qla83xx_fw_dump, ext_mem);
                 else if (IS_QLA81XX(ha))
                         fixed_size = offsetof(struct qla81xx_fw_dump, ext_mem);
@@ -1550,7 +1555,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                 mem_size = (ha->fw_memory_size - 0x100000 + 1) *
                     sizeof(uint32_t);
                 if (ha->mqenable) {
-                        if (!IS_QLA83XX(ha))
+                        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                                 mq_size = sizeof(struct qla2xxx_mq_chain);
                         /*
                          * Allocate maximum buffer size for all queues.
@@ -2922,21 +2927,14 @@ qla2x00_rport_del(void *data)
 {
         fc_port_t *fcport = data;
         struct fc_rport *rport;
-        scsi_qla_host_t *vha = fcport->vha;
         unsigned long flags;
 
         spin_lock_irqsave(fcport->vha->host->host_lock, flags);
         rport = fcport->drport ? fcport->drport: fcport->rport;
         fcport->drport = NULL;
         spin_unlock_irqrestore(fcport->vha->host->host_lock, flags);
-        if (rport) {
+        if (rport)
                 fc_remote_port_delete(rport);
-                /*
-                 * Release the target mode FC NEXUS in qla_target.c code
-                 * if target mod is enabled.
-                 */
-                qlt_fc_port_deleted(vha, fcport);
-        }
 }
 
 /**
@@ -3303,6 +3301,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
          * Create target mode FC NEXUS in qla_target.c if target mode is
          * enabled..
          */
+
         qlt_fc_port_added(vha, fcport);
 
         spin_lock_irqsave(fcport->vha->host->host_lock, flags);
@@ -3341,8 +3340,7 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
 
         if (IS_QLAFX00(vha->hw)) {
                 qla2x00_set_fcport_state(fcport, FCS_ONLINE);
-                qla2x00_reg_remote_port(vha, fcport);
-                return;
+                goto reg_port;
         }
         fcport->login_retry = 0;
         fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
@@ -3350,7 +3348,16 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
         qla2x00_set_fcport_state(fcport, FCS_ONLINE);
         qla2x00_iidma_fcport(vha, fcport);
         qla24xx_update_fcport_fcp_prio(vha, fcport);
-        qla2x00_reg_remote_port(vha, fcport);
+
+reg_port:
+        if (qla_ini_mode_enabled(vha))
+                qla2x00_reg_remote_port(vha, fcport);
+        else {
+                /*
+                 * Create target mode FC NEXUS in qla_target.c
+                 */
+                qlt_fc_port_added(vha, fcport);
+        }
 }
 
 /*
@@ -3375,6 +3382,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
         LIST_HEAD(new_fcports);
         struct qla_hw_data *ha = vha->hw;
         struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
+        int             discovery_gen;
 
         /* If FL port exists, then SNS is present */
         if (IS_FWI2_CAPABLE(ha))
@@ -3445,6 +3453,14 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                         fcport->scan_state = QLA_FCPORT_SCAN;
                 }
 
+                /* Mark the time right before querying FW for connected ports.
+                 * This process is long, asynchronous and by the time it's done,
+                 * collected information might not be accurate anymore. E.g.
+                 * disconnected port might have re-connected and a brand new
+                 * session has been created. In this case session's generation
+                 * will be newer than discovery_gen. */
+                qlt_do_generation_tick(vha, &discovery_gen);
+
                 rval = qla2x00_find_all_fabric_devs(vha, &new_fcports);
                 if (rval != QLA_SUCCESS)
                         break;
@@ -3460,20 +3476,44 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                         if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
                                 continue;
 
-                        if (fcport->scan_state == QLA_FCPORT_SCAN &&
-                            atomic_read(&fcport->state) == FCS_ONLINE) {
-                                qla2x00_mark_device_lost(vha, fcport,
-                                    ql2xplogiabsentdevice, 0);
-                                if (fcport->loop_id != FC_NO_LOOP_ID &&
-                                    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
-                                    fcport->port_type != FCT_INITIATOR &&
-                                    fcport->port_type != FCT_BROADCAST) {
-                                        ha->isp_ops->fabric_logout(vha,
-                                            fcport->loop_id,
-                                            fcport->d_id.b.domain,
-                                            fcport->d_id.b.area,
-                                            fcport->d_id.b.al_pa);
-                                        qla2x00_clear_loop_id(fcport);
+                        if (fcport->scan_state == QLA_FCPORT_SCAN) {
+                                if (qla_ini_mode_enabled(base_vha) &&
+                                    atomic_read(&fcport->state) == FCS_ONLINE) {
+                                        qla2x00_mark_device_lost(vha, fcport,
+                                            ql2xplogiabsentdevice, 0);
+                                        if (fcport->loop_id != FC_NO_LOOP_ID &&
+                                            (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+                                            fcport->port_type != FCT_INITIATOR &&
+                                            fcport->port_type != FCT_BROADCAST) {
+                                                ha->isp_ops->fabric_logout(vha,
+                                                    fcport->loop_id,
+                                                    fcport->d_id.b.domain,
+                                                    fcport->d_id.b.area,
+                                                    fcport->d_id.b.al_pa);
+                                                qla2x00_clear_loop_id(fcport);
+                                        }
+                                } else if (!qla_ini_mode_enabled(base_vha)) {
+                                        /*
+                                         * In target mode, explicitly kill
+                                         * sessions and log out of devices
+                                         * that are gone, so that we don't
+                                         * end up with an initiator using the
+                                         * wrong ACL (if the fabric recycles
+                                         * an FC address and we have a stale
+                                         * session around) and so that we don't
+                                         * report initiators that are no longer
+                                         * on the fabric.
+                                         */
+                                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
+                                            "port gone, logging out/killing session: "
+                                            "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
+                                            "scan_state %d\n",
+                                            fcport->port_name,
+                                            atomic_read(&fcport->state),
+                                            fcport->flags, fcport->fc4_type,
+                                            fcport->scan_state);
+                                        qlt_fc_port_deleted(vha, fcport,
+                                            discovery_gen);
                                 }
                         }
                 }
@@ -3494,6 +3534,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                             (fcport->flags & FCF_LOGIN_NEEDED) == 0)
                                 continue;
 
+                        /*
+                         * If we're not an initiator, skip looking for devices
+                         * and logging in.  There's no reason for us to do it,
+                         * and it seems to actively cause problems in target
+                         * mode if we race with the initiator logging into us
+                         * (we might get the "port ID used" status back from
+                         * our login command and log out the initiator, which
+                         * seems to cause havoc).
+                         */
+                        if (!qla_ini_mode_enabled(base_vha)) {
+                                if (fcport->scan_state == QLA_FCPORT_FOUND) {
+                                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
+                                            "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
+                                            "scan_state %d (initiator mode disabled; skipping "
+                                            "login)\n", fcport->port_name,
+                                            atomic_read(&fcport->state),
+                                            fcport->flags, fcport->fc4_type,
+                                            fcport->scan_state);
+                                }
+                                continue;
+                        }
+
                         if (fcport->loop_id == FC_NO_LOOP_ID) {
                                 fcport->loop_id = next_loopid;
                                 rval = qla2x00_find_new_loop_id(
@@ -3520,16 +3582,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                             test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
                                 break;
 
-                        /* Find a new loop ID to use. */
-                        fcport->loop_id = next_loopid;
-                        rval = qla2x00_find_new_loop_id(base_vha, fcport);
-                        if (rval != QLA_SUCCESS) {
-                                /* Ran out of IDs to use */
-                                break;
-                        }
+                        /*
+                         * If we're not an initiator, skip looking for devices
+                         * and logging in.  There's no reason for us to do it,
+                         * and it seems to actively cause problems in target
+                         * mode if we race with the initiator logging into us
+                         * (we might get the "port ID used" status back from
+                         * our login command and log out the initiator, which
+                         * seems to cause havoc).
+                         */
+                        if (qla_ini_mode_enabled(base_vha)) {
+                                /* Find a new loop ID to use. */
+                                fcport->loop_id = next_loopid;
+                                rval = qla2x00_find_new_loop_id(base_vha,
+                                    fcport);
+                                if (rval != QLA_SUCCESS) {
+                                        /* Ran out of IDs to use */
+                                        break;
+                                }
 
-                        /* Login and update database */
-                        qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
+                                /* Login and update database */
+                                qla2x00_fabric_dev_login(vha, fcport,
+                                    &next_loopid);
+                        } else {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
+                                        "new port %8phC state 0x%x flags 0x%x fc4_type "
+                                        "0x%x scan_state %d (initiator mode disabled; "
+                                        "skipping login)\n",
+                                        fcport->port_name,
+                                        atomic_read(&fcport->state),
+                                        fcport->flags, fcport->fc4_type,
+                                        fcport->scan_state);
+                        }
 
                         list_move_tail(&fcport->list, &vha->vp_fcports);
                 }
@@ -3725,11 +3809,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                         fcport->fp_speed = new_fcport->fp_speed;
 
                         /*
-                         * If address the same and state FCS_ONLINE, nothing
-                         * changed.
+                         * If address the same and state FCS_ONLINE
+                         * (or in target mode), nothing changed.
                          */
                         if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
-                            atomic_read(&fcport->state) == FCS_ONLINE) {
+                            (atomic_read(&fcport->state) == FCS_ONLINE ||
+                             !qla_ini_mode_enabled(base_vha))) {
                                 break;
                         }
 
@@ -3749,6 +3834,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                          * Log it out if still logged in and mark it for
                          * relogin later.
                          */
+                        if (!qla_ini_mode_enabled(base_vha)) {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
+                                         "port changed FC ID, %8phC"
+                                         " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
+                                         fcport->port_name,
+                                         fcport->d_id.b.domain,
+                                         fcport->d_id.b.area,
+                                         fcport->d_id.b.al_pa,
+                                         fcport->loop_id,
+                                         new_fcport->d_id.b.domain,
+                                         new_fcport->d_id.b.area,
+                                         new_fcport->d_id.b.al_pa);
+                                fcport->d_id.b24 = new_fcport->d_id.b24;
+                                break;
+                        }
+
                         fcport->d_id.b24 = new_fcport->d_id.b24;
                         fcport->flags |= FCF_LOGIN_NEEDED;
                         if (fcport->loop_id != FC_NO_LOOP_ID &&
@@ -3768,6 +3869,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                 if (found)
                         continue;
                 /* If device was not in our fcports list, then add it. */
+                new_fcport->scan_state = QLA_FCPORT_FOUND;
                 list_add_tail(&new_fcport->list, new_fcports);
 
                 /* Allocate a new replacement fcport. */
@@ -4188,6 +4290,14 @@ qla2x00_update_fcports(scsi_qla_host_t *base_vha)
                             atomic_read(&fcport->state) != FCS_UNCONFIGURED) {
                                 spin_unlock_irqrestore(&ha->vport_slock, flags);
                                 qla2x00_rport_del(fcport);
+
+                                /*
+                                 * Release the target mode FC NEXUS in
+                                 * qla_target.c, if target mod is enabled.
+                                 */
+                                qlt_fc_port_deleted(vha, fcport,
+                                    base_vha->total_fcport_update_gen);
+
                                 spin_lock_irqsave(&ha->vport_slock, flags);
                         }
                 }
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 36fbd4c7af8f..6f02b26a35cf 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1943,6 +1943,9 @@ qla24xx_logout_iocb(srb_t *sp, struct logio_entry_24xx *logio)
         logio->entry_type = LOGINOUT_PORT_IOCB_TYPE;
         logio->control_flags =
             cpu_to_le16(LCF_COMMAND_LOGO|LCF_IMPL_LOGO);
+        if (!sp->fcport->tgt_session ||
+            !sp->fcport->tgt_session->keep_nport_handle)
+                logio->control_flags |= cpu_to_le16(LCF_FREE_NPORT);
         logio->nport_handle = cpu_to_le16(sp->fcport->loop_id);
         logio->port_id[0] = sp->fcport->d_id.b.al_pa;
         logio->port_id[1] = sp->fcport->d_id.b.area;
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 02b1c1c5355b..b2f713ad9034 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -2415,7 +2415,8 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
                         *orig_iocb_cnt = mcp->mb[10];
                 if (vha->hw->flags.npiv_supported && max_npiv_vports)
                         *max_npiv_vports = mcp->mb[11];
-                if ((IS_QLA81XX(vha->hw) || IS_QLA83XX(vha->hw)) && max_fcfs)
+                if ((IS_QLA81XX(vha->hw) || IS_QLA83XX(vha->hw) ||
+                    IS_QLA27XX(vha->hw)) && max_fcfs)
                         *max_fcfs = mcp->mb[12];
         }
 
@@ -3898,7 +3899,7 @@ qla25xx_init_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
         spin_lock_irqsave(&ha->hardware_lock, flags);
         if (!(rsp->options & BIT_0)) {
                 WRT_REG_DWORD(rsp->rsp_q_out, 0);
-                if (!IS_QLA83XX(ha))
+                if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                         WRT_REG_DWORD(rsp->rsp_q_in, 0);
         }
 
@@ -5345,7 +5346,7 @@ qla83xx_restart_nic_firmware(scsi_qla_host_t *vha)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
-        if (!IS_QLA83XX(ha))
+        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                 return QLA_FUNCTION_FAILED;
 
         ql_dbg(ql_dbg_mbx, vha, 0x1143, "Entered %s.\n", __func__);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index a28815b8276f..8a5cac8448c7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2504,6 +2504,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 ha->mbx_count = MAILBOX_REGISTER_COUNT;
                 req_length = REQUEST_ENTRY_CNT_24XX;
                 rsp_length = RESPONSE_ENTRY_CNT_2300;
+                ha->tgt.atio_q_length = ATIO_ENTRY_CNT_24XX;
                 ha->max_loop_id = SNS_LAST_LOOP_ID_2300;
                 ha->init_cb_size = sizeof(struct mid_init_cb_81xx);
                 ha->gid_list_info_size = 8;
@@ -3229,11 +3230,15 @@ qla2x00_schedule_rport_del(struct scsi_qla_host *vha, fc_port_t *fcport,
                 spin_lock_irqsave(vha->host->host_lock, flags);
                 fcport->drport = rport;
                 spin_unlock_irqrestore(vha->host->host_lock, flags);
+                qlt_do_generation_tick(vha, &base_vha->total_fcport_update_gen);
                 set_bit(FCPORT_UPDATE_NEEDED, &base_vha->dpc_flags);
                 qla2xxx_wake_dpc(base_vha);
         } else {
-                fc_remote_port_delete(rport);
-                qlt_fc_port_deleted(vha, fcport);
+                int now;
+                if (rport)
+                        fc_remote_port_delete(rport);
+                qlt_do_generation_tick(vha, &now);
+                qlt_fc_port_deleted(vha, fcport, now);
         }
 }
 
@@ -3763,8 +3768,11 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
         INIT_LIST_HEAD(&vha->vp_fcports);
         INIT_LIST_HEAD(&vha->work_list);
         INIT_LIST_HEAD(&vha->list);
+        INIT_LIST_HEAD(&vha->qla_cmd_list);
+        INIT_LIST_HEAD(&vha->qla_sess_op_cmd_list);
 
         spin_lock_init(&vha->work_lock);
+        spin_lock_init(&vha->cmd_list_lock);
 
         sprintf(vha->host_str, "%s_%ld", QLA2XXX_DRIVER_NAME, vha->host_no);
         ql_dbg(ql_dbg_init, vha, 0x0041,
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 028e8c8a7de9..2feb5f38edcd 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -1697,7 +1697,7 @@ qla83xx_select_led_port(struct qla_hw_data *ha)
 {
         uint32_t led_select_value = 0;
 
-        if (!IS_QLA83XX(ha))
+        if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha))
                 goto out;
 
         if (ha->port_no == 0)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index b749026aa592..58651ecbd88c 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -113,6 +113,11 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
 static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
         struct atio_from_isp *atio, uint16_t status, int qfull);
 static void qlt_disable_vha(struct scsi_qla_host *vha);
+static void qlt_clear_tgt_db(struct qla_tgt *tgt);
+static void qlt_send_notify_ack(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *ntfy,
+        uint32_t add_flags, uint16_t resp_code, int resp_code_valid,
+        uint16_t srr_flags, uint16_t srr_reject_code, uint8_t srr_explan);
 /*
  * Global Variables
  */
@@ -122,6 +127,16 @@ static struct workqueue_struct *qla_tgt_wq;
 static DEFINE_MUTEX(qla_tgt_mutex);
 static LIST_HEAD(qla_tgt_glist);
 
+/* This API intentionally takes dest as a parameter, rather than returning
+ * int value to avoid caller forgetting to issue wmb() after the store */
+void qlt_do_generation_tick(struct scsi_qla_host *vha, int *dest)
+{
+        scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
+        *dest = atomic_inc_return(&base_vha->generation_tick);
+        /* memory barrier */
+        wmb();
+}
+
 /* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list) */
 static struct qla_tgt_sess *qlt_find_sess_by_port_name(
         struct qla_tgt *tgt,
@@ -381,14 +396,73 @@ static void qlt_free_session_done(struct work_struct *work)
         struct qla_tgt *tgt = sess->tgt;
         struct scsi_qla_host *vha = sess->vha;
         struct qla_hw_data *ha = vha->hw;
+        unsigned long flags;
+        bool logout_started = false;
+        fc_port_t fcport;
+
+        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf084,
+                "%s: se_sess %p / sess %p from port %8phC loop_id %#04x"
+                " s_id %02x:%02x:%02x logout %d keep %d plogi %d\n",
+                __func__, sess->se_sess, sess, sess->port_name, sess->loop_id,
+                sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
+                sess->logout_on_delete, sess->keep_nport_handle,
+                sess->plogi_ack_needed);
 
         BUG_ON(!tgt);
+
+        if (sess->logout_on_delete) {
+                int rc;
+
+                memset(&fcport, 0, sizeof(fcport));
+                fcport.loop_id = sess->loop_id;
+                fcport.d_id = sess->s_id;
+                memcpy(fcport.port_name, sess->port_name, WWN_SIZE);
+                fcport.vha = vha;
+                fcport.tgt_session = sess;
+
+                rc = qla2x00_post_async_logout_work(vha, &fcport, NULL);
+                if (rc != QLA_SUCCESS)
+                        ql_log(ql_log_warn, vha, 0xf085,
+                               "Schedule logo failed sess %p rc %d\n",
+                               sess, rc);
+                else
+                        logout_started = true;
+        }
+
         /*
          * Release the target session for FC Nexus from fabric module code.
          */
         if (sess->se_sess != NULL)
                 ha->tgt.tgt_ops->free_session(sess);
 
+        if (logout_started) {
+                bool traced = false;
+
+                while (!ACCESS_ONCE(sess->logout_completed)) {
+                        if (!traced) {
+                                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf086,
+                                        "%s: waiting for sess %p logout\n",
+                                        __func__, sess);
+                                traced = true;
+                        }
+                        msleep(100);
+                }
+
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087,
+                        "%s: sess %p logout completed\n",
+                        __func__, sess);
+        }
+
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+
+        if (sess->plogi_ack_needed)
+                qlt_send_notify_ack(vha, &sess->tm_iocb,
+                                    0, 0, 0, 0, 0, 0);
+
+        list_del(&sess->sess_list_entry);
+
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001,
             "Unregistration of sess %p finished\n", sess);
 
@@ -409,9 +483,9 @@ void qlt_unreg_sess(struct qla_tgt_sess *sess)
 
         vha->hw->tgt.tgt_ops->clear_nacl_from_fcport_map(sess);
 
-        list_del(&sess->sess_list_entry);
-        if (sess->deleted)
-                list_del(&sess->del_list_entry);
+        if (!list_empty(&sess->del_list_entry))
+                list_del_init(&sess->del_list_entry);
+        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
 
         INIT_WORK(&sess->free_work, qlt_free_session_done);
         schedule_work(&sess->free_work);
@@ -431,10 +505,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
 
         loop_id = le16_to_cpu(n->u.isp24.nport_handle);
         if (loop_id == 0xFFFF) {
-#if 0 /* FIXME: Re-enable Global event handling.. */
                 /* Global event */
-                atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
-                qlt_clear_tgt_db(ha->tgt.qla_tgt);
+                atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
+                qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
+#if 0 /* FIXME: do we need to choose a session here? */
                 if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
                         sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
                             typeof(*sess), sess_list_entry);
@@ -489,27 +563,38 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
         struct qla_tgt *tgt = sess->tgt;
         uint32_t dev_loss_tmo = tgt->ha->port_down_retry_count + 5;
 
-        if (sess->deleted)
-                return;
+        if (sess->deleted) {
+                /* Upgrade to unconditional deletion in case it was temporary */
+                if (immediate && sess->deleted == QLA_SESS_DELETION_PENDING)
+                        list_del(&sess->del_list_entry);
+                else
+                        return;
+        }
 
         ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
             "Scheduling sess %p for deletion\n", sess);
-        list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
-        sess->deleted = 1;
 
-        if (immediate)
+        if (immediate) {
                 dev_loss_tmo = 0;
+                sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+                list_add(&sess->del_list_entry, &tgt->del_sess_list);
+        } else {
+                sess->deleted = QLA_SESS_DELETION_PENDING;
+                list_add_tail(&sess->del_list_entry, &tgt->del_sess_list);
+        }
 
         sess->expires = jiffies + dev_loss_tmo * HZ;
 
         ql_dbg(ql_dbg_tgt, sess->vha, 0xe048,
-            "qla_target(%d): session for port %8phC (loop ID %d) scheduled for "
-            "deletion in %u secs (expires: %lu) immed: %d\n",
-            sess->vha->vp_idx, sess->port_name, sess->loop_id, dev_loss_tmo,
-            sess->expires, immediate);
+            "qla_target(%d): session for port %8phC (loop ID %d s_id %02x:%02x:%02x)"
+            " scheduled for deletion in %u secs (expires: %lu) immed: %d, logout: %d, gen: %#x\n",
+            sess->vha->vp_idx, sess->port_name, sess->loop_id,
+            sess->s_id.b.domain, sess->s_id.b.area, sess->s_id.b.al_pa,
+            dev_loss_tmo, sess->expires, immediate, sess->logout_on_delete,
+            sess->generation);
 
         if (immediate)
-                schedule_delayed_work(&tgt->sess_del_work, 0);
+                mod_delayed_work(system_wq, &tgt->sess_del_work, 0);
         else
                 schedule_delayed_work(&tgt->sess_del_work,
                     sess->expires - jiffies);
@@ -578,9 +663,9 @@ out_free_id_list:
 /* ha->hardware_lock supposed to be held on entry */
 static void qlt_undelete_sess(struct qla_tgt_sess *sess)
 {
-        BUG_ON(!sess->deleted);
+        BUG_ON(sess->deleted != QLA_SESS_DELETION_PENDING);
 
-        list_del(&sess->del_list_entry);
+        list_del_init(&sess->del_list_entry);
         sess->deleted = 0;
 }
 
@@ -599,7 +684,9 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                     del_list_entry);
                 elapsed = jiffies;
                 if (time_after_eq(elapsed, sess->expires)) {
-                        qlt_undelete_sess(sess);
+                        /* No turning back */
+                        list_del_init(&sess->del_list_entry);
+                        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
 
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
                             "Timeout: sess %p about to be deleted\n",
@@ -643,6 +730,13 @@ static struct qla_tgt_sess *qlt_create_sess(
                             fcport->d_id.b.al_pa, fcport->d_id.b.area,
                             fcport->loop_id);
 
+                        /* Cannot undelete at this point */
+                        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                                spin_unlock_irqrestore(&ha->hardware_lock,
+                                    flags);
+                                return NULL;
+                        }
+
                         if (sess->deleted)
                                 qlt_undelete_sess(sess);
 
@@ -652,6 +746,9 @@ static struct qla_tgt_sess *qlt_create_sess(
 
                         if (sess->local && !local)
                                 sess->local = 0;
+
+                        qlt_do_generation_tick(vha, &sess->generation);
+
                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
                         return sess;
@@ -673,6 +770,14 @@ static struct qla_tgt_sess *qlt_create_sess(
         sess->s_id = fcport->d_id;
         sess->loop_id = fcport->loop_id;
         sess->local = local;
+        INIT_LIST_HEAD(&sess->del_list_entry);
+
+        /* Under normal circumstances we want to logout from firmware when
+         * session eventually ends and release corresponding nport handle.
+         * In the exception cases (e.g. when new PLOGI is waiting) corresponding
+         * code will adjust these flags as necessary. */
+        sess->logout_on_delete = 1;
+        sess->keep_nport_handle = 0;
 
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf006,
             "Adding sess %p to tgt %p via ->check_initiator_node_acl()\n",
@@ -705,6 +810,7 @@ static struct qla_tgt_sess *qlt_create_sess(
         spin_lock_irqsave(&ha->hardware_lock, flags);
         list_add_tail(&sess->sess_list_entry, &vha->vha_tgt.qla_tgt->sess_list);
         vha->vha_tgt.qla_tgt->sess_count++;
+        qlt_do_generation_tick(vha, &sess->generation);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf04b,
@@ -718,7 +824,7 @@ static struct qla_tgt_sess *qlt_create_sess(
 }
 
 /*
- * Called from drivers/scsi/qla2xxx/qla_init.c:qla2x00_reg_remote_port()
+ * Called from qla2x00_reg_remote_port()
  */
 void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
 {
@@ -750,6 +856,10 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
                 mutex_unlock(&vha->vha_tgt.tgt_mutex);
 
                 spin_lock_irqsave(&ha->hardware_lock, flags);
+        } else if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                /* Point of no return */
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return;
         } else {
                 kref_get(&sess->se_sess->sess_kref);
 
@@ -780,27 +890,36 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
-void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+/*
+ * max_gen - specifies maximum session generation
+ * at which this deletion requestion is still valid
+ */
+void
+qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport, int max_gen)
 {
-        struct qla_hw_data *ha = vha->hw;
         struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
         struct qla_tgt_sess *sess;
-        unsigned long flags;
 
         if (!vha->hw->tgt.tgt_ops)
                 return;
 
-        if (!tgt || (fcport->port_type != FCT_INITIATOR))
+        if (!tgt)
                 return;
 
-        spin_lock_irqsave(&ha->hardware_lock, flags);
         if (tgt->tgt_stop) {
-                spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 return;
         }
         sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
         if (!sess) {
-                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return;
+        }
+
+        if (max_gen - sess->generation < 0) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf092,
+                    "Ignoring stale deletion request for se_sess %p / sess %p"
+                    " for port %8phC, req_gen %d, sess_gen %d\n",
+                    sess->se_sess, sess, sess->port_name, max_gen,
+                    sess->generation);
                 return;
         }
 
@@ -808,7 +927,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
 
         sess->local = 1;
         qlt_schedule_sess_for_deletion(sess, false);
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
 static inline int test_tgt_sess_count(struct qla_tgt *tgt)
@@ -1175,6 +1293,70 @@ static void qlt_24xx_retry_term_exchange(struct scsi_qla_host *vha,
             FCP_TMF_CMPL, true);
 }
 
+static int abort_cmd_for_tag(struct scsi_qla_host *vha, uint32_t tag)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+
+        spin_lock(&vha->cmd_list_lock);
+
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                if (tag == op->atio.u.isp24.exchange_addr) {
+                        op->aborted = true;
+                        spin_unlock(&vha->cmd_list_lock);
+                        return 1;
+                }
+        }
+
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                if (tag == cmd->atio.u.isp24.exchange_addr) {
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+                        spin_unlock(&vha->cmd_list_lock);
+                        return 1;
+                }
+        }
+
+        spin_unlock(&vha->cmd_list_lock);
+        return 0;
+}
+
+/* drop cmds for the given lun
+ * XXX only looks for cmds on the port through which lun reset was recieved
+ * XXX does not go through the list of other port (which may have cmds
+ *     for the same lun)
+ */
+static void abort_cmds_for_lun(struct scsi_qla_host *vha,
+                                uint32_t lun, uint8_t *s_id)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+        uint32_t key;
+
+        key = sid_to_key(s_id);
+        spin_lock(&vha->cmd_list_lock);
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                uint32_t op_key;
+                uint32_t op_lun;
+
+                op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
+                op_lun = scsilun_to_int(
+                        (struct scsi_lun *)&op->atio.u.isp24.fcp_cmnd.lun);
+                if (op_key == key && op_lun == lun)
+                        op->aborted = true;
+        }
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                uint32_t cmd_key;
+                uint32_t cmd_lun;
+
+                cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
+                cmd_lun = scsilun_to_int(
+                        (struct scsi_lun *)&cmd->atio.u.isp24.fcp_cmnd.lun);
+                if (cmd_key == key && cmd_lun == lun)
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+        }
+        spin_unlock(&vha->cmd_list_lock);
+}
+
 /* ha->hardware_lock supposed to be held on entry */
 static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
         struct abts_recv_from_24xx *abts, struct qla_tgt_sess *sess)
@@ -1199,8 +1381,19 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
         }
         spin_unlock(&se_sess->sess_cmd_lock);
 
-        if (!found_lun)
-                return -ENOENT;
+        /* cmd not in LIO lists, look in qla list */
+        if (!found_lun) {
+                if (abort_cmd_for_tag(vha, abts->exchange_addr_to_abort)) {
+                        /* send TASK_ABORT response immediately */
+                        qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_CMPL, false);
+                        return 0;
+                } else {
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf081,
+                            "unable to find cmd in driver or LIO for tag 0x%x\n",
+                            abts->exchange_addr_to_abort);
+                        return -ENOENT;
+                }
+        }
 
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00f,
             "qla_target(%d): task abort (tag=%d)\n",
@@ -1284,6 +1477,11 @@ static void qlt_24xx_handle_abts(struct scsi_qla_host *vha,
                 return;
         }
 
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                qlt_24xx_send_abts_resp(vha, abts, FCP_TMF_REJECTED, false);
+                return;
+        }
+
         rc = __qlt_24xx_handle_abts(vha, abts, sess);
         if (rc != 0) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf054,
@@ -1726,20 +1924,6 @@ static int qlt_pre_xmit_response(struct qla_tgt_cmd *cmd,
         struct qla_hw_data *ha = vha->hw;
         struct se_cmd *se_cmd = &cmd->se_cmd;
 
-        if (unlikely(cmd->aborted)) {
-                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
-                       "qla_target(%d): terminating exchange for aborted cmd=%p (se_cmd=%p, tag=%lld)",
-                       vha->vp_idx, cmd, se_cmd, se_cmd->tag);
-
-                cmd->state = QLA_TGT_STATE_ABORTED;
-                cmd->cmd_flags |= BIT_6;
-
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
-
-                /* !! At this point cmd could be already freed !! */
-                return QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED;
-        }
-
         prm->cmd = cmd;
         prm->tgt = tgt;
         prm->rq_result = scsi_status;
@@ -2301,6 +2485,19 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
         unsigned long flags = 0;
         int res;
 
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                cmd->state = QLA_TGT_STATE_PROCESSED;
+                if (cmd->sess->logout_completed)
+                        /* no need to terminate. FW already freed exchange. */
+                        qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
+                else
+                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+                return 0;
+        }
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
         memset(&prm, 0, sizeof(prm));
         qlt_check_srr_debug(cmd, &xmit_type);
 
@@ -2313,9 +2510,6 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
         res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status,
             &full_req_cnt);
         if (unlikely(res != 0)) {
-                if (res == QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED)
-                        return 0;
-
                 return res;
         }
 
@@ -2345,9 +2539,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
                 res = qlt_build_ctio_crc2_pkt(&prm, vha);
         else
                 res = qlt_24xx_build_ctio_pkt(&prm, vha);
-        if (unlikely(res != 0))
+        if (unlikely(res != 0)) {
+                vha->req->cnt += full_req_cnt;
                 goto out_unmap_unlock;
-
+        }
 
         pkt = (struct ctio7_to_24xx *)prm.pkt;
 
@@ -2461,7 +2656,8 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
-        if (qla2x00_reset_active(vha) || cmd->reset_count != ha->chip_reset) {
+        if (qla2x00_reset_active(vha) || (cmd->reset_count != ha->chip_reset) ||
+            (cmd->sess && cmd->sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)) {
                 /*
                  * Either a chip reset is active or this request was from
                  * previous life, just abort the processing.
@@ -2485,8 +2681,11 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
         else
                 res = qlt_24xx_build_ctio_pkt(&prm, vha);
 
-        if (unlikely(res != 0))
+        if (unlikely(res != 0)) {
+                vha->req->cnt += prm.req_cnt;
                 goto out_unlock_free_unmap;
+        }
+
         pkt = (struct ctio7_to_24xx *)prm.pkt;
         pkt->u.status0.flags |= __constant_cpu_to_le16(CTIO7_FLAGS_DATA_OUT |
             CTIO7_FLAGS_STATUS_MODE_0);
@@ -2651,6 +2850,89 @@ out:
 
 /* If hardware_lock held on entry, might drop it, then reaquire */
 /* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
+static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *ntfy)
+{
+        struct nack_to_isp *nack;
+        struct qla_hw_data *ha = vha->hw;
+        request_t *pkt;
+        int ret = 0;
+
+        ql_dbg(ql_dbg_tgt_tmr, vha, 0xe01c,
+            "Sending TERM ELS CTIO (ha=%p)\n", ha);
+
+        pkt = (request_t *)qla2x00_alloc_iocbs_ready(vha, NULL);
+        if (pkt == NULL) {
+                ql_dbg(ql_dbg_tgt, vha, 0xe080,
+                    "qla_target(%d): %s failed: unable to allocate "
+                    "request packet\n", vha->vp_idx, __func__);
+                return -ENOMEM;
+        }
+
+        pkt->entry_type = NOTIFY_ACK_TYPE;
+        pkt->entry_count = 1;
+        pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK;
+
+        nack = (struct nack_to_isp *)pkt;
+        nack->ox_id = ntfy->ox_id;
+
+        nack->u.isp24.nport_handle = ntfy->u.isp24.nport_handle;
+        if (le16_to_cpu(ntfy->u.isp24.status) == IMM_NTFY_ELS) {
+                nack->u.isp24.flags = ntfy->u.isp24.flags &
+                        __constant_cpu_to_le32(NOTIFY24XX_FLAGS_PUREX_IOCB);
+        }
+
+        /* terminate */
+        nack->u.isp24.flags |=
+                __constant_cpu_to_le16(NOTIFY_ACK_FLAGS_TERMINATE);
+
+        nack->u.isp24.srr_rx_id = ntfy->u.isp24.srr_rx_id;
+        nack->u.isp24.status = ntfy->u.isp24.status;
+        nack->u.isp24.status_subcode = ntfy->u.isp24.status_subcode;
+        nack->u.isp24.fw_handle = ntfy->u.isp24.fw_handle;
+        nack->u.isp24.exchange_address = ntfy->u.isp24.exchange_address;
+        nack->u.isp24.srr_rel_offs = ntfy->u.isp24.srr_rel_offs;
+        nack->u.isp24.srr_ui = ntfy->u.isp24.srr_ui;
+        nack->u.isp24.vp_index = ntfy->u.isp24.vp_index;
+
+        qla2x00_start_iocbs(vha, vha->req);
+        return ret;
+}
+
+static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
+        struct imm_ntfy_from_isp *imm, int ha_locked)
+{
+        unsigned long flags = 0;
+        int rc;
+
+        if (qlt_issue_marker(vha, ha_locked) < 0)
+                return;
+
+        if (ha_locked) {
+                rc = __qlt_send_term_imm_notif(vha, imm);
+
+#if 0   /* Todo  */
+                if (rc == -ENOMEM)
+                        qlt_alloc_qfull_cmd(vha, imm, 0, 0);
+#endif
+                goto done;
+        }
+
+        spin_lock_irqsave(&vha->hw->hardware_lock, flags);
+        rc = __qlt_send_term_imm_notif(vha, imm);
+
+#if 0   /* Todo */
+        if (rc == -ENOMEM)
+                qlt_alloc_qfull_cmd(vha, imm, 0, 0);
+#endif
+
+done:
+        if (!ha_locked)
+                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+}
+
+/* If hardware_lock held on entry, might drop it, then reaquire */
+/* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
 static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
         struct qla_tgt_cmd *cmd,
         struct atio_from_isp *atio)
@@ -2715,7 +2997,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
 static void qlt_send_term_exchange(struct scsi_qla_host *vha,
         struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
 {
-        unsigned long flags;
+        unsigned long flags = 0;
         int rc;
 
         if (qlt_issue_marker(vha, ha_locked) < 0)
@@ -2731,17 +3013,18 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
         rc = __qlt_send_term_exchange(vha, cmd, atio);
         if (rc == -ENOMEM)
                 qlt_alloc_qfull_cmd(vha, atio, 0, 0);
-        spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
 
 done:
         if (cmd && ((cmd->state != QLA_TGT_STATE_ABORTED) ||
             !cmd->cmd_sent_to_fw)) {
-                if (!ha_locked && !in_interrupt())
-                        msleep(250); /* just in case */
-
-                qlt_unmap_sg(vha, cmd);
+                if (cmd->sg_mapped)
+                        qlt_unmap_sg(vha, cmd);
                 vha->hw->tgt.tgt_ops->free_cmd(cmd);
         }
+
+        if (!ha_locked)
+                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+
         return;
 }
 
@@ -2792,6 +3075,24 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
 
 }
 
+void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+{
+        struct qla_tgt *tgt = cmd->tgt;
+        struct scsi_qla_host *vha = tgt->vha;
+        struct se_cmd *se_cmd = &cmd->se_cmd;
+
+        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
+            "qla_target(%d): terminating exchange for aborted cmd=%p "
+            "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
+            se_cmd->tag);
+
+        cmd->state = QLA_TGT_STATE_ABORTED;
+        cmd->cmd_flags |= BIT_6;
+
+        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+}
+EXPORT_SYMBOL(qlt_abort_cmd);
+
 void qlt_free_cmd(struct qla_tgt_cmd *cmd)
 {
         struct qla_tgt_sess *sess = cmd->sess;
@@ -3015,7 +3316,7 @@ qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                 dump_stack();
         }
 
-        cmd->cmd_flags |= BIT_12;
+        cmd->cmd_flags |= BIT_17;
         ha->tgt.tgt_ops->free_cmd(cmd);
 }
 
@@ -3177,7 +3478,7 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
 skip_term:
 
         if (cmd->state == QLA_TGT_STATE_PROCESSED) {
-                ;
+                cmd->cmd_flags |= BIT_12;
         } else if (cmd->state == QLA_TGT_STATE_NEED_DATA) {
                 int rx_status = 0;
 
@@ -3191,9 +3492,11 @@ skip_term:
                 ha->tgt.tgt_ops->handle_data(cmd);
                 return;
         } else if (cmd->state == QLA_TGT_STATE_ABORTED) {
+                cmd->cmd_flags |= BIT_18;
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf01e,
                   "Aborted command %p (tag %lld) finished\n", cmd, se_cmd->tag);
         } else {
+                cmd->cmd_flags |= BIT_19;
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf05c,
                     "qla_target(%d): A command in state (%d) should "
                     "not return a CTIO complete\n", vha->vp_idx, cmd->state);
@@ -3205,7 +3508,6 @@ skip_term:
                 dump_stack();
         }
 
-
         ha->tgt.tgt_ops->free_cmd(cmd);
 }
 
@@ -3263,6 +3565,13 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
         if (tgt->tgt_stop)
                 goto out_term;
 
+        if (cmd->state == QLA_TGT_STATE_ABORTED) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf082,
+                    "cmd with tag %u is aborted\n",
+                    cmd->atio.u.isp24.exchange_addr);
+                goto out_term;
+        }
+
         cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
         cmd->se_cmd.tag = atio->u.isp24.exchange_addr;
         cmd->unpacked_lun = scsilun_to_int(
@@ -3316,6 +3625,12 @@ out_term:
 static void qlt_do_work(struct work_struct *work)
 {
         struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
+        scsi_qla_host_t *vha = cmd->vha;
+        unsigned long flags;
+
+        spin_lock_irqsave(&vha->cmd_list_lock, flags);
+        list_del(&cmd->cmd_list);
+        spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
 
         __qlt_do_work(cmd);
 }
@@ -3345,6 +3660,11 @@ static struct qla_tgt_cmd *qlt_get_tag(scsi_qla_host_t *vha,
         cmd->loop_id = sess->loop_id;
         cmd->conf_compl_supported = sess->conf_compl_supported;
 
+        cmd->cmd_flags = 0;
+        cmd->jiffies_at_alloc = get_jiffies_64();
+
+        cmd->reset_count = vha->hw->chip_reset;
+
         return cmd;
 }
 
@@ -3362,14 +3682,25 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
         unsigned long flags;
         uint8_t *s_id = op->atio.u.isp24.fcp_hdr.s_id;
 
+        spin_lock_irqsave(&vha->cmd_list_lock, flags);
+        list_del(&op->cmd_list);
+        spin_unlock_irqrestore(&vha->cmd_list_lock, flags);
+
+        if (op->aborted) {
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf083,
+                    "sess_op with tag %u is aborted\n",
+                    op->atio.u.isp24.exchange_addr);
+                goto out_term;
+        }
+
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf022,
-                "qla_target(%d): Unable to find wwn login"
-                " (s_id %x:%x:%x), trying to create it manually\n",
-                vha->vp_idx, s_id[0], s_id[1], s_id[2]);
+            "qla_target(%d): Unable to find wwn login"
+            " (s_id %x:%x:%x), trying to create it manually\n",
+            vha->vp_idx, s_id[0], s_id[1], s_id[2]);
 
         if (op->atio.u.raw.entry_count > 1) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf023,
-                        "Dropping multy entry atio %p\n", &op->atio);
+                    "Dropping multy entry atio %p\n", &op->atio);
                 goto out_term;
         }
 
@@ -3434,10 +3765,25 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
 
                 memcpy(&op->atio, atio, sizeof(*atio));
                 op->vha = vha;
+
+                spin_lock(&vha->cmd_list_lock);
+                list_add_tail(&op->cmd_list, &vha->qla_sess_op_cmd_list);
+                spin_unlock(&vha->cmd_list_lock);
+
                 INIT_WORK(&op->work, qlt_create_sess_from_atio);
                 queue_work(qla_tgt_wq, &op->work);
                 return 0;
         }
+
+        /* Another WWN used to have our s_id. Our PLOGI scheduled its
+         * session deletion, but it's still in sess_del_work wq */
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                ql_dbg(ql_dbg_io, vha, 0x3061,
+                    "New command while old session %p is being deleted\n",
+                    sess);
+                return -EFAULT;
+        }
+
         /*
          * Do kref_get() before returning + dropping qla_hw_data->hardware_lock.
          */
@@ -3451,13 +3797,13 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
                 return -ENOMEM;
         }
 
-        cmd->cmd_flags = 0;
-        cmd->jiffies_at_alloc = get_jiffies_64();
-
-        cmd->reset_count = vha->hw->chip_reset;
-
         cmd->cmd_in_wq = 1;
         cmd->cmd_flags |= BIT_0;
+
+        spin_lock(&vha->cmd_list_lock);
+        list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
+        spin_unlock(&vha->cmd_list_lock);
+
         INIT_WORK(&cmd->work, qlt_do_work);
         queue_work(qla_tgt_wq, &cmd->work);
         return 0;
@@ -3471,6 +3817,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
         struct scsi_qla_host *vha = sess->vha;
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt_mgmt_cmd *mcmd;
+        struct atio_from_isp *a = (struct atio_from_isp *)iocb;
         int res;
         uint8_t tmr_func;
 
@@ -3511,6 +3858,7 @@ static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
                 ql_dbg(ql_dbg_tgt_tmr, vha, 0x10002,
                     "qla_target(%d): LUN_RESET received\n", sess->vha->vp_idx);
                 tmr_func = TMR_LUN_RESET;
+                abort_cmds_for_lun(vha, lun, a->u.isp24.fcp_hdr.s_id);
                 break;
 
         case QLA_TGT_CLEAR_TS:
@@ -3599,6 +3947,9 @@ static int qlt_handle_task_mgmt(struct scsi_qla_host *vha, void *iocb)
                     sizeof(struct atio_from_isp));
         }
 
+        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS)
+                return -EFAULT;
+
         return qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
 }
 
@@ -3664,22 +4015,280 @@ static int qlt_abort_task(struct scsi_qla_host *vha,
         return __qlt_abort_task(vha, iocb, sess);
 }
 
+void qlt_logo_completion_handler(fc_port_t *fcport, int rc)
+{
+        if (fcport->tgt_session) {
+                if (rc != MBS_COMMAND_COMPLETE) {
+                        ql_dbg(ql_dbg_tgt_mgt, fcport->vha, 0xf093,
+                                "%s: se_sess %p / sess %p from"
+                                " port %8phC loop_id %#04x s_id %02x:%02x:%02x"
+                                " LOGO failed: %#x\n",
+                                __func__,
+                                fcport->tgt_session->se_sess,
+                                fcport->tgt_session,
+                                fcport->port_name, fcport->loop_id,
+                                fcport->d_id.b.domain, fcport->d_id.b.area,
+                                fcport->d_id.b.al_pa, rc);
+                }
+
+                fcport->tgt_session->logout_completed = 1;
+        }
+}
+
+static void qlt_swap_imm_ntfy_iocb(struct imm_ntfy_from_isp *a,
+    struct imm_ntfy_from_isp *b)
+{
+        struct imm_ntfy_from_isp tmp;
+        memcpy(&tmp, a, sizeof(struct imm_ntfy_from_isp));
+        memcpy(a, b, sizeof(struct imm_ntfy_from_isp));
+        memcpy(b, &tmp, sizeof(struct imm_ntfy_from_isp));
+}
+
+/*
+* ha->hardware_lock supposed to be held on entry (to protect tgt->sess_list)
+*
+* Schedules sessions with matching port_id/loop_id but different wwn for
+* deletion. Returns existing session with matching wwn if present.
+* Null otherwise.
+*/
+static struct qla_tgt_sess *
+qlt_find_sess_invalidate_other(struct qla_tgt *tgt, uint64_t wwn,
+    port_id_t port_id, uint16_t loop_id)
+{
+        struct qla_tgt_sess *sess = NULL, *other_sess;
+        uint64_t other_wwn;
+
+        list_for_each_entry(other_sess, &tgt->sess_list, sess_list_entry) {
+
+                other_wwn = wwn_to_u64(other_sess->port_name);
+
+                if (wwn == other_wwn) {
+                        WARN_ON(sess);
+                        sess = other_sess;
+                        continue;
+                }
+
+                /* find other sess with nport_id collision */
+                if (port_id.b24 == other_sess->s_id.b24) {
+                        if (loop_id != other_sess->loop_id) {
+                                ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000c,
+                                    "Invalidating sess %p loop_id %d wwn %llx.\n",
+                                    other_sess, other_sess->loop_id, other_wwn);
+
+                                /*
+                                 * logout_on_delete is set by default, but another
+                                 * session that has the same s_id/loop_id combo
+                                 * might have cleared it when requested this session
+                                 * deletion, so don't touch it
+                                 */
+                                qlt_schedule_sess_for_deletion(other_sess, true);
+                        } else {
+                                /*
+                                 * Another wwn used to have our s_id/loop_id
+                                 * combo - kill the session, but don't log out
+                                 */
+                                sess->logout_on_delete = 0;
+                                qlt_schedule_sess_for_deletion(other_sess,
+                                    true);
+                        }
+                        continue;
+                }
+
+                /* find other sess with nport handle collision */
+                if (loop_id == other_sess->loop_id) {
+                        ql_dbg(ql_dbg_tgt_tmr, tgt->vha, 0x1000d,
+                               "Invalidating sess %p loop_id %d wwn %llx.\n",
+                               other_sess, other_sess->loop_id, other_wwn);
+
+                        /* Same loop_id but different s_id
+                         * Ok to kill and logout */
+                        qlt_schedule_sess_for_deletion(other_sess, true);
+                }
+        }
+
+        return sess;
+}
+
+/* Abort any commands for this s_id waiting on qla_tgt_wq workqueue */
+static int abort_cmds_for_s_id(struct scsi_qla_host *vha, port_id_t *s_id)
+{
+        struct qla_tgt_sess_op *op;
+        struct qla_tgt_cmd *cmd;
+        uint32_t key;
+        int count = 0;
+
+        key = (((u32)s_id->b.domain << 16) |
+               ((u32)s_id->b.area   <<  8) |
+               ((u32)s_id->b.al_pa));
+
+        spin_lock(&vha->cmd_list_lock);
+        list_for_each_entry(op, &vha->qla_sess_op_cmd_list, cmd_list) {
+                uint32_t op_key = sid_to_key(op->atio.u.isp24.fcp_hdr.s_id);
+                if (op_key == key) {
+                        op->aborted = true;
+                        count++;
+                }
+        }
+        list_for_each_entry(cmd, &vha->qla_cmd_list, cmd_list) {
+                uint32_t cmd_key = sid_to_key(cmd->atio.u.isp24.fcp_hdr.s_id);
+                if (cmd_key == key) {
+                        cmd->state = QLA_TGT_STATE_ABORTED;
+                        count++;
+                }
+        }
+        spin_unlock(&vha->cmd_list_lock);
+
+        return count;
+}
+
 /*
  * ha->hardware_lock supposed to be held on entry. Might drop it, then reaquire
  */
 static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
         struct imm_ntfy_from_isp *iocb)
 {
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+        struct qla_hw_data *ha = vha->hw;
+        struct qla_tgt_sess *sess = NULL;
+        uint64_t wwn;
+        port_id_t port_id;
+        uint16_t loop_id;
+        uint16_t wd3_lo;
         int res = 0;
 
+        wwn = wwn_to_u64(iocb->u.isp24.port_name);
+
+        port_id.b.domain = iocb->u.isp24.port_id[2];
+        port_id.b.area   = iocb->u.isp24.port_id[1];
+        port_id.b.al_pa  = iocb->u.isp24.port_id[0];
+        port_id.b.rsvd_1 = 0;
+
+        loop_id = le16_to_cpu(iocb->u.isp24.nport_handle);
+
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf026,
             "qla_target(%d): Port ID: 0x%3phC ELS opcode: 0x%02x\n",
             vha->vp_idx, iocb->u.isp24.port_id, iocb->u.isp24.status_subcode);
 
+        /* res = 1 means ack at the end of thread
+         * res = 0 means ack async/later.
+         */
         switch (iocb->u.isp24.status_subcode) {
         case ELS_PLOGI:
-        case ELS_FLOGI:
+
+                /* Mark all stale commands in qla_tgt_wq for deletion */
+                abort_cmds_for_s_id(vha, &port_id);
+
+                if (wwn)
+                        sess = qlt_find_sess_invalidate_other(tgt, wwn,
+                            port_id, loop_id);
+
+                if (!sess || IS_SW_RESV_ADDR(sess->s_id)) {
+                        res = 1;
+                        break;
+                }
+
+                if (sess->plogi_ack_needed) {
+                        /*
+                         * Initiator sent another PLOGI before last PLOGI could
+                         * finish. Swap plogi iocbs and terminate old one
+                         * without acking, new one will get acked when session
+                         * deletion completes.
+                         */
+                        ql_log(ql_log_warn, sess->vha, 0xf094,
+                            "sess %p received double plogi.\n", sess);
+
+                        qlt_swap_imm_ntfy_iocb(iocb, &sess->tm_iocb);
+
+                        qlt_send_term_imm_notif(vha, iocb, 1);
+
+                        res = 0;
+                        break;
+                }
+
+                res = 0;
+
+                /*
+                 * Save immediate Notif IOCB for Ack when sess is done
+                 * and being deleted.
+                 */
+                memcpy(&sess->tm_iocb, iocb, sizeof(sess->tm_iocb));
+                sess->plogi_ack_needed  = 1;
+
+                 /*
+                  * Under normal circumstances we want to release nport handle
+                  * during LOGO process to avoid nport handle leaks inside FW.
+                  * The exception is when LOGO is done while another PLOGI with
+                  * the same nport handle is waiting as might be the case here.
+                  * Note: there is always a possibily of a race where session
+                  * deletion has already started for other reasons (e.g. ACL
+                  * removal) and now PLOGI arrives:
+                  * 1. if PLOGI arrived in FW after nport handle has been freed,
+                  *    FW must have assigned this PLOGI a new/same handle and we
+                  *    can proceed ACK'ing it as usual when session deletion
+                  *    completes.
+                  * 2. if PLOGI arrived in FW before LOGO with LCF_FREE_NPORT
+                  *    bit reached it, the handle has now been released. We'll
+                  *    get an error when we ACK this PLOGI. Nothing will be sent
+                  *    back to initiator. Initiator should eventually retry
+                  *    PLOGI and situation will correct itself.
+                  */
+                sess->keep_nport_handle = ((sess->loop_id == loop_id) &&
+                                           (sess->s_id.b24 == port_id.b24));
+                qlt_schedule_sess_for_deletion(sess, true);
+                break;
+
         case ELS_PRLI:
+                wd3_lo = le16_to_cpu(iocb->u.isp24.u.prli.wd3_lo);
+
+                if (wwn)
+                        sess = qlt_find_sess_invalidate_other(tgt, wwn, port_id,
+                            loop_id);
+
+                if (sess != NULL) {
+                        if (sess->deleted) {
+                                /*
+                                 * Impatient initiator sent PRLI before last
+                                 * PLOGI could finish. Will force him to re-try,
+                                 * while last one finishes.
+                                 */
+                                ql_log(ql_log_warn, sess->vha, 0xf095,
+                                    "sess %p PRLI received, before plogi ack.\n",
+                                    sess);
+                                qlt_send_term_imm_notif(vha, iocb, 1);
+                                res = 0;
+                                break;
+                        }
+
+                        /*
+                         * This shouldn't happen under normal circumstances,
+                         * since we have deleted the old session during PLOGI
+                         */
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf096,
+                            "PRLI (loop_id %#04x) for existing sess %p (loop_id %#04x)\n",
+                            sess->loop_id, sess, iocb->u.isp24.nport_handle);
+
+                        sess->local = 0;
+                        sess->loop_id = loop_id;
+                        sess->s_id = port_id;
+
+                        if (wd3_lo & BIT_7)
+                                sess->conf_compl_supported = 1;
+
+                }
+                res = 1; /* send notify ack */
+
+                /* Make session global (not used in fabric mode) */
+                if (ha->current_topology != ISP_CFG_F) {
+                        set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+                        set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+                        qla2xxx_wake_dpc(vha);
+                } else {
+                        /* todo: else - create sess here. */
+                        res = 1; /* send notify ack */
+                }
+
+                break;
+
         case ELS_LOGO:
         case ELS_PRLO:
                 res = qlt_reset(vha, iocb, QLA_TGT_NEXUS_LOSS_SESS);
@@ -3697,6 +4306,7 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                 break;
         }
 
+        case ELS_FLOGI: /* should never happen */
         default:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf061,
                     "qla_target(%d): Unsupported ELS command %x "
@@ -5012,6 +5622,11 @@ static void qlt_abort_work(struct qla_tgt *tgt,
                 if (!sess)
                         goto out_term;
         } else {
+                if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                        sess = NULL;
+                        goto out_term;
+                }
+
                 kref_get(&sess->se_sess->sess_kref);
         }
 
@@ -5066,6 +5681,11 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
                 if (!sess)
                         goto out_term;
         } else {
+                if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
+                        sess = NULL;
+                        goto out_term;
+                }
+
                 kref_get(&sess->se_sess->sess_kref);
         }
 
@@ -5552,6 +6172,7 @@ qlt_24xx_process_atio_queue(struct scsi_qla_host *vha)
 
         /* Adjust ring index */
         WRT_REG_DWORD(ISP_ATIO_Q_OUT(vha), ha->tgt.atio_ring_index);
+        RD_REG_DWORD_RELAXED(ISP_ATIO_Q_OUT(vha));
 }
 
 void
@@ -5793,7 +6414,7 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
         if (!QLA_TGT_MODE_ENABLED())
                 return;
 
-        if  (ha->mqenable || IS_QLA83XX(ha)) {
+        if  (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                 ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in;
                 ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out;
         } else {
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 985d76dd706b..bca584ae45b7 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -167,7 +167,24 @@ struct imm_ntfy_from_isp {
                         uint32_t srr_rel_offs;
                         uint16_t srr_ui;
                         uint16_t srr_ox_id;
-                        uint8_t  reserved_4[19];
+                        union {
+                                struct {
+                                        uint8_t node_name[8];
+                                } plogi; /* PLOGI/ADISC/PDISC */
+                                struct {
+                                        /* PRLI word 3 bit 0-15 */
+                                        uint16_t wd3_lo;
+                                        uint8_t resv0[6];
+                                } prli;
+                                struct {
+                                        uint8_t port_id[3];
+                                        uint8_t resv1;
+                                        uint16_t nport_handle;
+                                        uint16_t resv2;
+                                } req_els;
+                        } u;
+                        uint8_t port_name[8];
+                        uint8_t resv3[3];
                         uint8_t  vp_index;
                         uint32_t reserved_5;
                         uint8_t  port_id[3];
@@ -234,6 +251,7 @@ struct nack_to_isp {
         uint8_t  reserved[2];
         uint16_t ox_id;
 } __packed;
+#define NOTIFY_ACK_FLAGS_TERMINATE      BIT_3
 #define NOTIFY_ACK_SRR_FLAGS_ACCEPT     0
 #define NOTIFY_ACK_SRR_FLAGS_REJECT     1
 
@@ -790,13 +808,6 @@ int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
 #define FC_TM_REJECT                4
 #define FC_TM_FAILED                5
 
-/*
- * Error code of qlt_pre_xmit_response() meaning that cmd's exchange was
- * terminated, so no more actions is needed and success should be returned
- * to target.
- */
-#define QLA_TGT_PRE_XMIT_RESP_CMD_ABORTED       0x1717
-
 #if (BITS_PER_LONG > 32) || defined(CONFIG_HIGHMEM64G)
 #define pci_dma_lo32(a) (a & 0xffffffff)
 #define pci_dma_hi32(a) ((((a) >> 16)>>16) & 0xffffffff)
@@ -874,6 +885,15 @@ struct qla_tgt_sess_op {
         struct scsi_qla_host *vha;
         struct atio_from_isp atio;
         struct work_struct work;
+        struct list_head cmd_list;
+        bool aborted;
+};
+
+enum qla_sess_deletion {
+        QLA_SESS_DELETION_NONE          = 0,
+        QLA_SESS_DELETION_PENDING       = 1, /* hopefully we can get rid of
+                                              * this one */
+        QLA_SESS_DELETION_IN_PROGRESS   = 2,
 };
 
 /*
@@ -884,8 +904,15 @@ struct qla_tgt_sess {
         port_id_t s_id;
 
         unsigned int conf_compl_supported:1;
-        unsigned int deleted:1;
+        unsigned int deleted:2;
         unsigned int local:1;
+        unsigned int logout_on_delete:1;
+        unsigned int plogi_ack_needed:1;
+        unsigned int keep_nport_handle:1;
+
+        unsigned char logout_completed;
+
+        int generation;
 
         struct se_session *se_sess;
         struct scsi_qla_host *vha;
@@ -897,6 +924,10 @@ struct qla_tgt_sess {
 
         uint8_t port_name[WWN_SIZE];
         struct work_struct free_work;
+
+        union {
+                struct imm_ntfy_from_isp tm_iocb;
+        };
 };
 
 struct qla_tgt_cmd {
@@ -912,7 +943,6 @@ struct qla_tgt_cmd {
         unsigned int conf_compl_supported:1;
         unsigned int sg_mapped:1;
         unsigned int free_sg:1;
-        unsigned int aborted:1; /* Needed in case of SRR */
         unsigned int write_data_transferred:1;
         unsigned int ctx_dsd_alloced:1;
         unsigned int q_full:1;
@@ -961,6 +991,9 @@ struct qla_tgt_cmd {
          * BIT_14 - Back end data received/sent.
          * BIT_15 - SRR prepare ctio
          * BIT_16 - complete free
+         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
+         * BIT_18 - completion w/abort status
+         * BIT_19 - completion w/unknown status
          */
         uint32_t cmd_flags;
 };
@@ -1026,6 +1059,10 @@ struct qla_tgt_srr_ctio {
         struct qla_tgt_cmd *cmd;
 };
 
+/* Check for Switch reserved address */
+#define IS_SW_RESV_ADDR(_s_id) \
+        ((_s_id.b.domain == 0xff) && (_s_id.b.area == 0xfc))
+
 #define QLA_TGT_XMIT_DATA               1
 #define QLA_TGT_XMIT_STATUS             2
 #define QLA_TGT_XMIT_ALL                (QLA_TGT_XMIT_STATUS|QLA_TGT_XMIT_DATA)
@@ -1043,7 +1080,7 @@ extern int qlt_lport_register(void *, u64, u64, u64,
 extern void qlt_lport_deregister(struct scsi_qla_host *);
 extern void qlt_unreg_sess(struct qla_tgt_sess *);
 extern void qlt_fc_port_added(struct scsi_qla_host *, fc_port_t *);
-extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *);
+extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *, int);
 extern int __init qlt_init(void);
 extern void qlt_exit(void);
 extern void qlt_update_vp_map(struct scsi_qla_host *, int);
@@ -1073,12 +1110,23 @@ static inline void qla_reverse_ini_mode(struct scsi_qla_host *ha)
                 ha->host->active_mode |= MODE_INITIATOR;
 }
 
+static inline uint32_t sid_to_key(const uint8_t *s_id)
+{
+        uint32_t key;
+
+        key = (((unsigned long)s_id[0] << 16) |
+               ((unsigned long)s_id[1] << 8) |
+               (unsigned long)s_id[2]);
+        return key;
+}
+
 /*
  * Exported symbols from qla_target.c LLD logic used by qla2xxx code..
  */
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
+extern void qlt_abort_cmd(struct qla_tgt_cmd *);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
@@ -1109,5 +1157,7 @@ extern void qlt_stop_phase2(struct qla_tgt *);
 extern irqreturn_t qla83xx_msix_atio_q(int, void *);
 extern void qlt_83xx_iospace_config(struct qla_hw_data *);
 extern int qlt_free_qfull_cmds(struct scsi_qla_host *);
+extern void qlt_logo_completion_handler(fc_port_t *, int);
+extern void qlt_do_generation_tick(struct scsi_qla_host *, int *);
 
 #endif /* __QLA_TARGET_H */
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index d9a8c6084346..9224a06646e6 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -374,7 +374,7 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-
+        cmd->cmd_flags |= BIT_3;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
 
@@ -405,7 +405,7 @@ static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd)
             se_cmd->t_state == TRANSPORT_COMPLETE_QF_WP) {
                 spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
                 wait_for_completion_timeout(&se_cmd->t_transport_stop_comp,
-                                                3000);
+                                            3 * HZ);
                 return 0;
         }
         spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -541,12 +541,10 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
         cmd->cmd_flags |= BIT_4;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
-        cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
 
         cmd->sg_cnt = se_cmd->t_data_nents;
         cmd->sg = se_cmd->t_data_sg;
         cmd->offset = 0;
-        cmd->cmd_flags |= BIT_3;
 
         cmd->prot_sg_cnt = se_cmd->t_prot_nents;
         cmd->prot_sg = se_cmd->t_prot_sg;
@@ -571,7 +569,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
         cmd->sg_cnt = 0;
         cmd->offset = 0;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
-        cmd->aborted = (se_cmd->transport_state & CMD_T_ABORTED);
         if (cmd->cmd_flags &  BIT_5) {
                 pr_crit("Bit_5 already set for cmd = %p.\n", cmd);
                 dump_stack();
@@ -636,14 +633,7 @@ static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-        struct scsi_qla_host *vha = cmd->vha;
-        struct qla_hw_data *ha = vha->hw;
-
-        if (!cmd->sg_mapped)
-                return;
-
-        pci_unmap_sg(ha->pdev, cmd->sg, cmd->sg_cnt, cmd->dma_data_direction);
-        cmd->sg_mapped = 0;
+        qlt_abort_cmd(cmd);
 }
 
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
@@ -1149,9 +1139,7 @@ static struct qla_tgt_sess *tcm_qla2xxx_find_sess_by_s_id(
                 return NULL;
         }
 
-        key = (((unsigned long)s_id[0] << 16) |
-               ((unsigned long)s_id[1] << 8) |
-               (unsigned long)s_id[2]);
+        key = sid_to_key(s_id);
         pr_debug("find_sess_by_s_id: 0x%06x\n", key);
 
         se_nacl = btree_lookup32(&lport->lport_fcport_map, key);
@@ -1186,9 +1174,7 @@ static void tcm_qla2xxx_set_sess_by_s_id(
         void *slot;
         int rc;
 
-        key = (((unsigned long)s_id[0] << 16) |
-               ((unsigned long)s_id[1] << 8) |
-               (unsigned long)s_id[2]);
+        key = sid_to_key(s_id);
         pr_debug("set_sess_by_s_id: %06x\n", key);
 
         slot = btree_lookup32(&lport->lport_fcport_map, key);
@@ -1544,6 +1530,10 @@ static void tcm_qla2xxx_update_sess(struct qla_tgt_sess *sess, port_id_t s_id,
         }
 
         sess->conf_compl_supported = conf_compl_supported;
+
+        /* Reset logout parameters to default */
+        sess->logout_on_delete = 1;
+        sess->keep_nport_handle = 0;
 }
 
 /*
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 106884a5444e..cfadccef045c 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
                             scmd->sdb.length);
                 scmd->sdb.table.sgl = &ses->sense_sgl;
                 scmd->sc_data_direction = DMA_FROM_DEVICE;
-                scmd->sdb.table.nents = 1;
+                scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
                 scmd->cmnd[0] = REQUEST_SENSE;
                 scmd->cmnd[4] = scmd->sdb.length;
                 scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b1a263137a23..448ebdaa3d69 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask)
 
 static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
 {
-        if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS)
+        if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
                 return;
         __sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
 }
@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
 
         if (mq) {
                 if (nents <= SCSI_MAX_SG_SEGMENTS) {
-                        sdb->table.nents = nents;
-                        sg_init_table(sdb->table.sgl, sdb->table.nents);
+                        sdb->table.nents = sdb->table.orig_nents = nents;
+                        sg_init_table(sdb->table.sgl, nents);
                         return 0;
                 }
                 first_chunk = sdb->table.sgl;
diff --git a/drivers/staging/comedi/drivers/das1800.c b/drivers/staging/comedi/drivers/das1800.c
index bfa42620a3f6..940781183fac 100644
--- a/drivers/staging/comedi/drivers/das1800.c
+++ b/drivers/staging/comedi/drivers/das1800.c
@@ -1266,6 +1266,7 @@ static const struct das1800_board *das1800_probe(struct comedi_device *dev)
                 if (index == das1801hc || index == das1802hc)
                         return board;
                 index = das1801hc;
+                break;
         default:
                 dev_err(dev->class_dev,
                         "Board model: probe returned 0x%x (unknown, please report)\n",
diff --git a/drivers/staging/lustre/lustre/obdclass/debug.c b/drivers/staging/lustre/lustre/obdclass/debug.c
index 9c934e6d2ea1..c61add46b426 100644
--- a/drivers/staging/lustre/lustre/obdclass/debug.c
+++ b/drivers/staging/lustre/lustre/obdclass/debug.c
@@ -40,7 +40,7 @@
 
 #define DEBUG_SUBSYSTEM D_OTHER
 
-#include <linux/unaligned/access_ok.h>
+#include <asm/unaligned.h>
 
 #include "../include/obd_support.h"
 #include "../include/lustre_debug.h"
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index b0c8e235b982..69bdc8f29b59 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1483,8 +1483,9 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
-        if (changed & BSS_CHANGED_ASSOC && priv->op_mode != NL80211_IFTYPE_AP) {
-                if (conf->assoc) {
+        if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_BEACON_INFO) &&
+            priv->op_mode != NL80211_IFTYPE_AP) {
+                if (conf->assoc && conf->beacon_rate) {
                         CARDbUpdateTSF(priv, conf->beacon_rate->hw_value,
                                        conf->sync_tsf);
 
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 4e68b62193ed..cd77a064c772 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3998,7 +3998,13 @@ get_immediate:
         }
 
 transport_err:
-        iscsit_take_action_for_connection_exit(conn);
+        /*
+         * Avoid the normal connection failure code-path if this connection
+         * is still within LOGIN mode, and iscsi_np process context is
+         * responsible for cleaning up the early connection failure.
+         */
+        if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
+                iscsit_take_action_for_connection_exit(conn);
 out:
         return 0;
 }
@@ -4082,7 +4088,7 @@ reject:
 
 int iscsi_target_rx_thread(void *arg)
 {
-        int ret;
+        int ret, rc;
         u8 buffer[ISCSI_HDR_LEN], opcode;
         u32 checksum = 0, digest = 0;
         struct iscsi_conn *conn = arg;
@@ -4092,10 +4098,16 @@ int iscsi_target_rx_thread(void *arg)
          * connection recovery / failure event can be triggered externally.
          */
         allow_signal(SIGINT);
+        /*
+         * Wait for iscsi_post_login_handler() to complete before allowing
+         * incoming iscsi/tcp socket I/O, and/or failing the connection.
+         */
+        rc = wait_for_completion_interruptible(&conn->rx_login_comp);
+        if (rc < 0)
+                return 0;
 
         if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
                 struct completion comp;
-                int rc;
 
                 init_completion(&comp);
                 rc = wait_for_completion_interruptible(&comp);
@@ -4532,7 +4544,18 @@ static void iscsit_logout_post_handler_closesession(
         struct iscsi_conn *conn)
 {
         struct iscsi_session *sess = conn->sess;
-        int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+        int sleep = 1;
+        /*
+         * Traditional iscsi/tcp will invoke this logic from TX thread
+         * context during session logout, so clear tx_thread_active and
+         * sleep if iscsit_close_connection() has not already occured.
+         *
+         * Since iser-target invokes this logic from it's own workqueue,
+         * always sleep waiting for RX/TX thread shutdown to complete
+         * within iscsit_close_connection().
+         */
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                sleep = cmpxchg(&conn->tx_thread_active, true, false);
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
@@ -4546,7 +4569,10 @@ static void iscsit_logout_post_handler_closesession(
 static void iscsit_logout_post_handler_samecid(
         struct iscsi_conn *conn)
 {
-        int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+        int sleep = 1;
+
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                sleep = cmpxchg(&conn->tx_thread_active, true, false);
 
         atomic_set(&conn->conn_logout_remove, 0);
         complete(&conn->conn_logout_comp);
@@ -4765,6 +4791,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
         struct iscsi_session *sess;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
         struct se_session *se_sess, *se_sess_tmp;
+        LIST_HEAD(free_list);
         int session_count = 0;
 
         spin_lock_bh(&se_tpg->session_lock);
@@ -4786,14 +4813,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
                 }
                 atomic_set(&sess->session_reinstatement, 1);
                 spin_unlock(&sess->conn_lock);
-                spin_unlock_bh(&se_tpg->session_lock);
 
-                iscsit_free_session(sess);
-                spin_lock_bh(&se_tpg->session_lock);
+                list_move_tail(&se_sess->sess_list, &free_list);
+        }
+        spin_unlock_bh(&se_tpg->session_lock);
+
+        list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+                sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
 
+                iscsit_free_session(sess);
                 session_count++;
         }
-        spin_unlock_bh(&se_tpg->session_lock);
 
         pr_debug("Released %d iSCSI Session(s) from Target Portal"
                         " Group: %hu\n", session_count, tpg->tpgt);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 3d0fe4ff5590..7e8f65e5448f 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -82,6 +82,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
         init_completion(&conn->conn_logout_comp);
         init_completion(&conn->rx_half_close_comp);
         init_completion(&conn->tx_half_close_comp);
+        init_completion(&conn->rx_login_comp);
         spin_lock_init(&conn->cmd_lock);
         spin_lock_init(&conn->conn_usage_lock);
         spin_lock_init(&conn->immed_queue_lock);
@@ -644,7 +645,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
                 iscsit_start_nopin_timer(conn);
 }
 
-static int iscsit_start_kthreads(struct iscsi_conn *conn)
+int iscsit_start_kthreads(struct iscsi_conn *conn)
 {
         int ret = 0;
 
@@ -679,6 +680,7 @@ static int iscsit_start_kthreads(struct iscsi_conn *conn)
 
         return 0;
 out_tx:
+        send_sig(SIGINT, conn->tx_thread, 1);
         kthread_stop(conn->tx_thread);
         conn->tx_thread_active = false;
 out_bitmap:
@@ -689,7 +691,7 @@ out_bitmap:
         return ret;
 }
 
-int iscsi_post_login_handler(
+void iscsi_post_login_handler(
         struct iscsi_np *np,
         struct iscsi_conn *conn,
         u8 zero_tsih)
@@ -699,7 +701,6 @@ int iscsi_post_login_handler(
         struct se_session *se_sess = sess->se_sess;
         struct iscsi_portal_group *tpg = sess->tpg;
         struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
-        int rc;
 
         iscsit_inc_conn_usage_count(conn);
 
@@ -739,10 +740,6 @@ int iscsi_post_login_handler(
                         sess->sess_ops->InitiatorName);
                 spin_unlock_bh(&sess->conn_lock);
 
-                rc = iscsit_start_kthreads(conn);
-                if (rc)
-                        return rc;
-
                 iscsi_post_login_start_timers(conn);
                 /*
                  * Determine CPU mask to ensure connection's RX and TX kthreads
@@ -751,15 +748,20 @@ int iscsi_post_login_handler(
                 iscsit_thread_get_cpumask(conn);
                 conn->conn_rx_reset_cpumask = 1;
                 conn->conn_tx_reset_cpumask = 1;
-
+                /*
+                 * Wakeup the sleeping iscsi_target_rx_thread() now that
+                 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
+                 */
+                complete(&conn->rx_login_comp);
                 iscsit_dec_conn_usage_count(conn);
+
                 if (stop_timer) {
                         spin_lock_bh(&se_tpg->session_lock);
                         iscsit_stop_time2retain_timer(sess);
                         spin_unlock_bh(&se_tpg->session_lock);
                 }
                 iscsit_dec_session_usage_count(sess);
-                return 0;
+                return;
         }
 
         iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
@@ -800,10 +802,6 @@ int iscsi_post_login_handler(
                 " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
         spin_unlock_bh(&se_tpg->session_lock);
 
-        rc = iscsit_start_kthreads(conn);
-        if (rc)
-                return rc;
-
         iscsi_post_login_start_timers(conn);
         /*
          * Determine CPU mask to ensure connection's RX and TX kthreads
@@ -812,10 +810,12 @@ int iscsi_post_login_handler(
         iscsit_thread_get_cpumask(conn);
         conn->conn_rx_reset_cpumask = 1;
         conn->conn_tx_reset_cpumask = 1;
-
+        /*
+         * Wakeup the sleeping iscsi_target_rx_thread() now that
+         * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
+         */
+        complete(&conn->rx_login_comp);
         iscsit_dec_conn_usage_count(conn);
-
-        return 0;
 }
 
 static void iscsi_handle_login_thread_timeout(unsigned long data)
@@ -1380,23 +1380,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         if (ret < 0)
                 goto new_sess_out;
 
-        if (!conn->sess) {
-                pr_err("struct iscsi_conn session pointer is NULL!\n");
-                goto new_sess_out;
-        }
-
         iscsi_stop_login_thread_timer(np);
 
-        if (signal_pending(current))
-                goto new_sess_out;
-
         if (ret == 1) {
                 tpg_np = conn->tpg_np;
 
-                ret = iscsi_post_login_handler(np, conn, zero_tsih);
-                if (ret < 0)
-                        goto new_sess_out;
-
+                iscsi_post_login_handler(np, conn, zero_tsih);
                 iscsit_deaccess_np(np, tpg, tpg_np);
         }
 
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 1c7358081533..57aa0d0fd820 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
 extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+extern int iscsit_start_kthreads(struct iscsi_conn *);
+extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
 extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
                                 bool, bool);
 extern int iscsi_target_login_thread(void *);
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 8c02fa34716f..f9cde9141836 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -17,6 +17,7 @@
  ******************************************************************************/
 
 #include <linux/ctype.h>
+#include <linux/kthread.h>
 #include <scsi/iscsi_proto.h>
 #include <target/target_core_base.h>
 #include <target/target_core_fabric.h>
@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
                 ntohl(login_rsp->statsn), login->rsp_length);
 
         padding = ((-login->rsp_length) & 3);
+        /*
+         * Before sending the last login response containing the transition
+         * bit for full-feature-phase, go ahead and start up TX/RX threads
+         * now to avoid potential resource allocation failures after the
+         * final login response has been sent.
+         */
+        if (login->login_complete) {
+                int rc = iscsit_start_kthreads(conn);
+                if (rc) {
+                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+                                            ISCSI_LOGIN_STATUS_NO_RESOURCES);
+                        return -1;
+                }
+        }
 
         if (conn->conn_transport->iscsit_put_login_tx(conn, login,
                                         login->rsp_length + padding) < 0)
-                return -1;
+                goto err;
 
         login->rsp_length               = 0;
         mutex_lock(&sess->cmdsn_mutex);
@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
         mutex_unlock(&sess->cmdsn_mutex);
 
         return 0;
+
+err:
+        if (login->login_complete) {
+                if (conn->rx_thread && conn->rx_thread_active) {
+                        send_sig(SIGINT, conn->rx_thread, 1);
+                        kthread_stop(conn->rx_thread);
+                }
+                if (conn->tx_thread && conn->tx_thread_active) {
+                        send_sig(SIGINT, conn->tx_thread, 1);
+                        kthread_stop(conn->tx_thread);
+                }
+                spin_lock(&iscsit_global->ts_bitmap_lock);
+                bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
+                                      get_order(1));
+                spin_unlock(&iscsit_global->ts_bitmap_lock);
+        }
+        return -1;
 }
 
 static void iscsi_target_sk_data_ready(struct sock *sk)
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 0b0de3647478..c2e9fea90b4a 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -747,7 +747,7 @@ static ssize_t store_pi_prot_type(struct se_dev_attrib *da,
         if (!dev->transport->init_prot || !dev->transport->free_prot) {
                 /* 0 is only allowed value for non-supporting backends */
                 if (flag == 0)
-                        return 0;
+                        return count;
 
                 pr_err("DIF protection not supported by backend: %s\n",
                        dev->transport->name);
@@ -1590,9 +1590,9 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
         u8 type = 0;
 
         if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
-                return 0;
+                return count;
         if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS)
-                return 0;
+                return count;
 
         if (dev->export_count) {
                 pr_debug("Unable to process APTPL metadata while"
@@ -1658,22 +1658,32 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                  * PR APTPL Metadata for Reservation
                  */
                 case Opt_res_holder:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         res_holder = arg;
                         break;
                 case Opt_res_type:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         type = (u8)arg;
                         break;
                 case Opt_res_scope:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         break;
                 case Opt_res_all_tg_pt:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         all_tg_pt = (int)arg;
                         break;
                 case Opt_mapped_lun:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         mapped_lun = (u64)arg;
                         break;
                 /*
@@ -1701,14 +1711,20 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                         }
                         break;
                 case Opt_tpgt:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         tpgt = (u16)arg;
                         break;
                 case Opt_port_rtpi:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         break;
                 case Opt_target_lun:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         target_lun = (u64)arg;
                         break;
                 default:
@@ -1985,7 +2001,7 @@ static ssize_t target_core_store_alua_lu_gp(
 
         lu_gp_mem = dev->dev_alua_lu_gp_mem;
         if (!lu_gp_mem)
-                return 0;
+                return count;
 
         if (count > LU_GROUP_NAME_BUF) {
                 pr_err("ALUA LU Group Alias too large!\n");
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 0fdbe43b7dad..5ab7100de17e 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1474,7 +1474,7 @@ core_scsi3_decode_spec_i_port(
         LIST_HEAD(tid_dest_list);
         struct pr_transport_id_holder *tidh_new, *tidh, *tidh_tmp;
         unsigned char *buf, *ptr, proto_ident;
-        const unsigned char *i_str;
+        const unsigned char *i_str = NULL;
         char *iport_ptr = NULL, i_buf[PR_REG_ISID_ID_LEN];
         sense_reason_t ret;
         u32 tpdl, tid_len = 0;
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 4703f403f31c..384cf8894411 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -333,6 +333,7 @@ static int rd_configure_device(struct se_device *dev)
         dev->dev_attrib.hw_block_size = RD_BLOCKSIZE;
         dev->dev_attrib.hw_max_sectors = UINT_MAX;
         dev->dev_attrib.hw_queue_depth = RD_MAX_DEVICE_QUEUE_DEPTH;
+        dev->dev_attrib.is_nonrot = 1;
 
         rd_dev->rd_dev_id = rd_host->rd_host_dev_id_count++;
 
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index b0744433315a..b5ba1ec3c354 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -454,10 +454,17 @@ spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
                     cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE1_PROT)
                         buf[4] = 0x5;
                 else if (dev->dev_attrib.pi_prot_type == TARGET_DIF_TYPE3_PROT ||
-                        cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE3_PROT)
+                         cmd->se_sess->sess_prot_type == TARGET_DIF_TYPE3_PROT)
                         buf[4] = 0x4;
         }
 
+        /* logical unit supports type 1 and type 3 protection */
+        if ((dev->transport->get_device_type(dev) == TYPE_DISK) &&
+            (sess->sup_prot_ops & (TARGET_PROT_DIN_PASS | TARGET_PROT_DOUT_PASS)) &&
+            (dev->dev_attrib.pi_prot_type || cmd->se_sess->sess_prot_type)) {
+                buf[4] |= (0x3 << 3);
+        }
+
         /* Set HEADSUP, ORDSUP, SIMPSUP */
         buf[5] = 0x07;
 
diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
index d5dd357ba57c..b49f97c734d0 100644
--- a/drivers/thermal/hisi_thermal.c
+++ b/drivers/thermal/hisi_thermal.c
@@ -405,7 +405,6 @@ static SIMPLE_DEV_PM_OPS(hisi_thermal_pm_ops,
 static struct platform_driver hisi_thermal_driver = {
         .driver = {
                 .name           = "hisi_thermal",
-                .owner          = THIS_MODULE,
                 .pm             = &hisi_thermal_pm_ops,
                 .of_match_table = of_hisi_thermal_match,
         },
diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
index 4672250b329f..63a448f9d93b 100644
--- a/drivers/thermal/power_allocator.c
+++ b/drivers/thermal/power_allocator.c
@@ -229,7 +229,8 @@ static int allocate_power(struct thermal_zone_device *tz,
         struct thermal_instance *instance;
         struct power_allocator_params *params = tz->governor_data;
         u32 *req_power, *max_power, *granted_power, *extra_actor_power;
-        u32 total_req_power, max_allocatable_power;
+        u32 *weighted_req_power;
+        u32 total_req_power, max_allocatable_power, total_weighted_req_power;
         u32 total_granted_power, power_range;
         int i, num_actors, total_weight, ret = 0;
         int trip_max_desired_temperature = params->trip_max_desired_temperature;
@@ -247,16 +248,17 @@ static int allocate_power(struct thermal_zone_device *tz,
         }
 
         /*
-         * We need to allocate three arrays of the same size:
-         * req_power, max_power and granted_power.  They are going to
-         * be needed until this function returns.  Allocate them all
-         * in one go to simplify the allocation and deallocation
-         * logic.
+         * We need to allocate five arrays of the same size:
+         * req_power, max_power, granted_power, extra_actor_power and
+         * weighted_req_power.  They are going to be needed until this
+         * function returns.  Allocate them all in one go to simplify
+         * the allocation and deallocation logic.
          */
         BUILD_BUG_ON(sizeof(*req_power) != sizeof(*max_power));
         BUILD_BUG_ON(sizeof(*req_power) != sizeof(*granted_power));
         BUILD_BUG_ON(sizeof(*req_power) != sizeof(*extra_actor_power));
-        req_power = devm_kcalloc(&tz->device, num_actors * 4,
+        BUILD_BUG_ON(sizeof(*req_power) != sizeof(*weighted_req_power));
+        req_power = devm_kcalloc(&tz->device, num_actors * 5,
                                  sizeof(*req_power), GFP_KERNEL);
         if (!req_power) {
                 ret = -ENOMEM;
@@ -266,8 +268,10 @@ static int allocate_power(struct thermal_zone_device *tz,
         max_power = &req_power[num_actors];
         granted_power = &req_power[2 * num_actors];
         extra_actor_power = &req_power[3 * num_actors];
+        weighted_req_power = &req_power[4 * num_actors];
 
         i = 0;
+        total_weighted_req_power = 0;
         total_req_power = 0;
         max_allocatable_power = 0;
 
@@ -289,13 +293,14 @@ static int allocate_power(struct thermal_zone_device *tz,
                 else
                         weight = instance->weight;
 
-                req_power[i] = frac_to_int(weight * req_power[i]);
+                weighted_req_power[i] = frac_to_int(weight * req_power[i]);
 
                 if (power_actor_get_max_power(cdev, tz, &max_power[i]))
                         continue;
 
                 total_req_power += req_power[i];
                 max_allocatable_power += max_power[i];
+                total_weighted_req_power += weighted_req_power[i];
 
                 i++;
         }
@@ -303,8 +308,9 @@ static int allocate_power(struct thermal_zone_device *tz,
         power_range = pid_controller(tz, current_temp, control_temp,
                                      max_allocatable_power);
 
-        divvy_up_power(req_power, max_power, num_actors, total_req_power,
-                       power_range, granted_power, extra_actor_power);
+        divvy_up_power(weighted_req_power, max_power, num_actors,
+                       total_weighted_req_power, power_range, granted_power,
+                       extra_actor_power);
 
         total_granted_power = 0;
         i = 0;
diff --git a/drivers/thermal/samsung/Kconfig b/drivers/thermal/samsung/Kconfig
index c8e35c1a43dc..e0da3865e060 100644
--- a/drivers/thermal/samsung/Kconfig
+++ b/drivers/thermal/samsung/Kconfig
@@ -1,6 +1,6 @@
 config EXYNOS_THERMAL
         tristate "Exynos thermal management unit driver"
-        depends on OF
+        depends on THERMAL_OF
         help
           If you say yes here you get support for the TMU (Thermal Management
           Unit) driver for SAMSUNG EXYNOS series of SoCs. This driver initialises
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 531f4b179871..c96ff10b869e 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -1296,7 +1296,6 @@ static struct thermal_zone_of_device_ops exynos_sensor_ops = {
 
 static int exynos_tmu_probe(struct platform_device *pdev)
 {
-        struct exynos_tmu_platform_data *pdata;
         struct exynos_tmu_data *data;
         int ret;
 
@@ -1318,8 +1317,6 @@ static int exynos_tmu_probe(struct platform_device *pdev)
         if (ret)
                 goto err_sensor;
 
-        pdata = data->pdata;
-
         INIT_WORK(&data->irq_work, exynos_tmu_work);
 
         data->clk = devm_clk_get(&pdev->dev, "tmu_apbif");
@@ -1392,6 +1389,8 @@ err_clk_sec:
         if (!IS_ERR(data->clk_sec))
                 clk_unprepare(data->clk_sec);
 err_sensor:
+        if (!IS_ERR_OR_NULL(data->regulator))
+                regulator_disable(data->regulator);
         thermal_zone_of_sensor_unregister(&pdev->dev, data->tzd);
 
         return ret;
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 04659bfb888b..4ca211be4c0f 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1333,6 +1333,7 @@ int thermal_zone_unbind_cooling_device(struct thermal_zone_device *tz,
         return -ENODEV;
 
 unbind:
+        device_remove_file(&tz->device, &pos->weight_attr);
         device_remove_file(&tz->device, &pos->attr);
         sysfs_remove_link(&tz->device.kobj, pos->name);
         release_idr(&tz->idr, &tz->lock, pos->id);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 74fea4fa41b1..3ad48e1c0c57 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -1024,7 +1024,18 @@ static struct platform_driver ci_hdrc_driver = {
         },
 };
 
-module_platform_driver(ci_hdrc_driver);
+static int __init ci_hdrc_platform_register(void)
+{
+        ci_hdrc_host_driver_init();
+        return platform_driver_register(&ci_hdrc_driver);
+}
+module_init(ci_hdrc_platform_register);
+
+static void __exit ci_hdrc_platform_unregister(void)
+{
+        platform_driver_unregister(&ci_hdrc_driver);
+}
+module_exit(ci_hdrc_platform_unregister);
 
 MODULE_ALIAS("platform:ci_hdrc");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 6cf87b8b13a8..7161439def19 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -249,9 +249,12 @@ int ci_hdrc_host_init(struct ci_hdrc *ci)
         rdrv->name      = "host";
         ci->roles[CI_ROLE_HOST] = rdrv;
 
+        return 0;
+}
+
+void ci_hdrc_host_driver_init(void)
+{
         ehci_init_driver(&ci_ehci_hc_driver, &ehci_ci_overrides);
         orig_bus_suspend = ci_ehci_hc_driver.bus_suspend;
         ci_ehci_hc_driver.bus_suspend = ci_ehci_bus_suspend;
-
-        return 0;
 }
diff --git a/drivers/usb/chipidea/host.h b/drivers/usb/chipidea/host.h
index 5707bf379bfb..0f12f131bdd3 100644
--- a/drivers/usb/chipidea/host.h
+++ b/drivers/usb/chipidea/host.h
@@ -5,6 +5,7 @@
 
 int ci_hdrc_host_init(struct ci_hdrc *ci);
 void ci_hdrc_host_destroy(struct ci_hdrc *ci);
+void ci_hdrc_host_driver_init(void);
 
 #else
 
@@ -18,6 +19,11 @@ static inline void ci_hdrc_host_destroy(struct ci_hdrc *ci)
 
 }
 
+static void ci_hdrc_host_driver_init(void)
+{
+
+}
+
 #endif
 
 #endif /* __DRIVERS_USB_CHIPIDEA_HOST_H */
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index f7f35a36c09a..6df9715a4bcd 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -699,6 +699,10 @@ static inline int hidg_get_minor(void)
         int ret;
 
         ret = ida_simple_get(&hidg_ida, 0, 0, GFP_KERNEL);
+        if (ret >= HIDG_MINORS) {
+                ida_simple_remove(&hidg_ida, ret);
+                ret = -ENODEV;
+        }
 
         return ret;
 }
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 44173df27273..357f63f47b42 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -1248,7 +1248,15 @@ static struct config_item_type printer_func_type = {
 
 static inline int gprinter_get_minor(void)
 {
-        return ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
+        int ret;
+
+        ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
+        if (ret >= PRINTER_MINORS) {
+                ida_simple_remove(&printer_ida, ret);
+                ret = -ENODEV;
+        }
+
+        return ret;
 }
 
 static inline void gprinter_put_minor(int minor)
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 6d3eb8b00a48..531861547253 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -1162,14 +1162,14 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt)
                         factor = 1000;
                 } else {
                         ep_desc = &hs_epin_desc;
-                        factor = 125;
+                        factor = 8000;
                 }
 
                 /* pre-compute some values for iso_complete() */
                 uac2->p_framesize = opts->p_ssize *
                                     num_channels(opts->p_chmask);
                 rate = opts->p_srate * uac2->p_framesize;
-                uac2->p_interval = (1 << (ep_desc->bInterval - 1)) * factor;
+                uac2->p_interval = factor / (1 << (ep_desc->bInterval - 1));
                 uac2->p_pktsize = min_t(unsigned int, rate / uac2->p_interval,
                                         prm->max_psize);
 
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index b04980cf6dc4..1efa61265d8d 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -779,7 +779,7 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
         /* The current hw dequeue pointer */
         tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS0(0));
         deq_ptr_64 = tmp_32;
-        tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS0(1));
+        tmp_32 = bdc_readl(bdc->regs, BDC_EPSTS1(0));
         deq_ptr_64 |= ((u64)tmp_32 << 32);
 
         /* we have the dma addr of next bd that will be fetched by hardware */
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index 362ee8af5fce..89ed5e71a199 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -323,6 +323,7 @@ err4:
 
 err3:
         put_device(&udc->dev);
+        device_del(&gadget->dev);
 
 err2:
         put_device(&gadget->dev);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 3e442f77a2b9..9a8c936cd42c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1792,7 +1792,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         int size;
         int i, j, num_ports;
 
-        del_timer_sync(&xhci->cmd_timer);
+        if (timer_pending(&xhci->cmd_timer))
+                del_timer_sync(&xhci->cmd_timer);
 
         /* Free the Event Ring Segment Table and the actual Event Ring */
         size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6a8fc52aed58..32f4d564494a 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -82,7 +82,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
                 return 0;
         /* offset in TRBs */
         segment_offset = trb - seg->trbs;
-        if (segment_offset > TRBS_PER_SEGMENT)
+        if (segment_offset >= TRBS_PER_SEGMENT)
                 return 0;
         return seg->dma + (segment_offset * sizeof(*trb));
 }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 19b85ee98a72..876423b8892c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1099,6 +1099,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
         { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x68c0, 0xff),
           .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC73xx */
+        { USB_DEVICE_INTERFACE_CLASS(SIERRA_VENDOR_ID, 0x9041, 0xff),
+          .driver_info = (kernel_ulong_t)&sierra_mc73xx_blacklist }, /* MC7305/MC7355 */
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 9c63897b3a56..d156545728c2 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -145,7 +145,6 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x901c)},   /* Sierra Wireless EM7700 */
         {DEVICE_SWI(0x1199, 0x901f)},   /* Sierra Wireless EM7355 */
         {DEVICE_SWI(0x1199, 0x9040)},   /* Sierra Wireless Modem */
-        {DEVICE_SWI(0x1199, 0x9041)},   /* Sierra Wireless MC7305/MC7355 */
         {DEVICE_SWI(0x1199, 0x9051)},   /* Netgear AirCard 340U */
         {DEVICE_SWI(0x1199, 0x9053)},   /* Sierra Wireless Modem */
         {DEVICE_SWI(0x1199, 0x9054)},   /* Sierra Wireless Modem */
@@ -158,6 +157,7 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a8)},   /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a9)},   /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {DEVICE_SWI(0x413c, 0x81b1)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 46179a0828eb..07d1ecd564f7 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -289,6 +289,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
+        { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */
         /* AT&T Direct IP LTE modems */
         { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 2fb29dfeffbd..563c510f285c 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -689,6 +689,23 @@ struct vfio_device *vfio_device_get_from_dev(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(vfio_device_get_from_dev);
 
+static struct vfio_device *vfio_device_get_from_name(struct vfio_group *group,
+                                                     char *buf)
+{
+        struct vfio_device *device;
+
+        mutex_lock(&group->device_lock);
+        list_for_each_entry(device, &group->device_list, group_next) {
+                if (!strcmp(dev_name(device->dev), buf)) {
+                        vfio_device_get(device);
+                        break;
+                }
+        }
+        mutex_unlock(&group->device_lock);
+
+        return device;
+}
+
 /*
  * Caller must hold a reference to the vfio_device
  */
@@ -1198,53 +1215,53 @@ static int vfio_group_get_device_fd(struct vfio_group *group, char *buf)
 {
         struct vfio_device *device;
         struct file *filep;
-        int ret = -ENODEV;
+        int ret;
 
         if (0 == atomic_read(&group->container_users) ||
             !group->container->iommu_driver || !vfio_group_viable(group))
                 return -EINVAL;
 
-        mutex_lock(&group->device_lock);
-        list_for_each_entry(device, &group->device_list, group_next) {
-                if (strcmp(dev_name(device->dev), buf))
-                        continue;
+        device = vfio_device_get_from_name(group, buf);
+        if (!device)
+                return -ENODEV;
 
-                ret = device->ops->open(device->device_data);
-                if (ret)
-                        break;
-                /*
-                 * We can't use anon_inode_getfd() because we need to modify
-                 * the f_mode flags directly to allow more than just ioctls
-                 */
-                ret = get_unused_fd_flags(O_CLOEXEC);
-                if (ret < 0) {
-                        device->ops->release(device->device_data);
-                        break;
-                }
+        ret = device->ops->open(device->device_data);
+        if (ret) {
+                vfio_device_put(device);
+                return ret;
+        }
 
-                filep = anon_inode_getfile("[vfio-device]", &vfio_device_fops,
-                                           device, O_RDWR);
-                if (IS_ERR(filep)) {
-                        put_unused_fd(ret);
-                        ret = PTR_ERR(filep);
-                        device->ops->release(device->device_data);
-                        break;
-                }
+        /*
+         * We can't use anon_inode_getfd() because we need to modify
+         * the f_mode flags directly to allow more than just ioctls
+         */
+        ret = get_unused_fd_flags(O_CLOEXEC);
+        if (ret < 0) {
+                device->ops->release(device->device_data);
+                vfio_device_put(device);
+                return ret;
+        }
 
-                /*
-                 * TODO: add an anon_inode interface to do this.
-                 * Appears to be missing by lack of need rather than
-                 * explicitly prevented.  Now there's need.
-                 */
-                filep->f_mode |= (FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
+        filep = anon_inode_getfile("[vfio-device]", &vfio_device_fops,
+                                   device, O_RDWR);
+        if (IS_ERR(filep)) {
+                put_unused_fd(ret);
+                ret = PTR_ERR(filep);
+                device->ops->release(device->device_data);
+                vfio_device_put(device);
+                return ret;
+        }
+
+        /*
+         * TODO: add an anon_inode interface to do this.
+         * Appears to be missing by lack of need rather than
+         * explicitly prevented.  Now there's need.
+         */
+        filep->f_mode |= (FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
 
-                vfio_device_get(device);
-                atomic_inc(&group->container_users);
+        atomic_inc(&group->container_users);
 
-                fd_install(ret, filep);
-                break;
-        }
-        mutex_unlock(&group->device_lock);
+        fd_install(ret, filep);
 
         return ret;
 }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index a9fe859f43c8..eec2f11809ff 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -683,11 +683,8 @@ static void *vhost_kvzalloc(unsigned long size)
 {
         void *n = kzalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
 
-        if (!n) {
+        if (!n)
                 n = vzalloc(size);
-                if (!n)
-                        return ERR_PTR(-ENOMEM);
-        }
         return n;
 }
 
@@ -995,6 +992,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
                 }
                 if (eventfp != d->log_file) {
                         filep = d->log_file;
+                        d->log_file = eventfp;
                         ctx = d->log_ctx;
                         d->log_ctx = eventfp ?
                                 eventfd_ctx_fileget(eventfp) : NULL;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 658c34bb9076..1aaf89300621 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1306,10 +1306,11 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
         int y;
         int c = scr_readw((u16 *) vc->vc_pos);
 
+        ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+
         if (fbcon_is_inactive(vc, info) || vc->vc_deccm != 1)
                 return;
 
-        ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
         if (vc->vc_cursor_type & 0x10)
                 fbcon_del_cursor_timer(info);
         else
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 2d98de535e0f..f888561568d9 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -298,7 +298,7 @@ config FB_ARMCLCD
 
 # Helper logic selected only by the ARM Versatile platform family.
 config PLAT_VERSATILE_CLCD
-        def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS
+        def_bool ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || ARCH_INTEGRATOR
         depends on ARM
         depends on FB_ARMCLCD && FB=y
 
diff --git a/drivers/video/fbdev/omap2/dss/dss-of.c b/drivers/video/fbdev/omap2/dss/dss-of.c
index 928ee639c0c1..bf407b6ba15c 100644
--- a/drivers/video/fbdev/omap2/dss/dss-of.c
+++ b/drivers/video/fbdev/omap2/dss/dss-of.c
@@ -60,6 +60,8 @@ omapdss_of_get_next_port(const struct device_node *parent,
                         }
                         prev = port;
                 } while (of_node_cmp(port->name, "port") != 0);
+
+                of_node_put(ports);
         }
 
         return port;
@@ -94,7 +96,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port)
         if (!port)
                 return NULL;
 
-        np = of_get_next_parent(port);
+        np = of_get_parent(port);
 
         for (i = 0; i < 2 && np; ++i) {
                 struct property *prop;
diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
index 86bd457d039d..50bce45e7f3d 100644
--- a/drivers/video/fbdev/pxa3xx-gcu.c
+++ b/drivers/video/fbdev/pxa3xx-gcu.c
@@ -653,7 +653,7 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev)
                 goto err_free_dma;
         }
 
-        ret = clk_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
         if (ret < 0) {
                 dev_err(dev, "failed to enable clock\n");
                 goto err_misc_deregister;
@@ -685,7 +685,7 @@ err_misc_deregister:
         misc_deregister(&priv->misc_dev);
 
 err_disable_clk:
-        clk_disable(priv->clk);
+        clk_disable_unprepare(priv->clk);
 
         return ret;
 }
diff --git a/drivers/video/of_videomode.c b/drivers/video/of_videomode.c
index 111c2d1911d3..b5102aa6090d 100644
--- a/drivers/video/of_videomode.c
+++ b/drivers/video/of_videomode.c
@@ -44,11 +44,9 @@ int of_get_videomode(struct device_node *np, struct videomode *vm,
                 index = disp->native_mode;
 
         ret = videomode_from_timings(disp, vm, index);
-        if (ret)
-                return ret;
 
         display_timings_release(disp);
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(of_get_videomode);
diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c
index 60e2a1677563..c96944b59856 100644
--- a/drivers/virtio/virtio_input.c
+++ b/drivers/virtio/virtio_input.c
@@ -313,6 +313,7 @@ err_init_vq:
 static void virtinput_remove(struct virtio_device *vdev)
 {
         struct virtio_input *vi = vdev->priv;
+        void *buf;
         unsigned long flags;
 
         spin_lock_irqsave(&vi->lock, flags);
@@ -320,6 +321,9 @@ static void virtinput_remove(struct virtio_device *vdev)
         spin_unlock_irqrestore(&vi->lock, flags);
 
         input_unregister_device(vi->idev);
+        vdev->config->reset(vdev);
+        while ((buf = virtqueue_detach_unused_buf(vi->sts)) != NULL)
+                kfree(buf);
         vdev->config->del_vqs(vdev);
         kfree(vi);
 }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index fd933695f232..bf4a23c7c591 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -472,7 +472,7 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 }
 
 /*
- * We avoid multiple worker processes conflicting via the balloon mutex.
+ * As this is a work item it is guaranteed to run as a single instance only.
  * We may of course race updates of the target counts (which are protected
  * by the balloon lock), or with changes to the Xen hard limit, but we will
  * recover from these in time.
@@ -482,9 +482,10 @@ static void balloon_process(struct work_struct *work)
         enum bp_state state = BP_DONE;
         long credit;
 
-        mutex_lock(&balloon_mutex);
 
         do {
+                mutex_lock(&balloon_mutex);
+
                 credit = current_credit();
 
                 if (credit > 0) {
@@ -499,17 +500,15 @@ static void balloon_process(struct work_struct *work)
 
                 state = update_schedule(state);
 
-#ifndef CONFIG_PREEMPT
-                if (need_resched())
-                        schedule();
-#endif
+                mutex_unlock(&balloon_mutex);
+
+                cond_resched();
+
         } while (credit && state == BP_DONE);
 
         /* Schedule more work if there is some still to be done. */
         if (state == BP_EAGAIN)
                 schedule_delayed_work(&balloon_worker, balloon_stats.schedule_delay * HZ);
-
-        mutex_unlock(&balloon_mutex);
 }
 
 /* Resets the Xen limit, sets new target, and kicks off processing. */
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 67b9163db718..0dbb222daaf1 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -568,12 +568,14 @@ static int gntdev_release(struct inode *inode, struct file *flip)
 
         pr_debug("priv %p\n", priv);
 
+        mutex_lock(&priv->lock);
         while (!list_empty(&priv->maps)) {
                 map = list_entry(priv->maps.next, struct grant_map, next);
                 list_del(&map->next);
                 gntdev_put_map(NULL /* already removed */, map);
         }
         WARN_ON(!list_empty(&priv->freeable_maps));
+        mutex_unlock(&priv->lock);
 
         if (use_ptemod)
                 mmu_notifier_unregister(&priv->mn, priv->mm);
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 9ad327238ba9..e30353575d5d 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -814,8 +814,10 @@ static int xenbus_unmap_ring_vfree_hvm(struct xenbus_device *dev, void *vaddr)
 
         rv = xenbus_unmap_ring(dev, node->handles, node->nr_handles,
                                addrs);
-        if (!rv)
+        if (!rv) {
                 vunmap(vaddr);
+                free_xenballooned_pages(node->nr_handles, node->hvm.pages);
+        }
         else
                 WARN(1, "Leaking %p, size %u page(s)\n", vaddr,
                      node->nr_handles);
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 862fbc206755..564a7de17d99 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -378,7 +378,7 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
 
         ret = btrfs_kobj_add_device(tgt_device->fs_devices, tgt_device);
         if (ret)
-                btrfs_error(root->fs_info, ret, "kobj add dev failed");
+                btrfs_err(root->fs_info, "kobj add dev failed %d\n", ret);
 
         printk_in_rcu(KERN_INFO
                       "BTRFS: dev_replace from %s (devid %llu) to %s started\n",
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index a9aadb2ad525..f556c3732c2c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2842,6 +2842,7 @@ int open_ctree(struct super_block *sb,
             !extent_buffer_uptodate(chunk_root->node)) {
                 printk(KERN_ERR "BTRFS: failed to read chunk root on %s\n",
                        sb->s_id);
+                chunk_root->node = NULL;
                 goto fail_tree_roots;
         }
         btrfs_set_root_node(&chunk_root->root_item, chunk_root->node);
@@ -2879,7 +2880,7 @@ retry_root_backup:
             !extent_buffer_uptodate(tree_root->node)) {
                 printk(KERN_WARNING "BTRFS: failed to read tree root on %s\n",
                        sb->s_id);
-
+                tree_root->node = NULL;
                 goto recovery_tree_root;
         }
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 171312d51799..07204bf601ed 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4227,6 +4227,24 @@ out:
         space_info->chunk_alloc = 0;
         spin_unlock(&space_info->lock);
         mutex_unlock(&fs_info->chunk_mutex);
+        /*
+         * When we allocate a new chunk we reserve space in the chunk block
+         * reserve to make sure we can COW nodes/leafs in the chunk tree or
+         * add new nodes/leafs to it if we end up needing to do it when
+         * inserting the chunk item and updating device items as part of the
+         * second phase of chunk allocation, performed by
+         * btrfs_finish_chunk_alloc(). So make sure we don't accumulate a
+         * large number of new block groups to create in our transaction
+         * handle's new_bgs list to avoid exhausting the chunk block reserve
+         * in extreme cases - like having a single transaction create many new
+         * block groups when starting to write out the free space caches of all
+         * the block groups that were made dirty during the lifetime of the
+         * transaction.
+         */
+        if (trans->chunk_bytes_reserved >= (2 * 1024 * 1024ull)) {
+                btrfs_create_pending_block_groups(trans, trans->root);
+                btrfs_trans_release_chunk_metadata(trans);
+        }
         return ret;
 }
 
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index e9ace099162c..8a8202956576 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1651,6 +1651,11 @@ static int qgroup_update_counters(struct btrfs_fs_info *fs_info,
                                 /* Exclusive -> exclusive, nothing changed */
                         }
                 }
+
+                /* For exclusive extent, free its reserved bytes too */
+                if (nr_old_roots == 0 && nr_new_roots == 1 &&
+                    cur_new_count == nr_new_roots)
+                        qg->reserved -= num_bytes;
                 if (dirty)
                         qgroup_dirty(fs_info, qg);
         }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 51e0f0d0053e..f5021fcb154e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2152,7 +2152,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 
-        if (current != root->fs_info->transaction_kthread)
+        if (current != root->fs_info->transaction_kthread &&
+            current != root->fs_info->cleaner_kthread)
                 btrfs_run_delayed_iputs(root);
 
         return ret;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index dc10c9dd36c1..ddd5e9471290 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1506,7 +1506,6 @@ static int __mark_caps_flushing(struct inode *inode,
 
         swap(cf, ci->i_prealloc_cap_flush);
         cf->caps = flushing;
-        cf->kick = false;
 
         spin_lock(&mdsc->cap_dirty_lock);
         list_del_init(&ci->i_dirty_item);
@@ -2123,8 +2122,7 @@ static void kick_flushing_capsnaps(struct ceph_mds_client *mdsc,
 
 static int __kick_flushing_caps(struct ceph_mds_client *mdsc,
                                 struct ceph_mds_session *session,
-                                struct ceph_inode_info *ci,
-                                bool kick_all)
+                                struct ceph_inode_info *ci)
 {
         struct inode *inode = &ci->vfs_inode;
         struct ceph_cap *cap;
@@ -2150,9 +2148,7 @@ static int __kick_flushing_caps(struct ceph_mds_client *mdsc,
 
                 for (n = rb_first(&ci->i_cap_flush_tree); n; n = rb_next(n)) {
                         cf = rb_entry(n, struct ceph_cap_flush, i_node);
-                        if (cf->tid < first_tid)
-                                continue;
-                        if (kick_all || cf->kick)
+                        if (cf->tid >= first_tid)
                                 break;
                 }
                 if (!n) {
@@ -2161,7 +2157,6 @@ static int __kick_flushing_caps(struct ceph_mds_client *mdsc,
                 }
 
                 cf = rb_entry(n, struct ceph_cap_flush, i_node);
-                cf->kick = false;
 
                 first_tid = cf->tid + 1;
 
@@ -2181,8 +2176,6 @@ void ceph_early_kick_flushing_caps(struct ceph_mds_client *mdsc,
 {
         struct ceph_inode_info *ci;
         struct ceph_cap *cap;
-        struct ceph_cap_flush *cf;
-        struct rb_node *n;
 
         dout("early_kick_flushing_caps mds%d\n", session->s_mds);
         list_for_each_entry(ci, &session->s_cap_flushing, i_flushing_item) {
@@ -2205,16 +2198,11 @@ void ceph_early_kick_flushing_caps(struct ceph_mds_client *mdsc,
                 if ((cap->issued & ci->i_flushing_caps) !=
                     ci->i_flushing_caps) {
                         spin_unlock(&ci->i_ceph_lock);
-                        if (!__kick_flushing_caps(mdsc, session, ci, true))
+                        if (!__kick_flushing_caps(mdsc, session, ci))
                                 continue;
                         spin_lock(&ci->i_ceph_lock);
                 }
 
-                for (n = rb_first(&ci->i_cap_flush_tree); n; n = rb_next(n)) {
-                        cf = rb_entry(n, struct ceph_cap_flush, i_node);
-                        cf->kick = true;
-                }
-
                 spin_unlock(&ci->i_ceph_lock);
         }
 }
@@ -2228,7 +2216,7 @@ void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
 
         dout("kick_flushing_caps mds%d\n", session->s_mds);
         list_for_each_entry(ci, &session->s_cap_flushing, i_flushing_item) {
-                int delayed = __kick_flushing_caps(mdsc, session, ci, false);
+                int delayed = __kick_flushing_caps(mdsc, session, ci);
                 if (delayed) {
                         spin_lock(&ci->i_ceph_lock);
                         __cap_delay_requeue(mdsc, ci);
@@ -2261,7 +2249,7 @@ static void kick_flushing_inode_caps(struct ceph_mds_client *mdsc,
 
                 spin_unlock(&ci->i_ceph_lock);
 
-                delayed = __kick_flushing_caps(mdsc, session, ci, true);
+                delayed = __kick_flushing_caps(mdsc, session, ci);
                 if (delayed) {
                         spin_lock(&ci->i_ceph_lock);
                         __cap_delay_requeue(mdsc, ci);
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index 4347039ecc18..6706bde9ad1b 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -287,7 +287,7 @@ int ceph_encode_locks_to_buffer(struct inode *inode,
                 return 0;
 
         spin_lock(&ctx->flc_lock);
-        list_for_each_entry(lock, &ctx->flc_flock, fl_list) {
+        list_for_each_entry(lock, &ctx->flc_posix, fl_list) {
                 ++seen_fcntl;
                 if (seen_fcntl > num_fcntl_locks) {
                         err = -ENOSPC;
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 860cc016e70d..2f2460d23a06 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -189,7 +189,6 @@ static inline void ceph_put_cap_snap(struct ceph_cap_snap *capsnap)
 struct ceph_cap_flush {
         u64 tid;
         int caps;
-        bool kick;
         struct rb_node g_node; // global
         union {
                 struct rb_node i_node; // inode
diff --git a/fs/dax.c b/fs/dax.c
index c3e21ccfc358..a7f77e1fa18c 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -319,6 +319,12 @@ static int dax_insert_mapping(struct inode *inode, struct buffer_head *bh,
  * @vma: The virtual memory area where the fault occurred
  * @vmf: The description of the fault
  * @get_block: The filesystem method used to translate file offsets to blocks
+ * @complete_unwritten: The filesystem method used to convert unwritten blocks
+ *      to written so the data written to them is exposed. This is required for
+ *      required by write faults for filesystems that will return unwritten
+ *      extent mappings from @get_block, but it is optional for reads as
+ *      dax_insert_mapping() will always zero unwritten blocks. If the fs does
+ *      not support unwritten extents, the it should pass NULL.
  *
  * When a page fault occurs, filesystems may call this helper in their
  * fault handler for DAX files. __dax_fault() assumes the caller has done all
@@ -437,8 +443,12 @@ int __dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf,
          * as for normal BH based IO completions.
          */
         error = dax_insert_mapping(inode, &bh, vma, vmf);
-        if (buffer_unwritten(&bh))
-                complete_unwritten(&bh, !error);
+        if (buffer_unwritten(&bh)) {
+                if (complete_unwritten)
+                        complete_unwritten(&bh, !error);
+                else
+                        WARN_ON_ONCE(!(vmf->flags & FAULT_FLAG_WRITE));
+        }
 
  out:
         if (error == -ENOMEM)
diff --git a/fs/dcache.c b/fs/dcache.c
index 5c8ea15e73a5..9b5fe503f6cb 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3442,22 +3442,15 @@ void __init vfs_caches_init_early(void)
         inode_init_early();
 }
 
-void __init vfs_caches_init(unsigned long mempages)
+void __init vfs_caches_init(void)
 {
-        unsigned long reserve;
-
-        /* Base hash sizes on available memory, with a reserve equal to
-           150% of current kernel size */
-
-        reserve = min((mempages - nr_free_pages()) * 3/2, mempages - 1);
-        mempages -= reserve;
-
         names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 
         dcache_init();
         inode_init();
-        files_init(mempages);
+        files_init();
+        files_maxfiles_init();
         mnt_init();
         bdev_cache_init();
         chrdev_init();
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 9bedfa8dd3a5..f71e19a9dd3c 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2072,8 +2072,6 @@ static int f2fs_set_data_page_dirty(struct page *page)
                 return 1;
         }
 
-        mark_inode_dirty(inode);
-
         if (!PageDirty(page)) {
                 __set_page_dirty_nobuffers(page);
                 update_dirty_page(inode, page);
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index ada2a3dd701a..b0f38c3b37f4 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1331,12 +1331,13 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)
         if (ret)
                 return ret;
 
-        if (f2fs_is_atomic_file(inode))
+        if (f2fs_is_atomic_file(inode)) {
+                clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
                 commit_inmem_pages(inode, false);
+        }
 
         ret = f2fs_sync_file(filp, 0, LONG_MAX, 0);
         mnt_drop_write_file(filp);
-        clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
         return ret;
 }
 
@@ -1387,8 +1388,8 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)
         f2fs_balance_fs(F2FS_I_SB(inode));
 
         if (f2fs_is_atomic_file(inode)) {
-                commit_inmem_pages(inode, false);
                 clear_inode_flag(F2FS_I(inode), FI_ATOMIC_FILE);
+                commit_inmem_pages(inode, false);
         }
 
         if (f2fs_is_volatile_file(inode))
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index e1e73617d13b..22fb5ef37966 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -556,27 +556,39 @@ static void move_encrypted_block(struct inode *inode, block_t bidx)
         if (!fio.encrypted_page)
                 goto put_out;
 
-        f2fs_submit_page_bio(&fio);
+        err = f2fs_submit_page_bio(&fio);
+        if (err)
+                goto put_page_out;
+
+        /* write page */
+        lock_page(fio.encrypted_page);
+
+        if (unlikely(!PageUptodate(fio.encrypted_page)))
+                goto put_page_out;
+        if (unlikely(fio.encrypted_page->mapping != META_MAPPING(fio.sbi)))
+                goto put_page_out;
+
+        set_page_dirty(fio.encrypted_page);
+        f2fs_wait_on_page_writeback(fio.encrypted_page, META);
+        if (clear_page_dirty_for_io(fio.encrypted_page))
+                dec_page_count(fio.sbi, F2FS_DIRTY_META);
+
+        set_page_writeback(fio.encrypted_page);
 
         /* allocate block address */
         f2fs_wait_on_page_writeback(dn.node_page, NODE);
-
         allocate_data_block(fio.sbi, NULL, fio.blk_addr,
                                         &fio.blk_addr, &sum, CURSEG_COLD_DATA);
-        dn.data_blkaddr = fio.blk_addr;
-
-        /* write page */
-        lock_page(fio.encrypted_page);
-        set_page_writeback(fio.encrypted_page);
         fio.rw = WRITE_SYNC;
         f2fs_submit_page_mbio(&fio);
 
+        dn.data_blkaddr = fio.blk_addr;
         set_data_blkaddr(&dn);
         f2fs_update_extent_cache(&dn);
         set_inode_flag(F2FS_I(inode), FI_APPEND_WRITE);
         if (page->index == 0)
                 set_inode_flag(F2FS_I(inode), FI_FIRST_BLOCK_WRITTEN);
-
+put_page_out:
         f2fs_put_page(fio.encrypted_page, 1);
 put_out:
         f2fs_put_dnode(&dn);
@@ -605,8 +617,8 @@ static void move_data_page(struct inode *inode, block_t bidx, int gc_type)
                         .page = page,
                         .encrypted_page = NULL,
                 };
+                set_page_dirty(page);
                 f2fs_wait_on_page_writeback(page, DATA);
-
                 if (clear_page_dirty_for_io(page))
                         inode_dec_dirty_pages(inode);
                 set_cold_data(page);
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 38e75fb1e488..a13ffcc32992 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -141,6 +141,8 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
         kunmap_atomic(dst_addr);
         SetPageUptodate(page);
 no_update:
+        set_page_dirty(page);
+
         /* clear dirty state */
         dirty = clear_page_dirty_for_io(page);
 
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 1eb343768781..61b97f9cb9f6 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -257,6 +257,7 @@ void commit_inmem_pages(struct inode *inode, bool abort)
                 if (!abort) {
                         lock_page(cur->page);
                         if (cur->page->mapping == inode->i_mapping) {
+                                set_page_dirty(cur->page);
                                 f2fs_wait_on_page_writeback(cur->page, DATA);
                                 if (clear_page_dirty_for_io(cur->page))
                                         inode_dec_dirty_pages(inode);
diff --git a/fs/file_table.c b/fs/file_table.c
index 7f9d407c7595..ad17e05ebf95 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -25,6 +25,7 @@
 #include <linux/hardirq.h>
 #include <linux/task_work.h>
 #include <linux/ima.h>
+#include <linux/swap.h>
 
 #include <linux/atomic.h>
 
@@ -308,19 +309,24 @@ void put_filp(struct file *file)
         }
 }
 
-void __init files_init(unsigned long mempages)
+void __init files_init(void)
 { 
-        unsigned long n;
-
         filp_cachep = kmem_cache_create("filp", sizeof(struct file), 0,
                         SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
+        percpu_counter_init(&nr_files, 0, GFP_KERNEL);
+}
 
-        /*
-         * One file with associated inode and dcache is very roughly 1K.
-         * Per default don't use more than 10% of our memory for files. 
-         */ 
+/*
+ * One file with associated inode and dcache is very roughly 1K. Per default
+ * do not use more than 10% of our memory for files.
+ */
+void __init files_maxfiles_init(void)
+{
+        unsigned long n;
+        unsigned long memreserve = (totalram_pages - nr_free_pages()) * 3/2;
+
+        memreserve = min(memreserve, totalram_pages - 1);
+        n = ((totalram_pages - memreserve) * (PAGE_SIZE / 1024)) / 10;
 
-        n = (mempages * (PAGE_SIZE / 1024)) / 10;
         files_stat.max_files = max_t(unsigned long, n, NR_FILE);
-        percpu_counter_init(&nr_files, 0, GFP_KERNEL);
 } 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 0cf74df68617..973c24ce59ad 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1010,6 +1010,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size,
         inode = hugetlbfs_get_inode(sb, NULL, S_IFREG | S_IRWXUGO, 0);
         if (!inode)
                 goto out_dentry;
+        if (creat_flags == HUGETLB_SHMFS_INODE)
+                inode->i_flags |= S_PRIVATE;
 
         file = ERR_PTR(-ENOMEM);
         if (hugetlb_reserve_pages(inode, 0,
diff --git a/fs/namei.c b/fs/namei.c
index ae4e4c18b2ac..1c2105ed20c5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -879,7 +879,7 @@ static inline int may_follow_link(struct nameidata *nd)
                 return 0;
 
         /* Allowed if parent directory not sticky and world-writable. */
-        parent = nd->path.dentry->d_inode;
+        parent = nd->inode;
         if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
                 return 0;
 
@@ -1954,8 +1954,13 @@ OK:
                                 continue;
                         }
                 }
-                if (unlikely(!d_can_lookup(nd->path.dentry)))
+                if (unlikely(!d_can_lookup(nd->path.dentry))) {
+                        if (nd->flags & LOOKUP_RCU) {
+                                if (unlazy_walk(nd, NULL, 0))
+                                        return -ECHILD;
+                        }
                         return -ENOTDIR;
+                }
         }
 }
 
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index ecebb406cc1a..4a90c9bb3135 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -775,7 +775,7 @@ static int nfs_init_server(struct nfs_server *server,
         server->options = data->options;
         server->caps |= NFS_CAP_HARDLINKS|NFS_CAP_SYMLINKS|NFS_CAP_FILEID|
                 NFS_CAP_MODE|NFS_CAP_NLINK|NFS_CAP_OWNER|NFS_CAP_OWNER_GROUP|
-                NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME|NFS_CAP_CHANGE_ATTR;
+                NFS_CAP_ATIME|NFS_CAP_CTIME|NFS_CAP_MTIME;
 
         if (data->rsize)
                 server->rsize = nfs_block_size(data->rsize, NULL);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index c12951b9551e..b3289d701eea 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1852,7 +1852,7 @@ ff_layout_mirror_prepare_stats(struct nfs42_layoutstat_args *args,
         struct nfs42_layoutstat_devinfo *devinfo;
         int i;
 
-        for (i = 0; i <= FF_LAYOUT_MIRROR_COUNT(pls); i++) {
+        for (i = 0; i < FF_LAYOUT_MIRROR_COUNT(pls); i++) {
                 if (*dev_count >= dev_limit)
                         break;
                 mirror = FF_LAYOUT_COMP(pls, i);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index b77b328a06d7..0adc7d245b3d 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -442,8 +442,9 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                         nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
                 if (fattr->valid & NFS_ATTR_FATTR_CHANGE)
                         inode->i_version = fattr->change_attr;
-                else if (nfs_server_capable(inode, NFS_CAP_CHANGE_ATTR))
-                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
+                else
+                        nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR
+                                | NFS_INO_REVAL_PAGECACHE);
                 if (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         inode->i_size = nfs_size_to_loff_t(fattr->size);
                 else
@@ -1244,9 +1245,11 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
         if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
                 cur_size = i_size_read(inode);
                 new_isize = nfs_size_to_loff_t(fattr->size);
-                if (cur_size != new_isize && nfsi->nrequests == 0)
+                if (cur_size != new_isize)
                         invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
         }
+        if (nfsi->nrequests != 0)
+                invalid &= ~NFS_INO_REVAL_PAGECACHE;
 
         /* Have any file permissions changed? */
         if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
@@ -1684,13 +1687,12 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         invalid |= NFS_INO_INVALID_ATTR
                                 | NFS_INO_INVALID_DATA
                                 | NFS_INO_INVALID_ACCESS
-                                | NFS_INO_INVALID_ACL
-                                | NFS_INO_REVAL_PAGECACHE;
+                                | NFS_INO_INVALID_ACL;
                         if (S_ISDIR(inode->i_mode))
                                 nfs_force_lookup_revalidate(inode);
                         inode->i_version = fattr->change_attr;
                 }
-        } else if (server->caps & NFS_CAP_CHANGE_ATTR)
+        } else
                 nfsi->cache_validity |= save_cache_validity;
 
         if (fattr->valid & NFS_ATTR_FATTR_MTIME) {
@@ -1717,7 +1719,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         if ((nfsi->nrequests == 0) || new_isize > cur_isize) {
                                 i_size_write(inode, new_isize);
                                 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
-                                invalid &= ~NFS_INO_REVAL_PAGECACHE;
                         }
                         dprintk("NFS: isize change on server for file %s/%ld "
                                         "(%Ld to %Ld)\n",
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 7e3c4604bea8..9b372b845f6a 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -296,6 +296,22 @@ extern struct rpc_procinfo nfs4_procedures[];
 
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
 extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
+static inline struct nfs4_label *
+nfs4_label_copy(struct nfs4_label *dst, struct nfs4_label *src)
+{
+        if (!dst || !src)
+                return NULL;
+
+        if (src->len > NFS4_MAXLABELLEN)
+                return NULL;
+
+        dst->lfs = src->lfs;
+        dst->pi = src->pi;
+        dst->len = src->len;
+        memcpy(dst->label, src->label, src->len);
+
+        return dst;
+}
 static inline void nfs4_label_free(struct nfs4_label *label)
 {
         if (label) {
@@ -316,6 +332,11 @@ static inline void nfs4_label_free(void *label) {}
 static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
 {
 }
+static inline struct nfs4_label *
+nfs4_label_copy(struct nfs4_label *dst, struct nfs4_label *src)
+{
+        return NULL;
+}
 #endif /* CONFIG_NFS_V4_SECURITY_LABEL */
 
 /* proc.c */
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index f486b80f927a..d731bbf974aa 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -135,7 +135,7 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len)
         return err;
 }
 
-loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
+static loff_t _nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
 {
         struct inode *inode = file_inode(filep);
         struct nfs42_seek_args args = {
@@ -171,6 +171,23 @@ loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
         return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
 }
 
+loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
+{
+        struct nfs_server *server = NFS_SERVER(file_inode(filep));
+        struct nfs4_exception exception = { };
+        int err;
+
+        do {
+                err = _nfs42_proc_llseek(filep, offset, whence);
+                if (err == -ENOTSUPP)
+                        return -EOPNOTSUPP;
+                err = nfs4_handle_exception(server, err, &exception);
+        } while (exception.retry);
+
+        return err;
+}
+
+
 static void
 nfs42_layoutstat_prepare(struct rpc_task *task, void *calldata)
 {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 8bee93469617..3acb1eb72930 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -467,7 +467,10 @@ static void do_renew_lease(struct nfs_client *clp, unsigned long timestamp)
 
 static void renew_lease(const struct nfs_server *server, unsigned long timestamp)
 {
-        do_renew_lease(server->nfs_client, timestamp);
+        struct nfs_client *clp = server->nfs_client;
+
+        if (!nfs4_has_session(clp))
+                do_renew_lease(clp, timestamp);
 }
 
 struct nfs4_call_sync_data {
@@ -616,8 +619,7 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
                 clp = session->clp;
                 do_renew_lease(clp, res->sr_timestamp);
                 /* Check sequence flags */
-                if (res->sr_status_flags != 0)
-                        nfs4_schedule_lease_recovery(clp);
+                nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
                 nfs41_update_target_slotid(slot->table, slot, res);
                 break;
         case 1:
@@ -910,6 +912,7 @@ struct nfs4_opendata {
         struct nfs_open_confirmres c_res;
         struct nfs4_string owner_name;
         struct nfs4_string group_name;
+        struct nfs4_label *a_label;
         struct nfs_fattr f_attr;
         struct nfs4_label *f_label;
         struct dentry *dir;
@@ -1013,6 +1016,10 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         if (IS_ERR(p->f_label))
                 goto err_free_p;
 
+        p->a_label = nfs4_label_alloc(server, gfp_mask);
+        if (IS_ERR(p->a_label))
+                goto err_free_f;
+
         alloc_seqid = server->nfs_client->cl_mvops->alloc_seqid;
         p->o_arg.seqid = alloc_seqid(&sp->so_seqid, gfp_mask);
         if (IS_ERR(p->o_arg.seqid))
@@ -1041,7 +1048,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         p->o_arg.server = server;
         p->o_arg.bitmask = nfs4_bitmask(server, label);
         p->o_arg.open_bitmap = &nfs4_fattr_bitmap[0];
-        p->o_arg.label = label;
+        p->o_arg.label = nfs4_label_copy(p->a_label, label);
         p->o_arg.claim = nfs4_map_atomic_open_claim(server, claim);
         switch (p->o_arg.claim) {
         case NFS4_OPEN_CLAIM_NULL:
@@ -1074,6 +1081,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         return p;
 
 err_free_label:
+        nfs4_label_free(p->a_label);
+err_free_f:
         nfs4_label_free(p->f_label);
 err_free_p:
         kfree(p);
@@ -1093,6 +1102,7 @@ static void nfs4_opendata_free(struct kref *kref)
                 nfs4_put_open_state(p->state);
         nfs4_put_state_owner(p->owner);
 
+        nfs4_label_free(p->a_label);
         nfs4_label_free(p->f_label);
 
         dput(p->dir);
@@ -1198,12 +1208,15 @@ static bool nfs_need_update_open_stateid(struct nfs4_state *state,
 
 static void nfs_resync_open_stateid_locked(struct nfs4_state *state)
 {
+        if (!(state->n_wronly || state->n_rdonly || state->n_rdwr))
+                return;
         if (state->n_wronly)
                 set_bit(NFS_O_WRONLY_STATE, &state->flags);
         if (state->n_rdonly)
                 set_bit(NFS_O_RDONLY_STATE, &state->flags);
         if (state->n_rdwr)
                 set_bit(NFS_O_RDWR_STATE, &state->flags);
+        set_bit(NFS_OPEN_STATE, &state->flags);
 }
 
 static void nfs_clear_open_stateid_locked(struct nfs4_state *state,
@@ -7571,13 +7584,8 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
                 goto out;
         }
         ret = rpc_wait_for_completion_task(task);
-        if (!ret) {
-                struct nfs4_sequence_res *res = task->tk_msg.rpc_resp;
-
-                if (task->tk_status == 0)
-                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
+        if (!ret)
                 ret = task->tk_status;
-        }
         rpc_put_task(task);
 out:
         dprintk("<-- %s status=%d\n", __func__, ret);
@@ -7965,16 +7973,17 @@ static void nfs4_layoutreturn_release(void *calldata)
 {
         struct nfs4_layoutreturn *lrp = calldata;
         struct pnfs_layout_hdr *lo = lrp->args.layout;
+        LIST_HEAD(freeme);
 
         dprintk("--> %s\n", __func__);
         spin_lock(&lo->plh_inode->i_lock);
         if (lrp->res.lrs_present)
                 pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
+        pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range);
         pnfs_clear_layoutreturn_waitbit(lo);
-        clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE, &lo->plh_flags);
-        rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
         lo->plh_block_lgets--;
         spin_unlock(&lo->plh_inode->i_lock);
+        pnfs_free_lseg_list(&freeme);
         pnfs_put_layout_hdr(lrp->args.layout);
         nfs_iput_and_deactive(lrp->inode);
         kfree(calldata);
@@ -8588,7 +8597,6 @@ static const struct nfs4_minor_version_ops nfs_v4_0_minor_ops = {
         .minor_version = 0,
         .init_caps = NFS_CAP_READDIRPLUS
                 | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                 | NFS_CAP_POSIX_LOCK,
         .init_client = nfs40_init_client,
         .shutdown_client = nfs40_shutdown_client,
@@ -8614,7 +8622,6 @@ static const struct nfs4_minor_version_ops nfs_v4_1_minor_ops = {
         .minor_version = 1,
         .init_caps = NFS_CAP_READDIRPLUS
                 | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                 | NFS_CAP_POSIX_LOCK
                 | NFS_CAP_STATEID_NFSV41
                 | NFS_CAP_ATOMIC_OPEN_V1,
@@ -8637,7 +8644,6 @@ static const struct nfs4_minor_version_ops nfs_v4_2_minor_ops = {
         .minor_version = 2,
         .init_caps = NFS_CAP_READDIRPLUS
                 | NFS_CAP_ATOMIC_OPEN
-                | NFS_CAP_CHANGE_ATTR
                 | NFS_CAP_POSIX_LOCK
                 | NFS_CAP_STATEID_NFSV41
                 | NFS_CAP_ATOMIC_OPEN_V1
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 605840dc89cf..f2e2ad894461 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2191,25 +2191,35 @@ static void nfs41_handle_server_reboot(struct nfs_client *clp)
         }
 }
 
-static void nfs41_handle_state_revoked(struct nfs_client *clp)
+static void nfs41_handle_all_state_revoked(struct nfs_client *clp)
 {
         nfs4_reset_all_state(clp);
         dprintk("%s: state revoked on server %s\n", __func__, clp->cl_hostname);
 }
 
+static void nfs41_handle_some_state_revoked(struct nfs_client *clp)
+{
+        nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_nograce);
+        nfs4_schedule_state_manager(clp);
+
+        dprintk("%s: state revoked on server %s\n", __func__, clp->cl_hostname);
+}
+
 static void nfs41_handle_recallable_state_revoked(struct nfs_client *clp)
 {
-        /* This will need to handle layouts too */
-        nfs_expire_all_delegations(clp);
+        /* FIXME: For now, we destroy all layouts. */
+        pnfs_destroy_all_layouts(clp);
+        /* FIXME: For now, we test all delegations+open state+locks. */
+        nfs41_handle_some_state_revoked(clp);
         dprintk("%s: Recallable state revoked on server %s!\n", __func__,
                         clp->cl_hostname);
 }
 
 static void nfs41_handle_backchannel_fault(struct nfs_client *clp)
 {
-        nfs_expire_all_delegations(clp);
-        if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
-                nfs4_schedule_state_manager(clp);
+        set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+        nfs4_schedule_state_manager(clp);
+
         dprintk("%s: server %s declared a backchannel fault\n", __func__,
                         clp->cl_hostname);
 }
@@ -2231,10 +2241,11 @@ void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
 
         if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
                 nfs41_handle_server_reboot(clp);
-        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
-                            SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
+        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED))
+                nfs41_handle_all_state_revoked(clp);
+        if (flags & (SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                             SEQ4_STATUS_ADMIN_STATE_REVOKED))
-                nfs41_handle_state_revoked(clp);
+                nfs41_handle_some_state_revoked(clp);
         if (flags & SEQ4_STATUS_LEASE_MOVED)
                 nfs4_schedule_lease_moved_recovery(clp);
         if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 1da68d3b1eda..4984bbe55ff1 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -1100,8 +1100,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                 mirror->pg_base = 0;
                 mirror->pg_recoalesce = 0;
 
-                desc->pg_moreio = 0;
-
                 while (!list_empty(&head)) {
                         struct nfs_page *req;
 
@@ -1109,8 +1107,11 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                         nfs_list_remove_request(req);
                         if (__nfs_pageio_add_request(desc, req))
                                 continue;
-                        if (desc->pg_error < 0)
+                        if (desc->pg_error < 0) {
+                                list_splice_tail(&head, &mirror->pg_list);
+                                mirror->pg_recoalesce = 1;
                                 return 0;
+                        }
                         break;
                 }
         } while (mirror->pg_recoalesce);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 0ba9a02c9566..70bf706b1090 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -352,7 +352,7 @@ pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
 {
         struct pnfs_layout_segment *s;
 
-        if (!test_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
+        if (!test_and_clear_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
                 return false;
 
         list_for_each_entry(s, &lo->plh_segs, pls_list)
@@ -362,6 +362,18 @@ pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
         return true;
 }
 
+static bool
+pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo)
+{
+        if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return false;
+        lo->plh_return_iomode = 0;
+        lo->plh_block_lgets++;
+        pnfs_get_layout_hdr(lo);
+        clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE, &lo->plh_flags);
+        return true;
+}
+
 static void pnfs_layoutreturn_before_put_lseg(struct pnfs_layout_segment *lseg,
                 struct pnfs_layout_hdr *lo, struct inode *inode)
 {
@@ -372,17 +384,16 @@ static void pnfs_layoutreturn_before_put_lseg(struct pnfs_layout_segment *lseg,
         if (pnfs_layout_need_return(lo, lseg)) {
                 nfs4_stateid stateid;
                 enum pnfs_iomode iomode;
+                bool send;
 
                 stateid = lo->plh_stateid;
                 iomode = lo->plh_return_iomode;
-                /* decreased in pnfs_send_layoutreturn() */
-                lo->plh_block_lgets++;
-                lo->plh_return_iomode = 0;
+                send = pnfs_prepare_layoutreturn(lo);
                 spin_unlock(&inode->i_lock);
-                pnfs_get_layout_hdr(lo);
-
-                /* Send an async layoutreturn so we dont deadlock */
-                pnfs_send_layoutreturn(lo, stateid, iomode, false);
+                if (send) {
+                        /* Send an async layoutreturn so we dont deadlock */
+                        pnfs_send_layoutreturn(lo, stateid, iomode, false);
+                }
         } else
                 spin_unlock(&inode->i_lock);
 }
@@ -411,6 +422,10 @@ pnfs_put_lseg(struct pnfs_layout_segment *lseg)
                 pnfs_layoutreturn_before_put_lseg(lseg, lo, inode);
 
         if (atomic_dec_and_lock(&lseg->pls_refcount, &inode->i_lock)) {
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags)) {
+                        spin_unlock(&inode->i_lock);
+                        return;
+                }
                 pnfs_get_layout_hdr(lo);
                 pnfs_layout_remove_lseg(lo, lseg);
                 spin_unlock(&inode->i_lock);
@@ -451,6 +466,8 @@ pnfs_put_lseg_locked(struct pnfs_layout_segment *lseg)
                 test_bit(NFS_LSEG_VALID, &lseg->pls_flags));
         if (atomic_dec_and_test(&lseg->pls_refcount)) {
                 struct pnfs_layout_hdr *lo = lseg->pls_layout;
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags))
+                        return;
                 pnfs_get_layout_hdr(lo);
                 pnfs_layout_remove_lseg(lo, lseg);
                 pnfs_free_lseg_async(lseg);
@@ -924,6 +941,7 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
         clear_bit_unlock(NFS_LAYOUT_RETURN, &lo->plh_flags);
         smp_mb__after_atomic();
         wake_up_bit(&lo->plh_flags, NFS_LAYOUT_RETURN);
+        rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 
 static int
@@ -978,6 +996,7 @@ _pnfs_return_layout(struct inode *ino)
         LIST_HEAD(tmp_list);
         nfs4_stateid stateid;
         int status = 0, empty;
+        bool send;
 
         dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino);
 
@@ -1007,17 +1026,18 @@ _pnfs_return_layout(struct inode *ino)
         /* Don't send a LAYOUTRETURN if list was initially empty */
         if (empty) {
                 spin_unlock(&ino->i_lock);
-                pnfs_put_layout_hdr(lo);
                 dprintk("NFS: %s no layout segments to return\n", __func__);
-                goto out;
+                goto out_put_layout_hdr;
         }
 
         set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-        lo->plh_block_lgets++;
+        send = pnfs_prepare_layoutreturn(lo);
         spin_unlock(&ino->i_lock);
         pnfs_free_lseg_list(&tmp_list);
-
-        status = pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, true);
+        if (send)
+                status = pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, true);
+out_put_layout_hdr:
+        pnfs_put_layout_hdr(lo);
 out:
         dprintk("<-- %s status: %d\n", __func__, status);
         return status;
@@ -1097,13 +1117,9 @@ bool pnfs_roc(struct inode *ino)
 out_noroc:
         if (lo) {
                 stateid = lo->plh_stateid;
-                layoutreturn =
-                        test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
-                                           &lo->plh_flags);
-                if (layoutreturn) {
-                        lo->plh_block_lgets++;
-                        pnfs_get_layout_hdr(lo);
-                }
+                if (test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                                           &lo->plh_flags))
+                        layoutreturn = pnfs_prepare_layoutreturn(lo);
         }
         spin_unlock(&ino->i_lock);
         if (layoutreturn) {
@@ -1146,15 +1162,18 @@ bool pnfs_roc_drain(struct inode *ino, u32 *barrier, struct rpc_task *task)
         struct pnfs_layout_segment *lseg;
         nfs4_stateid stateid;
         u32 current_seqid;
-        bool found = false, layoutreturn = false;
+        bool layoutreturn = false;
 
         spin_lock(&ino->i_lock);
-        list_for_each_entry(lseg, &nfsi->layout->plh_segs, pls_list)
-                if (test_bit(NFS_LSEG_ROC, &lseg->pls_flags)) {
-                        rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
-                        found = true;
-                        goto out;
-                }
+        list_for_each_entry(lseg, &nfsi->layout->plh_segs, pls_list) {
+                if (!test_bit(NFS_LSEG_ROC, &lseg->pls_flags))
+                        continue;
+                if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags))
+                        continue;
+                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+                spin_unlock(&ino->i_lock);
+                return true;
+        }
         lo = nfsi->layout;
         current_seqid = be32_to_cpu(lo->plh_stateid.seqid);
 
@@ -1162,23 +1181,19 @@ bool pnfs_roc_drain(struct inode *ino, u32 *barrier, struct rpc_task *task)
          * a barrier, we choose the worst-case barrier.
          */
         *barrier = current_seqid + atomic_read(&lo->plh_outstanding);
-out:
-        if (!found) {
-                stateid = lo->plh_stateid;
-                layoutreturn =
-                        test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
-                                           &lo->plh_flags);
-                if (layoutreturn) {
-                        lo->plh_block_lgets++;
-                        pnfs_get_layout_hdr(lo);
-                }
-        }
+        stateid = lo->plh_stateid;
+        if (test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                                           &lo->plh_flags))
+                layoutreturn = pnfs_prepare_layoutreturn(lo);
+        if (test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+
         spin_unlock(&ino->i_lock);
         if (layoutreturn) {
-                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
                 pnfs_send_layoutreturn(lo, stateid, IOMODE_ANY, false);
+                return true;
         }
-        return found;
+        return false;
 }
 
 /*
@@ -1695,7 +1710,6 @@ void pnfs_error_mark_layout_for_return(struct inode *inode,
         spin_lock(&inode->i_lock);
         /* set failure bit so that pnfs path will be retried later */
         pnfs_layout_set_fail_bit(lo, iomode);
-        set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
         if (lo->plh_return_iomode == 0)
                 lo->plh_return_iomode = range.iomode;
         else if (lo->plh_return_iomode != range.iomode)
@@ -2207,13 +2221,12 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
         if (ld->prepare_layoutcommit) {
                 status = ld->prepare_layoutcommit(&data->args);
                 if (status) {
+                        put_rpccred(data->cred);
                         spin_lock(&inode->i_lock);
                         set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags);
                         if (end_pos > nfsi->layout->plh_lwb)
                                 nfsi->layout->plh_lwb = end_pos;
-                        spin_unlock(&inode->i_lock);
-                        put_rpccred(data->cred);
-                        goto clear_layoutcommitting;
+                        goto out_unlock;
                 }
         }
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 65869ca9c851..75a35a1afa79 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1379,24 +1379,27 @@ static void nfs_writeback_check_extend(struct nfs_pgio_header *hdr,
 {
         struct nfs_pgio_args *argp = &hdr->args;
         struct nfs_pgio_res *resp = &hdr->res;
+        u64 size = argp->offset + resp->count;
 
         if (!(fattr->valid & NFS_ATTR_FATTR_SIZE))
+                fattr->size = size;
+        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode)) {
+                fattr->valid &= ~NFS_ATTR_FATTR_SIZE;
                 return;
-        if (argp->offset + resp->count != fattr->size)
-                return;
-        if (nfs_size_to_loff_t(fattr->size) < i_size_read(hdr->inode))
+        }
+        if (size != fattr->size)
                 return;
         /* Set attribute barrier */
         nfs_fattr_set_barrier(fattr);
+        /* ...and update size */
+        fattr->valid |= NFS_ATTR_FATTR_SIZE;
 }
 
 void nfs_writeback_update_inode(struct nfs_pgio_header *hdr)
 {
-        struct nfs_fattr *fattr = hdr->res.fattr;
+        struct nfs_fattr *fattr = &hdr->fattr;
         struct inode *inode = hdr->inode;
 
-        if (fattr == NULL)
-                return;
         spin_lock(&inode->i_lock);
         nfs_writeback_check_extend(hdr, fattr);
         nfs_post_op_update_inode_force_wcc_locked(inode, fattr);
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 6904213a4363..ebf90e487c75 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -212,6 +212,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
         BUG_ON(!ls->ls_file);
 
         if (nfsd4_layout_setlease(ls)) {
+                fput(ls->ls_file);
                 put_nfs4_file(fp);
                 kmem_cache_free(nfs4_layout_stateid_cache, ls);
                 return NULL;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 61dfb33f0559..95202719a1fd 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4396,9 +4396,9 @@ laundromat_main(struct work_struct *laundry)
         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
 }
 
-static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
+static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
 {
-        if (!fh_match(&fhp->fh_handle, &stp->st_stid.sc_file->fi_fhandle))
+        if (!fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
                 return nfserr_bad_stateid;
         return nfs_ok;
 }
@@ -4601,9 +4601,6 @@ nfs4_check_olstateid(struct svc_fh *fhp, struct nfs4_ol_stateid *ols, int flags)
 {
         __be32 status;
 
-        status = nfs4_check_fh(fhp, ols);
-        if (status)
-                return status;
         status = nfsd4_check_openowner_confirmed(ols);
         if (status)
                 return status;
@@ -4690,6 +4687,9 @@ nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
                 status = nfserr_bad_stateid;
                 break;
         }
+        if (status)
+                goto out;
+        status = nfs4_check_fh(fhp, s);
 
 done:
         if (!status && filpp)
@@ -4798,7 +4798,7 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_
         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
         if (status)
                 return status;
-        return nfs4_check_fh(current_fh, stp);
+        return nfs4_check_fh(current_fh, &stp->st_stid);
 }
 
 /* 
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 54633858733a..75e0563c09d1 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2143,6 +2143,7 @@ nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp,
 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
                               FATTR4_WORD0_RDATTR_ERROR)
 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
+#define WORD2_ABSENT_FS_ATTRS 0
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
 static inline __be32
@@ -2171,7 +2172,7 @@ nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
 { return 0; }
 #endif
 
-static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
+static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err)
 {
         /* As per referral draft:  */
         if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
@@ -2184,6 +2185,7 @@ static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
         }
         *bmval0 &= WORD0_ABSENT_FS_ATTRS;
         *bmval1 &= WORD1_ABSENT_FS_ATTRS;
+        *bmval2 &= WORD2_ABSENT_FS_ATTRS;
         return 0;
 }
 
@@ -2246,8 +2248,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
         BUG_ON(bmval2 & ~nfsd_suppattrs2(minorversion));
 
         if (exp->ex_fslocs.migrated) {
-                BUG_ON(bmval[2]);
-                status = fattr_handle_absent_fs(&bmval0, &bmval1, &rdattr_err);
+                status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err);
                 if (status)
                         goto out;
         }
@@ -2286,8 +2287,8 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
         }
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-        if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) ||
-                        bmval[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
+        if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) ||
+             bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
                 err = security_inode_getsecctx(d_inode(dentry),
                                                 &context, &contextlen);
                 contextsupport = (err == 0);
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 92e48c70f0f0..39ddcaf0918f 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -412,16 +412,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
                                          unsigned int flags)
 {
         struct fsnotify_mark *lmark, *mark;
+        LIST_HEAD(to_free);
 
+        /*
+         * We have to be really careful here. Anytime we drop mark_mutex, e.g.
+         * fsnotify_clear_marks_by_inode() can come and free marks. Even in our
+         * to_free list so we have to use mark_mutex even when accessing that
+         * list. And freeing mark requires us to drop mark_mutex. So we can
+         * reliably free only the first mark in the list. That's why we first
+         * move marks to free to to_free list in one go and then free marks in
+         * to_free list one by one.
+         */
         mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
         list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) {
-                if (mark->flags & flags) {
-                        fsnotify_get_mark(mark);
-                        fsnotify_destroy_mark_locked(mark, group);
-                        fsnotify_put_mark(mark);
-                }
+                if (mark->flags & flags)
+                        list_move(&mark->g_list, &to_free);
         }
         mutex_unlock(&group->mark_mutex);
+
+        while (1) {
+                mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
+                if (list_empty(&to_free)) {
+                        mutex_unlock(&group->mark_mutex);
+                        break;
+                }
+                mark = list_first_entry(&to_free, struct fsnotify_mark, g_list);
+                fsnotify_get_mark(mark);
+                fsnotify_destroy_mark_locked(mark, group);
+                mutex_unlock(&group->mark_mutex);
+                fsnotify_put_mark(mark);
+        }
 }
 
 /*
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 1a35c6139656..0f5fd9db8194 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -685,7 +685,7 @@ static int ocfs2_direct_IO_zero_extend(struct ocfs2_super *osb,
 
         if (p_cpos && !(ext_flags & OCFS2_EXT_UNWRITTEN)) {
                 u64 s = i_size_read(inode);
-                sector_t sector = (p_cpos << (osb->s_clustersize_bits - 9)) +
+                sector_t sector = ((u64)p_cpos << (osb->s_clustersize_bits - 9)) +
                         (do_div(s, osb->s_clustersize) >> 9);
 
                 ret = blkdev_issue_zeroout(osb->sb->s_bdev, sector,
@@ -910,7 +910,7 @@ static ssize_t ocfs2_direct_IO_write(struct kiocb *iocb,
                 BUG_ON(!p_cpos || (ext_flags & OCFS2_EXT_UNWRITTEN));
 
                 ret = blkdev_issue_zeroout(osb->sb->s_bdev,
-                                p_cpos << (osb->s_clustersize_bits - 9),
+                                (u64)p_cpos << (osb->s_clustersize_bits - 9),
                                 zero_len_head >> 9, GFP_NOFS, false);
                 if (ret < 0)
                         mlog_errno(ret);
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 8b23aa2f52dd..23157e40dd74 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -4025,9 +4025,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb)
         osb->dc_work_sequence = osb->dc_wake_sequence;
 
         processed = osb->blocked_lock_count;
-        while (processed) {
-                BUG_ON(list_empty(&osb->blocked_lock_list));
-
+        /*
+         * blocked lock processing in this loop might call iput which can
+         * remove items off osb->blocked_lock_list. Downconvert up to
+         * 'processed' number of locks, but stop short if we had some
+         * removed in ocfs2_mark_lockres_freeing when downconverting.
+         */
+        while (processed && !list_empty(&osb->blocked_lock_list)) {
                 lockres = list_entry(osb->blocked_lock_list.next,
                                      struct ocfs2_lock_res, l_blocked_list);
                 list_del_init(&lockres->l_blocked_list);
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 7e412ad74836..270221fcef42 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
                  * Other callers might not initialize the si_lsb field,
                  * so check explicitly for the right codes here.
                  */
-                if (kinfo->si_code == BUS_MCEERR_AR ||
-                    kinfo->si_code == BUS_MCEERR_AO)
+                if (kinfo->si_signo == SIGBUS &&
+                    (kinfo->si_code == BUS_MCEERR_AR ||
+                     kinfo->si_code == BUS_MCEERR_AO))
                         err |= __put_user((short) kinfo->si_addr_lsb,
                                           &uinfo->ssi_addr_lsb);
 #endif
diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
index 20de88d1bf86..dd714037c322 100644
--- a/fs/xfs/libxfs/xfs_attr_remote.c
+++ b/fs/xfs/libxfs/xfs_attr_remote.c
@@ -159,11 +159,10 @@ xfs_attr3_rmt_write_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
-        struct xfs_buf_log_item *bip = bp->b_fspriv;
+        int             blksize = mp->m_attr_geo->blksize;
         char            *ptr;
         int             len;
         xfs_daddr_t     bno;
-        int             blksize = mp->m_attr_geo->blksize;
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
@@ -175,16 +174,22 @@ xfs_attr3_rmt_write_verify(
         ASSERT(len >= blksize);
 
         while (len > 0) {
+                struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+
                 if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
                         xfs_buf_ioerror(bp, -EFSCORRUPTED);
                         xfs_verifier_error(bp);
                         return;
                 }
-                if (bip) {
-                        struct xfs_attr3_rmt_hdr *rmt;
 
-                        rmt = (struct xfs_attr3_rmt_hdr *)ptr;
-                        rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
+                /*
+                 * Ensure we aren't writing bogus LSNs to disk. See
+                 * xfs_attr3_rmt_hdr_set() for the explanation.
+                 */
+                if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
+                        xfs_buf_ioerror(bp, -EFSCORRUPTED);
+                        xfs_verifier_error(bp);
+                        return;
                 }
                 xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
 
@@ -221,6 +226,18 @@ xfs_attr3_rmt_hdr_set(
         rmt->rm_owner = cpu_to_be64(ino);
         rmt->rm_blkno = cpu_to_be64(bno);
 
+        /*
+         * Remote attribute blocks are written synchronously, so we don't
+         * have an LSN that we can stamp in them that makes any sense to log
+         * recovery. To ensure that log recovery handles overwrites of these
+         * blocks sanely (i.e. once they've been freed and reallocated as some
+         * other type of metadata) we need to ensure that the LSN has a value
+         * that tells log recovery to ignore the LSN and overwrite the buffer
+         * with whatever is in it's log. To do this, we use the magic
+         * NULLCOMMITLSN to indicate that the LSN is invalid.
+         */
+        rmt->rm_lsn = cpu_to_be64(NULLCOMMITLSN);
+
         return sizeof(struct xfs_attr3_rmt_hdr);
 }
 
@@ -434,14 +451,21 @@ xfs_attr_rmtval_set(
 
                 /*
                  * Allocate a single extent, up to the size of the value.
+                 *
+                 * Note that we have to consider this a data allocation as we
+                 * write the remote attribute without logging the contents.
+                 * Hence we must ensure that we aren't using blocks that are on
+                 * the busy list so that we don't overwrite blocks which have
+                 * recently been freed but their transactions are not yet
+                 * committed to disk. If we overwrite the contents of a busy
+                 * extent and then crash then the block may not contain the
+                 * correct metadata after log recovery occurs.
                  */
                 xfs_bmap_init(args->flist, args->firstblock);
                 nmap = 1;
                 error = xfs_bmapi_write(args->trans, dp, (xfs_fileoff_t)lblkno,
-                                  blkcnt,
-                                  XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
-                                  args->firstblock, args->total, &map, &nmap,
-                                  args->flist);
+                                  blkcnt, XFS_BMAPI_ATTRFORK, args->firstblock,
+                                  args->total, &map, &nmap, args->flist);
                 if (!error) {
                         error = xfs_bmap_finish(&args->trans, args->flist,
                                                 &committed);
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index f0e8249722d4..db4acc1c3e73 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1514,18 +1514,27 @@ xfs_filemap_fault(
         struct vm_area_struct   *vma,
         struct vm_fault         *vmf)
 {
-        struct xfs_inode        *ip = XFS_I(file_inode(vma->vm_file));
+        struct inode            *inode = file_inode(vma->vm_file);
         int                     ret;
 
-        trace_xfs_filemap_fault(ip);
+        trace_xfs_filemap_fault(XFS_I(inode));
 
         /* DAX can shortcut the normal fault path on write faults! */
-        if ((vmf->flags & FAULT_FLAG_WRITE) && IS_DAX(VFS_I(ip)))
+        if ((vmf->flags & FAULT_FLAG_WRITE) && IS_DAX(inode))
                 return xfs_filemap_page_mkwrite(vma, vmf);
 
-        xfs_ilock(ip, XFS_MMAPLOCK_SHARED);
-        ret = filemap_fault(vma, vmf);
-        xfs_iunlock(ip, XFS_MMAPLOCK_SHARED);
+        xfs_ilock(XFS_I(inode), XFS_MMAPLOCK_SHARED);
+        if (IS_DAX(inode)) {
+                /*
+                 * we do not want to trigger unwritten extent conversion on read
+                 * faults - that is unnecessary overhead and would also require
+                 * changes to xfs_get_blocks_direct() to map unwritten extent
+                 * ioend for conversion on read-only mappings.
+                 */
+                ret = __dax_fault(vma, vmf, xfs_get_blocks_direct, NULL);
+        } else
+                ret = filemap_fault(vma, vmf);
+        xfs_iunlock(XFS_I(inode), XFS_MMAPLOCK_SHARED);
 
         return ret;
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 01dd228ca05e..480ebba8464f 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1886,9 +1886,14 @@ xlog_recover_get_buf_lsn(
                 uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
                 break;
         case XFS_ATTR3_RMT_MAGIC:
-                lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
-                uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
-                break;
+                /*
+                 * Remote attr blocks are written synchronously, rather than
+                 * being logged. That means they do not contain a valid LSN
+                 * (i.e. transactionally ordered) in them, and hence any time we
+                 * see a buffer to replay over the top of a remote attribute
+                 * block we should simply do so.
+                 */
+                goto recover_immediately;
         case XFS_SB_MAGIC:
                 lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
                 uuid = &((struct xfs_dsb *)blk)->sb_uuid;
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 48db6a56975f..5aa519711e0b 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -691,7 +691,7 @@ struct drm_vblank_crtc {
         struct timer_list disable_timer;                /* delayed disable timer */
 
         /* vblank counter, protected by dev->vblank_time_lock for writes */
-        unsigned long count;
+        u32 count;
         /* vblank timestamps, protected by dev->vblank_time_lock for writes */
         struct timeval time[DRM_VBLANKTIME_RBSIZE];
 
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index c8fc187061de..918aa68b5199 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -168,6 +168,7 @@ struct drm_encoder_helper_funcs {
  * @get_modes: get mode list for this connector
  * @mode_valid: is this mode valid on the given connector? (optional)
  * @best_encoder: return the preferred encoder for this connector
+ * @atomic_best_encoder: atomic version of @best_encoder
  *
  * The helper operations are called by the mid-layer CRTC helper.
  */
@@ -176,6 +177,8 @@ struct drm_connector_helper_funcs {
         enum drm_mode_status (*mode_valid)(struct drm_connector *connector,
                                            struct drm_display_mode *mode);
         struct drm_encoder *(*best_encoder)(struct drm_connector *connector);
+        struct drm_encoder *(*atomic_best_encoder)(struct drm_connector *connector,
+                                                   struct drm_connector_state *connector_state);
 };
 
 extern void drm_helper_disable_unused_functions(struct drm_device *dev);
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 45c39a37f924..8bc073d297db 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -172,6 +172,7 @@
         {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6617, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6620, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 29ad97c34fd5..bde1e567b3a9 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -62,6 +62,7 @@ struct cpufreq_policy {
         /* CPUs sharing clock, require sw coordination */
         cpumask_var_t           cpus;   /* Online CPUs only */
         cpumask_var_t           related_cpus; /* Online + Offline CPUs */
+        cpumask_var_t           real_cpus; /* Related and present */
 
         unsigned int            shared_type; /* ACPI: ANY or ALL affected CPUs
                                                 should set cpufreq */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index cc008c338f5a..84b783f277f7 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -55,7 +55,8 @@ struct vm_fault;
 
 extern void __init inode_init(void);
 extern void __init inode_init_early(void);
-extern void __init files_init(unsigned long);
+extern void __init files_init(void);
+extern void __init files_maxfiles_init(void);
 
 extern struct files_stat_struct files_stat;
 extern unsigned long get_max_files(void);
@@ -2245,7 +2246,7 @@ extern int ioctl_preallocate(struct file *filp, void __user *argp);
 
 /* fs/dcache.c */
 extern void __init vfs_caches_init_early(void);
-extern void __init vfs_caches_init(unsigned long);
+extern void __init vfs_caches_init(void);
 
 extern struct kmem_cache *names_cachep;
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index f91b5ade30c9..874b77228fb9 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -292,9 +292,12 @@ static inline void nfs_mark_for_revalidate(struct inode *inode)
         struct nfs_inode *nfsi = NFS_I(inode);
 
         spin_lock(&inode->i_lock);
-        nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS;
+        nfsi->cache_validity |= NFS_INO_INVALID_ATTR |
+                                NFS_INO_REVAL_PAGECACHE |
+                                NFS_INO_INVALID_ACCESS |
+                                NFS_INO_INVALID_ACL;
         if (S_ISDIR(inode->i_mode))
-                nfsi->cache_validity |= NFS_INO_REVAL_PAGECACHE|NFS_INO_INVALID_DATA;
+                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
         spin_unlock(&inode->i_lock);
 }
 
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index a2ea1491d3df..20bc8e51b161 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -220,7 +220,7 @@ struct nfs_server {
 #define NFS_CAP_SYMLINKS        (1U << 2)
 #define NFS_CAP_ACLS            (1U << 3)
 #define NFS_CAP_ATOMIC_OPEN     (1U << 4)
-#define NFS_CAP_CHANGE_ATTR     (1U << 5)
+/* #define NFS_CAP_CHANGE_ATTR  (1U << 5) */
 #define NFS_CAP_FILEID          (1U << 6)
 #define NFS_CAP_MODE            (1U << 7)
 #define NFS_CAP_NLINK           (1U << 8)
diff --git a/include/linux/of_device.h b/include/linux/of_device.h
index 4c508549833a..cc7dd687a89d 100644
--- a/include/linux/of_device.h
+++ b/include/linux/of_device.h
@@ -59,7 +59,7 @@ void of_dma_configure(struct device *dev, struct device_node *np);
 #else /* CONFIG_OF */
 
 static inline int of_driver_match_device(struct device *dev,
-                                         struct device_driver *drv)
+                                         const struct device_driver *drv)
 {
         return 0;
 }
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index f34e040b34e9..41c93844fb1d 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -631,15 +631,19 @@ static inline void ClearPageSlabPfmemalloc(struct page *page)
          1 << PG_private | 1 << PG_private_2 | \
          1 << PG_writeback | 1 << PG_reserved | \
          1 << PG_slab    | 1 << PG_swapcache | 1 << PG_active | \
-         1 << PG_unevictable | __PG_MLOCKED | __PG_HWPOISON | \
+         1 << PG_unevictable | __PG_MLOCKED | \
          __PG_COMPOUND_LOCK)
 
 /*
  * Flags checked when a page is prepped for return by the page allocator.
- * Pages being prepped should not have any flags set.  It they are set,
+ * Pages being prepped should not have these flags set.  It they are set,
  * there has been a kernel bug or struct page corruption.
+ *
+ * __PG_HWPOISON is exceptional because it needs to be kept beyond page's
+ * alloc-free cycle to prevent from reusing the page.
  */
-#define PAGE_FLAGS_CHECK_AT_PREP        ((1 << NR_PAGEFLAGS) - 1)
+#define PAGE_FLAGS_CHECK_AT_PREP        \
+        (((1 << NR_PAGEFLAGS) - 1) & ~__PG_HWPOISON)
 
 #define PAGE_FLAGS_PRIVATE                              \
         (1 << PG_private | 1 << PG_private_2)
diff --git a/include/linux/platform_data/macb.h b/include/linux/platform_data/macb.h
index 044a124bfbbc..21b15f6fee25 100644
--- a/include/linux/platform_data/macb.h
+++ b/include/linux/platform_data/macb.h
@@ -8,11 +8,19 @@
 #ifndef __MACB_PDATA_H__
 #define __MACB_PDATA_H__
 
+/**
+ * struct macb_platform_data - platform data for MACB Ethernet
+ * @phy_mask:           phy mask passed when register the MDIO bus
+ *                      within the driver
+ * @phy_irq_pin:        PHY IRQ
+ * @is_rmii:            using RMII interface?
+ * @rev_eth_addr:       reverse Ethernet address byte order
+ */
 struct macb_platform_data {
         u32             phy_mask;
-        int             phy_irq_pin;    /* PHY IRQ */
-        u8              is_rmii;        /* using RMII interface? */
-        u8              rev_eth_addr;   /* reverse Ethernet address byte order */
+        int             phy_irq_pin;
+        u8              is_rmii;
+        u8              rev_eth_addr;
 };
 
 #endif /* __MACB_PDATA_H__ */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d6cdd6e87d53..22b6d9ca1654 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2884,11 +2884,11 @@ static inline bool skb_defer_rx_timestamp(struct sk_buff *skb)
  *
  * PHY drivers may accept clones of transmitted packets for
  * timestamping via their phy_driver.txtstamp method. These drivers
- * must call this function to return the skb back to the stack, with
- * or without a timestamp.
+ * must call this function to return the skb back to the stack with a
+ * timestamp.
  *
  * @skb: clone of the the original outgoing packet
- * @hwtstamps: hardware time stamps, may be NULL if not available
+ * @hwtstamps: hardware time stamps
  *
  */
 void skb_complete_tx_timestamp(struct sk_buff *skb,
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 3ee4c92afd1b..931738bc5bba 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -99,7 +99,6 @@ struct tc_action_ops {
 
 int tcf_hash_search(struct tc_action *a, u32 index);
 void tcf_hash_destroy(struct tc_action *a);
-int tcf_hash_release(struct tc_action *a, int bind);
 u32 tcf_hash_new_index(struct tcf_hashinfo *hinfo);
 int tcf_hash_check(u32 index, struct tc_action *a, int bind);
 int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a,
@@ -107,6 +106,13 @@ int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a,
 void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est);
 void tcf_hash_insert(struct tc_action *a);
 
+int __tcf_hash_release(struct tc_action *a, bool bind, bool strict);
+
+static inline int tcf_hash_release(struct tc_action *a, bool bind)
+{
+        return __tcf_hash_release(a, bind, false);
+}
+
 int tcf_register_action(struct tc_action_ops *a, unsigned int mask);
 int tcf_unregister_action(struct tc_action_ops *a);
 int tcf_action_destroy(struct list_head *actions, int bind);
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index e1300b3dd597..53eead2da743 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -21,13 +21,11 @@ struct netns_frags {
  * @INET_FRAG_FIRST_IN: first fragment has arrived
  * @INET_FRAG_LAST_IN: final fragment has arrived
  * @INET_FRAG_COMPLETE: frag queue has been processed and is due for destruction
- * @INET_FRAG_EVICTED: frag queue is being evicted
  */
 enum {
         INET_FRAG_FIRST_IN      = BIT(0),
         INET_FRAG_LAST_IN       = BIT(1),
         INET_FRAG_COMPLETE      = BIT(2),
-        INET_FRAG_EVICTED       = BIT(3)
 };
 
 /**
@@ -45,6 +43,7 @@ enum {
  * @flags: fragment queue flags
  * @max_size: maximum received fragment size
  * @net: namespace that this frag belongs to
+ * @list_evictor: list of queues to forcefully evict (e.g. due to low memory)
  */
 struct inet_frag_queue {
         spinlock_t              lock;
@@ -59,6 +58,7 @@ struct inet_frag_queue {
         __u8                    flags;
         u16                     max_size;
         struct netns_frags      *net;
+        struct hlist_node       list_evictor;
 };
 
 #define INETFRAGS_HASHSZ        1024
@@ -125,6 +125,11 @@ static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f
                 inet_frag_destroy(q, f);
 }
 
+static inline bool inet_frag_evicting(struct inet_frag_queue *q)
+{
+        return !hlist_unhashed(&q->list_evictor);
+}
+
 /* Memory Tracking Functions. */
 
 /* The default percpu_counter batch size is not big enough to scale to
@@ -139,14 +144,14 @@ static inline int frag_mem_limit(struct netns_frags *nf)
         return percpu_counter_read(&nf->mem);
 }
 
-static inline void sub_frag_mem_limit(struct inet_frag_queue *q, int i)
+static inline void sub_frag_mem_limit(struct netns_frags *nf, int i)
 {
-        __percpu_counter_add(&q->net->mem, -i, frag_percpu_counter_batch);
+        __percpu_counter_add(&nf->mem, -i, frag_percpu_counter_batch);
 }
 
-static inline void add_frag_mem_limit(struct inet_frag_queue *q, int i)
+static inline void add_frag_mem_limit(struct netns_frags *nf, int i)
 {
-        __percpu_counter_add(&q->net->mem, i, frag_percpu_counter_batch);
+        __percpu_counter_add(&nf->mem, i, frag_percpu_counter_batch);
 }
 
 static inline void init_frag_mem_limit(struct netns_frags *nf)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 49c142bdf01e..5fa643b4e891 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -183,7 +183,6 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
 struct fib_table {
         struct hlist_node       tb_hlist;
         u32                     tb_id;
-        int                     tb_default;
         int                     tb_num_default;
         struct rcu_head         rcu;
         unsigned long           *tb_data;
@@ -290,7 +289,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb);
 int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                         u8 tos, int oif, struct net_device *dev,
                         struct in_device *idev, u32 *itag);
-void fib_select_default(struct fib_result *res);
+void fib_select_default(const struct flowi4 *flp, struct fib_result *res);
 #ifdef CONFIG_IP_ROUTE_CLASSID
 static inline int fib_num_tclassid_users(struct net *net)
 {
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 095433b8a8b0..37cd3911d5c5 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -291,7 +291,7 @@ extern unsigned int nf_conntrack_max;
 extern unsigned int nf_conntrack_hash_rnd;
 void init_nf_conntrack_hash_rnd(void);
 
-void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl);
+struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags);
 
 #define NF_CT_STAT_INC(net, count)        __this_cpu_inc((net)->ct.stat->count)
 #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 29d6a94db54d..723b61c82b3f 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -68,7 +68,6 @@ struct ct_pcpu {
         spinlock_t              lock;
         struct hlist_nulls_head unconfirmed;
         struct hlist_nulls_head dying;
-        struct hlist_nulls_head tmpl;
 };
 
 struct netns_ct {
diff --git a/include/net/sock.h b/include/net/sock.h
index 05a8c1aea251..f21f0708ec59 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -902,7 +902,7 @@ void sk_stream_kill_queues(struct sock *sk);
 void sk_set_memalloc(struct sock *sk);
 void sk_clear_memalloc(struct sock *sk);
 
-int sk_wait_data(struct sock *sk, long *timeo);
+int sk_wait_data(struct sock *sk, long *timeo, const struct sk_buff *skb);
 
 struct request_sock_ops;
 struct timewait_sock_ops;
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 34117b8b72e4..0aedbb2c10e0 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -595,6 +595,7 @@ struct iscsi_conn {
         int                     bitmap_id;
         int                     rx_thread_active;
         struct task_struct      *rx_thread;
+        struct completion       rx_login_comp;
         int                     tx_thread_active;
         struct task_struct      *tx_thread;
         /* list_head for session connection list */
diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
index d708a53b8fb1..fbdd11851725 100644
--- a/include/uapi/drm/amdgpu_drm.h
+++ b/include/uapi/drm/amdgpu_drm.h
@@ -32,7 +32,7 @@
 #ifndef __AMDGPU_DRM_H__
 #define __AMDGPU_DRM_H__
 
-#include <drm/drm.h>
+#include "drm.h"
 
 #define DRM_AMDGPU_GEM_CREATE           0x00
 #define DRM_AMDGPU_GEM_MMAP             0x01
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index 1ef76661e1a1..01aa2a8e3f8d 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -33,7 +33,7 @@
 #ifndef __RADEON_DRM_H__
 #define __RADEON_DRM_H__
 
-#include <drm/drm.h>
+#include "drm.h"
 
 /* WARNING: If you change any of these defines, make sure to change the
  * defines in the X server file (radeon_sarea.h)
diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index efe3443572ba..413417f3707b 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -319,6 +319,7 @@
 #define PCI_MSIX_PBA            8       /* Pending Bit Array offset */
 #define  PCI_MSIX_PBA_BIR       0x00000007 /* BAR index */
 #define  PCI_MSIX_PBA_OFFSET    0xfffffff8 /* Offset into specified BAR */
+#define PCI_MSIX_FLAGS_BIRMASK  PCI_MSIX_PBA_BIR /* deprecated */
 #define PCI_CAP_MSIX_SIZEOF     12      /* size of MSIX registers */
 
 /* MSI-X Table entry format */
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index 12215205ab8d..51b8066a223b 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -77,7 +77,7 @@
 #define SND_SOC_TPLG_NUM_TEXTS          16
 
 /* ABI version */
-#define SND_SOC_TPLG_ABI_VERSION        0x2
+#define SND_SOC_TPLG_ABI_VERSION        0x3
 
 /* Max size of TLV data */
 #define SND_SOC_TPLG_TLV_SIZE           32
@@ -97,7 +97,8 @@
 #define SND_SOC_TPLG_TYPE_PCM           7
 #define SND_SOC_TPLG_TYPE_MANIFEST      8
 #define SND_SOC_TPLG_TYPE_CODEC_LINK    9
-#define SND_SOC_TPLG_TYPE_MAX   SND_SOC_TPLG_TYPE_CODEC_LINK
+#define SND_SOC_TPLG_TYPE_PDATA         10
+#define SND_SOC_TPLG_TYPE_MAX   SND_SOC_TPLG_TYPE_PDATA
 
 /* vendor block IDs - please add new vendor types to end */
 #define SND_SOC_TPLG_TYPE_VENDOR_FW     1000
@@ -110,7 +111,7 @@
 
 /*
  * Block Header.
- * This header preceeds all object and object arrays below.
+ * This header precedes all object and object arrays below.
  */
 struct snd_soc_tplg_hdr {
         __le32 magic;           /* magic number */
@@ -137,11 +138,19 @@ struct snd_soc_tplg_private {
 /*
  * Kcontrol TLV data.
  */
+struct snd_soc_tplg_tlv_dbscale {
+        __le32 min;
+        __le32 step;
+        __le32 mute;
+} __attribute__((packed));
+
 struct snd_soc_tplg_ctl_tlv {
-        __le32 size;    /* in bytes aligned to 4 */
-        __le32 numid;   /* control element numeric identification */
-        __le32 count;   /* number of elem in data array */
-        __le32 data[SND_SOC_TPLG_TLV_SIZE];
+        __le32 size;    /* in bytes of this structure */
+        __le32 type;    /* SNDRV_CTL_TLVT_*, type of TLV */
+        union {
+                __le32 data[SND_SOC_TPLG_TLV_SIZE];
+                struct snd_soc_tplg_tlv_dbscale scale;
+        };
 } __attribute__((packed));
 
 /*
@@ -155,9 +164,11 @@ struct snd_soc_tplg_channel {
 } __attribute__((packed));
 
 /*
- * Kcontrol Operations IDs
+ * Genericl Operations IDs, for binding Kcontrol or Bytes ext ops
+ * Kcontrol ops need get/put/info.
+ * Bytes ext ops need get/put.
  */
-struct snd_soc_tplg_kcontrol_ops_id {
+struct snd_soc_tplg_io_ops {
         __le32 get;
         __le32 put;
         __le32 info;
@@ -171,8 +182,8 @@ struct snd_soc_tplg_ctl_hdr {
         __le32 type;
         char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
         __le32 access;
-        struct snd_soc_tplg_kcontrol_ops_id ops;
-        __le32 tlv_size;        /* non zero means control has TLV data */
+        struct snd_soc_tplg_io_ops ops;
+        struct snd_soc_tplg_ctl_tlv tlv;
 } __attribute__((packed));
 
 /*
@@ -222,7 +233,7 @@ struct snd_soc_tplg_stream_config {
 /*
  * Manifest. List totals for each payload type. Not used in parsing, but will
  * be passed to the component driver before any other objects in order for any
- * global componnent resource allocations.
+ * global component resource allocations.
  *
  * File block representation for manifest :-
  * +-----------------------------------+----+
@@ -238,6 +249,7 @@ struct snd_soc_tplg_manifest {
         __le32 graph_elems;     /* number of graph elements */
         __le32 dai_elems;       /* number of DAI elements */
         __le32 dai_link_elems;  /* number of DAI link elements */
+        struct snd_soc_tplg_private priv;
 } __attribute__((packed));
 
 /*
@@ -259,7 +271,6 @@ struct snd_soc_tplg_mixer_control {
         __le32 invert;
         __le32 num_channels;
         struct snd_soc_tplg_channel channel[SND_SOC_TPLG_MAX_CHAN];
-        struct snd_soc_tplg_ctl_tlv tlv;
         struct snd_soc_tplg_private priv;
 } __attribute__((packed));
 
@@ -303,6 +314,7 @@ struct snd_soc_tplg_bytes_control {
         __le32 mask;
         __le32 base;
         __le32 num_regs;
+        struct snd_soc_tplg_io_ops ext_ops;
         struct snd_soc_tplg_private priv;
 } __attribute__((packed));
 
@@ -347,6 +359,7 @@ struct snd_soc_tplg_dapm_widget {
         __le32 reg;             /* negative reg = no direct dapm */
         __le32 shift;           /* bits to shift */
         __le32 mask;            /* non-shifted mask */
+        __le32 subseq;          /* sort within widget type */
         __u32 invert;           /* invert the power bit */
         __u32 ignore_suspend;   /* kept enabled over suspend */
         __u16 event_flags;
diff --git a/init/main.c b/init/main.c
index c5d5626289ce..56506553d4d8 100644
--- a/init/main.c
+++ b/init/main.c
@@ -656,7 +656,7 @@ asmlinkage __visible void __init start_kernel(void)
         key_init();
         security_init();
         dbg_late_init();
-        vfs_caches_init(totalram_pages);
+        vfs_caches_init();
         signals_init();
         /* rootfs populating might need page-writeback */
         page_writeback_init();
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index a24ba9fe5bb8..161a1807e6ef 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -142,7 +142,6 @@ static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info)
                 if (!leaf)
                         return -ENOMEM;
                 INIT_LIST_HEAD(&leaf->msg_list);
-                info->qsize += sizeof(*leaf);
         }
         leaf->priority = msg->m_type;
         rb_link_node(&leaf->rb_node, parent, p);
@@ -187,7 +186,6 @@ try_again:
                              "lazy leaf delete!\n");
                 rb_erase(&leaf->rb_node, &info->msg_tree);
                 if (info->node_cache) {
-                        info->qsize -= sizeof(*leaf);
                         kfree(leaf);
                 } else {
                         info->node_cache = leaf;
@@ -200,7 +198,6 @@ try_again:
                 if (list_empty(&leaf->msg_list)) {
                         rb_erase(&leaf->rb_node, &info->msg_tree);
                         if (info->node_cache) {
-                                info->qsize -= sizeof(*leaf);
                                 kfree(leaf);
                         } else {
                                 info->node_cache = leaf;
@@ -1034,7 +1031,6 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr,
                 /* Save our speculative allocation into the cache */
                 INIT_LIST_HEAD(&new_leaf->msg_list);
                 info->node_cache = new_leaf;
-                info->qsize += sizeof(*new_leaf);
                 new_leaf = NULL;
         } else {
                 kfree(new_leaf);
@@ -1142,7 +1138,6 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr,
                 /* Save our speculative allocation into the cache */
                 INIT_LIST_HEAD(&new_leaf->msg_list);
                 info->node_cache = new_leaf;
-                info->qsize += sizeof(*new_leaf);
         } else {
                 kfree(new_leaf);
         }
diff --git a/ipc/shm.c b/ipc/shm.c
index 06e5cf2fe019..4aef24d91b63 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -545,7 +545,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
                 if  ((shmflg & SHM_NORESERVE) &&
                                 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
                         acctflag = VM_NORESERVE;
-                file = shmem_file_setup(name, size, acctflag);
+                file = shmem_kernel_file_setup(name, size, acctflag);
         }
         error = PTR_ERR(file);
         if (IS_ERR(file))
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 10e489c448fe..fdea0bee7b5a 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -97,6 +97,7 @@ bool kthread_should_park(void)
 {
         return test_bit(KTHREAD_SHOULD_PARK, &to_kthread(current)->flags);
 }
+EXPORT_SYMBOL_GPL(kthread_should_park);
 
 /**
  * kthread_freezable_should_stop - should this freezable kthread return now?
@@ -171,6 +172,7 @@ void kthread_parkme(void)
 {
         __kthread_parkme(to_kthread(current));
 }
+EXPORT_SYMBOL_GPL(kthread_parkme);
 
 static int kthread(void *_create)
 {
@@ -411,6 +413,7 @@ void kthread_unpark(struct task_struct *k)
         if (kthread)
                 __kthread_unpark(k, kthread);
 }
+EXPORT_SYMBOL_GPL(kthread_unpark);
 
 /**
  * kthread_park - park a thread created by kthread_create().
@@ -441,6 +444,7 @@ int kthread_park(struct task_struct *k)
         }
         return ret;
 }
+EXPORT_SYMBOL_GPL(kthread_park);
 
 /**
  * kthread_stop - stop a thread created by kthread_create().
diff --git a/kernel/module.c b/kernel/module.c
index 4d2b82e610e2..b86b7bf1be38 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -602,13 +602,16 @@ const struct kernel_symbol *find_symbol(const char *name,
 }
 EXPORT_SYMBOL_GPL(find_symbol);
 
-/* Search for module by name: must hold module_mutex. */
+/*
+ * Search for module by name: must hold module_mutex (or preempt disabled
+ * for read-only access).
+ */
 static struct module *find_module_all(const char *name, size_t len,
                                       bool even_unformed)
 {
         struct module *mod;
 
-        module_assert_mutex();
+        module_assert_mutex_or_preempt();
 
         list_for_each_entry(mod, &modules, list) {
                 if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
@@ -621,6 +624,7 @@ static struct module *find_module_all(const char *name, size_t len,
 
 struct module *find_module(const char *name)
 {
+        module_assert_mutex();
         return find_module_all(name, strlen(name), false);
 }
 EXPORT_SYMBOL_GPL(find_module);
diff --git a/kernel/signal.c b/kernel/signal.c
index 836df8dac6cc..0f6bbbe77b46 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2748,12 +2748,15 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from)
                  * Other callers might not initialize the si_lsb field,
                  * so check explicitly for the right codes here.
                  */
-                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
+                if (from->si_signo == SIGBUS &&
+                    (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO))
                         err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
 #endif
 #ifdef SEGV_BNDERR
-                err |= __put_user(from->si_lower, &to->si_lower);
-                err |= __put_user(from->si_upper, &to->si_upper);
+                if (from->si_signo == SIGSEGV && from->si_code == SEGV_BNDERR) {
+                        err |= __put_user(from->si_lower, &to->si_lower);
+                        err |= __put_user(from->si_upper, &to->si_upper);
+                }
 #endif
                 break;
         case __SI_CHLD:
@@ -3017,7 +3020,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo,
                         int, sig,
                         struct compat_siginfo __user *, uinfo)
 {
-        siginfo_t info;
+        siginfo_t info = {};
         int ret = copy_siginfo_from_user32(&info, uinfo);
         if (unlikely(ret))
                 return ret;
@@ -3061,7 +3064,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo,
                         int, sig,
                         struct compat_siginfo __user *, uinfo)
 {
-        siginfo_t info;
+        siginfo_t info = {};
 
         if (copy_siginfo_from_user32(&info, uinfo))
                 return -EFAULT;
diff --git a/lib/iommu-common.c b/lib/iommu-common.c
index df30632f0bef..ff19f66d3f7f 100644
--- a/lib/iommu-common.c
+++ b/lib/iommu-common.c
@@ -119,7 +119,7 @@ unsigned long iommu_tbl_range_alloc(struct device *dev,
         unsigned long align_mask = 0;
 
         if (align_order > 0)
-                align_mask = 0xffffffffffffffffl >> (64 - align_order);
+                align_mask = ~0ul >> (BITS_PER_LONG - align_order);
 
         /* Sanity check */
         if (unlikely(npages == 0)) {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c107094f79ba..097c7a4bfbd9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1676,12 +1676,7 @@ static void __split_huge_page_refcount(struct page *page,
                 /* after clearing PageTail the gup refcount can be released */
                 smp_mb__after_atomic();
 
-                /*
-                 * retain hwpoison flag of the poisoned tail page:
-                 *   fix for the unsuitable process killed on Guest Machine(KVM)
-                 *   by the memory-failure.
-                 */
-                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP | __PG_HWPOISON;
+                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
                 page_tail->flags |= (page->flags &
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index c53543d89282..ea5a93659488 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -909,6 +909,18 @@ int get_hwpoison_page(struct page *page)
          * directly for tail pages.
          */
         if (PageTransHuge(head)) {
+                /*
+                 * Non anonymous thp exists only in allocation/free time. We
+                 * can't handle such a case correctly, so let's give it up.
+                 * This should be better than triggering BUG_ON when kernel
+                 * tries to touch the "partially handled" page.
+                 */
+                if (!PageAnon(head)) {
+                        pr_err("MCE: %#lx: non anonymous thp\n",
+                                page_to_pfn(page));
+                        return 0;
+                }
+
                 if (get_page_unless_zero(head)) {
                         if (PageTail(page))
                                 get_page(page);
@@ -1134,15 +1146,6 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
         }
 
         if (!PageHuge(p) && PageTransHuge(hpage)) {
-                if (!PageAnon(hpage)) {
-                        pr_err("MCE: %#lx: non anonymous thp\n", pfn);
-                        if (TestClearPageHWPoison(p))
-                                atomic_long_sub(nr_pages, &num_poisoned_pages);
-                        put_page(p);
-                        if (p != hpage)
-                                put_page(hpage);
-                        return -EBUSY;
-                }
                 if (unlikely(split_huge_page(hpage))) {
                         pr_err("MCE: %#lx: thp split failed\n", pfn);
                         if (TestClearPageHWPoison(p))
@@ -1209,9 +1212,9 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
         if (!PageHWPoison(p)) {
                 printk(KERN_ERR "MCE %#lx: just unpoisoned\n", pfn);
                 atomic_long_sub(nr_pages, &num_poisoned_pages);
+                unlock_page(hpage);
                 put_page(hpage);
-                res = 0;
-                goto out;
+                return 0;
         }
         if (hwpoison_filter(p)) {
                 if (TestClearPageHWPoison(p))
@@ -1656,6 +1659,8 @@ static int __soft_offline_page(struct page *page, int flags)
                 inc_zone_page_state(page, NR_ISOLATED_ANON +
                                         page_is_file_cache(page));
                 list_add(&page->lru, &pagelist);
+                if (!TestSetPageHWPoison(page))
+                        atomic_long_inc(&num_poisoned_pages);
                 ret = migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,
                                         MIGRATE_SYNC, MR_MEMORY_FAILURE);
                 if (ret) {
@@ -1670,9 +1675,8 @@ static int __soft_offline_page(struct page *page, int flags)
                                 pfn, ret, page->flags);
                         if (ret > 0)
                                 ret = -EIO;
-                } else {
-                        SetPageHWPoison(page);
-                        atomic_long_inc(&num_poisoned_pages);
+                        if (TestClearPageHWPoison(page))
+                                atomic_long_dec(&num_poisoned_pages);
                 }
         } else {
                 pr_info("soft offline: %#lx: isolation failed: %d, page count %d, type %lx\n",
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 26fbba7d888f..003dbe4b060d 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -446,7 +446,7 @@ static int __meminit __add_zone(struct zone *zone, unsigned long phys_start_pfn)
         int nr_pages = PAGES_PER_SECTION;
         int nid = pgdat->node_id;
         int zone_type;
-        unsigned long flags;
+        unsigned long flags, pfn;
         int ret;
 
         zone_type = zone - pgdat->node_zones;
@@ -461,6 +461,14 @@ static int __meminit __add_zone(struct zone *zone, unsigned long phys_start_pfn)
         pgdat_resize_unlock(zone->zone_pgdat, &flags);
         memmap_init_zone(nr_pages, nid, zone_type,
                          phys_start_pfn, MEMMAP_HOTPLUG);
+
+        /* online_page_range is called later and expects pages reserved */
+        for (pfn = phys_start_pfn; pfn < phys_start_pfn + nr_pages; pfn++) {
+                if (!pfn_valid(pfn))
+                        continue;
+
+                SetPageReserved(pfn_to_page(pfn));
+        }
         return 0;
 }
 
diff --git a/mm/migrate.c b/mm/migrate.c
index ee401e4e5ef1..eb4267107d1f 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -880,7 +880,8 @@ static int __unmap_and_move(struct page *page, struct page *newpage,
         /* Establish migration ptes or remove ptes */
         if (page_mapped(page)) {
                 try_to_unmap(page,
-                        TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
+                        TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS|
+                        TTU_IGNORE_HWPOISON);
                 page_was_mapped = 1;
         }
 
@@ -950,7 +951,10 @@ out:
                 list_del(&page->lru);
                 dec_zone_page_state(page, NR_ISOLATED_ANON +
                                 page_is_file_cache(page));
-                if (reason != MR_MEMORY_FAILURE)
+                /* Soft-offlined page shouldn't go through lru cache list */
+                if (reason == MR_MEMORY_FAILURE)
+                        put_page(page);
+                else
                         putback_lru_page(page);
         }
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 22cddd3e5de8..5cccc127ef81 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2063,10 +2063,10 @@ static struct notifier_block ratelimit_nb = {
  */
 void __init page_writeback_init(void)
 {
+        BUG_ON(wb_domain_init(&global_wb_domain, GFP_KERNEL));
+
         writeback_set_ratelimit();
         register_cpu_notifier(&ratelimit_nb);
-
-        BUG_ON(wb_domain_init(&global_wb_domain, GFP_KERNEL));
 }
 
 /**
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ef19f22b2b7d..beda41710802 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -18,7 +18,6 @@
 #include <linux/mm.h>
 #include <linux/swap.h>
 #include <linux/interrupt.h>
-#include <linux/rwsem.h>
 #include <linux/pagemap.h>
 #include <linux/jiffies.h>
 #include <linux/bootmem.h>
@@ -981,21 +980,21 @@ static void __init __free_pages_boot_core(struct page *page,
 
 #if defined(CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID) || \
         defined(CONFIG_HAVE_MEMBLOCK_NODE_MAP)
-/* Only safe to use early in boot when initialisation is single-threaded */
+
 static struct mminit_pfnnid_cache early_pfnnid_cache __meminitdata;
 
 int __meminit early_pfn_to_nid(unsigned long pfn)
 {
+        static DEFINE_SPINLOCK(early_pfn_lock);
         int nid;
 
-        /* The system will behave unpredictably otherwise */
-        BUG_ON(system_state != SYSTEM_BOOTING);
-
+        spin_lock(&early_pfn_lock);
         nid = __early_pfn_to_nid(pfn, &early_pfnnid_cache);
-        if (nid >= 0)
-                return nid;
-        /* just returns 0 */
-        return 0;
+        if (nid < 0)
+                nid = 0;
+        spin_unlock(&early_pfn_lock);
+
+        return nid;
 }
 #endif
 
@@ -1060,7 +1059,15 @@ static void __init deferred_free_range(struct page *page,
                 __free_pages_boot_core(page, pfn, 0);
 }
 
-static __initdata DECLARE_RWSEM(pgdat_init_rwsem);
+/* Completion tracking for deferred_init_memmap() threads */
+static atomic_t pgdat_init_n_undone __initdata;
+static __initdata DECLARE_COMPLETION(pgdat_init_all_done_comp);
+
+static inline void __init pgdat_init_report_one_done(void)
+{
+        if (atomic_dec_and_test(&pgdat_init_n_undone))
+                complete(&pgdat_init_all_done_comp);
+}
 
 /* Initialise remaining memory on a node */
 static int __init deferred_init_memmap(void *data)
@@ -1077,7 +1084,7 @@ static int __init deferred_init_memmap(void *data)
         const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id);
 
         if (first_init_pfn == ULONG_MAX) {
-                up_read(&pgdat_init_rwsem);
+                pgdat_init_report_one_done();
                 return 0;
         }
 
@@ -1177,7 +1184,8 @@ free_range:
 
         pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_pages,
                                         jiffies_to_msecs(jiffies - start));
-        up_read(&pgdat_init_rwsem);
+
+        pgdat_init_report_one_done();
         return 0;
 }
 
@@ -1185,14 +1193,17 @@ void __init page_alloc_init_late(void)
 {
         int nid;
 
+        /* There will be num_node_state(N_MEMORY) threads */
+        atomic_set(&pgdat_init_n_undone, num_node_state(N_MEMORY));
         for_each_node_state(nid, N_MEMORY) {
-                down_read(&pgdat_init_rwsem);
                 kthread_run(deferred_init_memmap, NODE_DATA(nid), "pgdatinit%d", nid);
         }
 
         /* Block until all are initialised */
-        down_write(&pgdat_init_rwsem);
-        up_write(&pgdat_init_rwsem);
+        wait_for_completion(&pgdat_init_all_done_comp);
+
+        /* Reinit limits that are based on free pages after the kernel is up */
+        files_maxfiles_init();
 }
 #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */
 
@@ -1285,6 +1296,10 @@ static inline int check_new_page(struct page *page)
                 bad_reason = "non-NULL mapping";
         if (unlikely(atomic_read(&page->_count) != 0))
                 bad_reason = "nonzero _count";
+        if (unlikely(page->flags & __PG_HWPOISON)) {
+                bad_reason = "HWPoisoned (hardware-corrupted)";
+                bad_flags = __PG_HWPOISON;
+        }
         if (unlikely(page->flags & PAGE_FLAGS_CHECK_AT_PREP)) {
                 bad_reason = "PAGE_FLAGS_CHECK_AT_PREP flag set";
                 bad_flags = PAGE_FLAGS_CHECK_AT_PREP;
diff --git a/mm/shmem.c b/mm/shmem.c
index 4caf8ed24d65..dbe0c1e8349c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3363,8 +3363,8 @@ put_path:
  * shmem_kernel_file_setup - get an unlinked file living in tmpfs which must be
  *      kernel internal.  There will be NO LSM permission checks against the
  *      underlying inode.  So users of this interface must do LSM checks at a
- *      higher layer.  The one user is the big_key implementation.  LSM checks
- *      are provided at the key level rather than the inode level.
+ *      higher layer.  The users are the big_key and shm implementations.  LSM
+ *      checks are provided at the key or shm level rather than the inode.
  * @name: name for dentry (to be seen in /proc/<pid>/maps
  * @size: size to be set for the file
  * @flags: VM_NORESERVE suppresses pre-accounting of the entire object size
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 3e5f8f29c286..86831105a09f 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -37,8 +37,7 @@ struct kmem_cache *kmem_cache;
                 SLAB_TRACE | SLAB_DESTROY_BY_RCU | SLAB_NOLEAKTRACE | \
                 SLAB_FAILSLAB)
 
-#define SLAB_MERGE_SAME (SLAB_DEBUG_FREE | SLAB_RECLAIM_ACCOUNT | \
-                SLAB_CACHE_DMA | SLAB_NOTRACK)
+#define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | SLAB_NOTRACK)
 
 /*
  * Merge control. If this is set then no merging of slab caches will occur.
diff --git a/mm/vmscan.c b/mm/vmscan.c
index e61445dce04e..8286938c70de 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -973,22 +973,18 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                  *    caller can stall after page list has been processed.
                  *
                  * 2) Global or new memcg reclaim encounters a page that is
-                 *    not marked for immediate reclaim or the caller does not
-                 *    have __GFP_IO. In this case mark the page for immediate
+                 *    not marked for immediate reclaim, or the caller does not
+                 *    have __GFP_FS (or __GFP_IO if it's simply going to swap,
+                 *    not to fs). In this case mark the page for immediate
                  *    reclaim and continue scanning.
                  *
-                 *    __GFP_IO is checked  because a loop driver thread might
+                 *    Require may_enter_fs because we would wait on fs, which
+                 *    may not have submitted IO yet. And the loop driver might
                  *    enter reclaim, and deadlock if it waits on a page for
                  *    which it is needed to do the write (loop masks off
                  *    __GFP_IO|__GFP_FS for this reason); but more thought
                  *    would probably show more reasons.
                  *
-                 *    Don't require __GFP_FS, since we're not going into the
-                 *    FS, just waiting on its writeback completion. Worryingly,
-                 *    ext4 gfs2 and xfs allocate pages with
-                 *    grab_cache_page_write_begin(,,AOP_FLAG_NOFS), so testing
-                 *    may_enter_fs here is liable to OOM on them.
-                 *
                  * 3) Legacy memcg encounters a page that is not already marked
                  *    PageReclaim. memcg does not have any dirty pages
                  *    throttling so we could easily OOM just because too many
@@ -1005,7 +1001,7 @@ static unsigned long shrink_page_list(struct list_head *page_list,
 
                         /* Case 2 above */
                         } else if (sane_reclaim(sc) ||
-                            !PageReclaim(page) || !(sc->gfp_mask & __GFP_IO)) {
+                            !PageReclaim(page) || !may_enter_fs) {
                                 /*
                                  * This is slightly racy - end_page_writeback()
                                  * might have just cleared PageReclaim, then
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index fb54e6aed096..6d0b471eede8 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1138,6 +1138,9 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: packet to check
  * @hdr_size: size of the encapsulation header
+ *
+ * Returns true if the packet was snooped and consumed by DAT. False if the
+ * packet has to be delivered to the interface
  */
 bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
                                          struct sk_buff *skb, int hdr_size)
@@ -1145,7 +1148,7 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
         uint16_t type;
         __be32 ip_src, ip_dst;
         uint8_t *hw_src, *hw_dst;
-        bool ret = false;
+        bool dropped = false;
         unsigned short vid;
 
         if (!atomic_read(&bat_priv->distributed_arp_table))
@@ -1174,12 +1177,17 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
         /* if this REPLY is directed to a client of mine, let's deliver the
          * packet to the interface
          */
-        ret = !batadv_is_my_client(bat_priv, hw_dst, vid);
+        dropped = !batadv_is_my_client(bat_priv, hw_dst, vid);
+
+        /* if this REPLY is sent on behalf of a client of mine, let's drop the
+         * packet because the client will reply by itself
+         */
+        dropped |= batadv_is_my_client(bat_priv, hw_src, vid);
 out:
-        if (ret)
+        if (dropped)
                 kfree_skb(skb);
-        /* if ret == false -> packet has to be delivered to the interface */
-        return ret;
+        /* if dropped == false -> deliver to the interface */
+        return dropped;
 }
 
 /**
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index bb0158620628..cffa92dd9877 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -439,6 +439,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
 
         INIT_HLIST_NODE(&gw_node->list);
         gw_node->orig_node = orig_node;
+        gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
+        gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
         atomic_set(&gw_node->refcount, 1);
 
         spin_lock_bh(&bat_priv->gw.list_lock);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index c002961da75d..a2fc843c2243 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -479,6 +479,9 @@ out:
  */
 void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
 {
+        if (!vlan)
+                return;
+
         if (atomic_dec_and_test(&vlan->refcount)) {
                 spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
                 hlist_del_rcu(&vlan->list);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b4824951010b..5e953297d3b2 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -594,6 +594,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
         /* increase the refcounter of the related vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
+        if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
+                 addr, BATADV_PRINT_VID(vid)))
+                goto out;
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
@@ -1034,6 +1037,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
         struct batadv_tt_local_entry *tt_local_entry;
         uint16_t flags, curr_flags = BATADV_NO_FLAGS;
         struct batadv_softif_vlan *vlan;
+        void *tt_entry_exists;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1061,11 +1065,22 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
          * immediately purge it
          */
         batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
-        hlist_del_rcu(&tt_local_entry->common.hash_entry);
+
+        tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
+                                             batadv_compare_tt,
+                                             batadv_choose_tt,
+                                             &tt_local_entry->common);
+        if (!tt_entry_exists)
+                goto out;
+
+        /* extra call to free the local tt entry */
         batadv_tt_local_entry_free_ref(tt_local_entry);
 
         /* decrease the reference held for this vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
+        if (!vlan)
+                goto out;
+
         batadv_softif_vlan_free_ref(vlan);
         batadv_softif_vlan_free_ref(vlan);
 
@@ -1166,8 +1181,10 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                         /* decrease the reference held for this vlan */
                         vlan = batadv_softif_vlan_get(bat_priv,
                                                       tt_common_entry->vid);
-                        batadv_softif_vlan_free_ref(vlan);
-                        batadv_softif_vlan_free_ref(vlan);
+                        if (vlan) {
+                                batadv_softif_vlan_free_ref(vlan);
+                                batadv_softif_vlan_free_ref(vlan);
+                        }
 
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
@@ -3207,8 +3224,10 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
 
                         /* decrease the reference held for this vlan */
                         vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
-                        batadv_softif_vlan_free_ref(vlan);
-                        batadv_softif_vlan_free_ref(vlan);
+                        if (vlan) {
+                                batadv_softif_vlan_free_ref(vlan);
+                                batadv_softif_vlan_free_ref(vlan);
+                        }
 
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7998fb279165..92720f3fe573 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7820,7 +7820,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
         /* Make sure we copy only the significant bytes based on the
          * encryption key size, and set the rest of the value to zeroes.
          */
-        memcpy(ev.key.val, key->val, sizeof(key->enc_size));
+        memcpy(ev.key.val, key->val, key->enc_size);
         memset(ev.key.val + key->enc_size, 0,
                sizeof(ev.key.val) - key->enc_size);
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 3d0f7d2a0616..ad82324f710f 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2312,6 +2312,10 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
                 return 1;
 
         chan = conn->smp;
+        if (!chan) {
+                BT_ERR("SMP security requested but not available");
+                return 1;
+        }
 
         if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
                 return 1;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 0ff6e1bbca91..fa7bfced888e 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -37,15 +37,30 @@ static inline int should_deliver(const struct net_bridge_port *p,
 
 int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb)
 {
-        if (!is_skb_forwardable(skb->dev, skb)) {
-                kfree_skb(skb);
-        } else {
-                skb_push(skb, ETH_HLEN);
-                br_drop_fake_rtable(skb);
-                skb_sender_cpu_clear(skb);
-                dev_queue_xmit(skb);
+        if (!is_skb_forwardable(skb->dev, skb))
+                goto drop;
+
+        skb_push(skb, ETH_HLEN);
+        br_drop_fake_rtable(skb);
+        skb_sender_cpu_clear(skb);
+
+        if (skb->ip_summed == CHECKSUM_PARTIAL &&
+            (skb->protocol == htons(ETH_P_8021Q) ||
+             skb->protocol == htons(ETH_P_8021AD))) {
+                int depth;
+
+                if (!__vlan_get_protocol(skb, skb->protocol, &depth))
+                        goto drop;
+
+                skb_set_network_header(skb, depth);
         }
 
+        dev_queue_xmit(skb);
+
+        return 0;
+
+drop:
+        kfree_skb(skb);
         return 0;
 }
 EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 1198a3dbad95..c94321955db7 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -445,6 +445,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                 if (p->port->state == BR_STATE_DISABLED)
                         goto unlock;
 
+                entry->state = p->state;
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 79db489cdade..0b39dcc65b94 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1416,8 +1416,7 @@ br_multicast_leave_group(struct net_bridge *br,
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
-            (port && port->state == BR_STATE_DISABLED) ||
-            timer_pending(&other_query->timer))
+            (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
         mdb = mlock_dereference(br->mdb, br);
@@ -1425,6 +1424,31 @@ br_multicast_leave_group(struct net_bridge *br,
         if (!mp)
                 goto out;
 
+        if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
+                struct net_bridge_port_group __rcu **pp;
+
+                for (pp = &mp->ports;
+                     (p = mlock_dereference(*pp, br)) != NULL;
+                     pp = &p->next) {
+                        if (p->port != port)
+                                continue;
+
+                        rcu_assign_pointer(*pp, p->next);
+                        hlist_del_init(&p->mglist);
+                        del_timer(&p->timer);
+                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
+                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
+
+                        if (!mp->ports && !mp->mglist &&
+                            netif_running(br->dev))
+                                mod_timer(&mp->timer, jiffies);
+                }
+                goto out;
+        }
+
+        if (timer_pending(&other_query->timer))
+                goto out;
+
         if (br->multicast_querier) {
                 __br_multicast_send_query(br, port, &mp->addr);
 
@@ -1450,28 +1474,6 @@ br_multicast_leave_group(struct net_bridge *br,
                 }
         }
 
-        if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
-                struct net_bridge_port_group __rcu **pp;
-
-                for (pp = &mp->ports;
-                     (p = mlock_dereference(*pp, br)) != NULL;
-                     pp = &p->next) {
-                        if (p->port != port)
-                                continue;
-
-                        rcu_assign_pointer(*pp, p->next);
-                        hlist_del_init(&p->mglist);
-                        del_timer(&p->timer);
-                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
-
-                        if (!mp->ports && !mp->mglist &&
-                            netif_running(br->dev))
-                                mod_timer(&mp->timer, jiffies);
-                }
-                goto out;
-        }
-
         now = jiffies;
         time = now + br->multicast_last_member_count *
                      br->multicast_last_member_interval;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 364bdc98bd9b..4d74a0639c4c 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -112,6 +112,8 @@ static inline size_t br_port_info_size(void)
                 + nla_total_size(1)     /* IFLA_BRPORT_FAST_LEAVE */
                 + nla_total_size(1)     /* IFLA_BRPORT_LEARNING */
                 + nla_total_size(1)     /* IFLA_BRPORT_UNICAST_FLOOD */
+                + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP */
+                + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP_WIFI */
                 + 0;
 }
 
@@ -506,6 +508,8 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
         [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
         [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
+        [IFLA_BRPORT_PROXYARP]  = { .type = NLA_U8 },
+        [IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
 };
 
 /* Change the state of the port and notify spanning tree */
@@ -693,9 +697,17 @@ static int br_port_slave_changelink(struct net_device *brdev,
                                     struct nlattr *tb[],
                                     struct nlattr *data[])
 {
+        struct net_bridge *br = netdev_priv(brdev);
+        int ret;
+
         if (!data)
                 return 0;
-        return br_setport(br_port_get_rtnl(dev), data);
+
+        spin_lock_bh(&br->lock);
+        ret = br_setport(br_port_get_rtnl(dev), data);
+        spin_unlock_bh(&br->lock);
+
+        return ret;
 }
 
 static int br_port_fill_slave_info(struct sk_buff *skb,
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index b4b6dab9c285..ed74ffaa851f 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -209,8 +209,9 @@ void br_transmit_config(struct net_bridge_port *p)
                 br_send_config_bpdu(p, &bpdu);
                 p->topology_change_ack = 0;
                 p->config_pending = 0;
-                mod_timer(&p->hold_timer,
-                          round_jiffies(jiffies + BR_HOLD_TIME));
+                if (p->br->stp_enabled == BR_KERNEL_STP)
+                        mod_timer(&p->hold_timer,
+                                  round_jiffies(jiffies + BR_HOLD_TIME));
         }
 }
 
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index a2730e7196cd..4ca449a16132 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -48,7 +48,8 @@ void br_stp_enable_bridge(struct net_bridge *br)
         struct net_bridge_port *p;
 
         spin_lock_bh(&br->lock);
-        mod_timer(&br->hello_timer, jiffies + br->hello_time);
+        if (br->stp_enabled == BR_KERNEL_STP)
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
         mod_timer(&br->gc_timer, jiffies + HZ/10);
 
         br_config_bpdu_generation(br);
@@ -127,6 +128,7 @@ static void br_stp_start(struct net_bridge *br)
         int r;
         char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL };
         char *envp[] = { NULL };
+        struct net_bridge_port *p;
 
         r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
 
@@ -140,6 +142,10 @@ static void br_stp_start(struct net_bridge *br)
         if (r == 0) {
                 br->stp_enabled = BR_USER_STP;
                 br_debug(br, "userspace STP started\n");
+                /* Stop hello and hold timers */
+                del_timer(&br->hello_timer);
+                list_for_each_entry(p, &br->port_list, list)
+                        del_timer(&p->hold_timer);
         } else {
                 br->stp_enabled = BR_KERNEL_STP;
                 br_debug(br, "using kernel STP\n");
@@ -156,12 +162,17 @@ static void br_stp_stop(struct net_bridge *br)
         int r;
         char *argv[] = { BR_STP_PROG, br->dev->name, "stop", NULL };
         char *envp[] = { NULL };
+        struct net_bridge_port *p;
 
         if (br->stp_enabled == BR_USER_STP) {
                 r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
                 br_info(br, "userspace STP stopped, return code %d\n", r);
 
                 /* To start timers on any ports left in blocking */
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                list_for_each_entry(p, &br->port_list, list)
+                        mod_timer(&p->hold_timer,
+                                  round_jiffies(jiffies + BR_HOLD_TIME));
                 spin_lock_bh(&br->lock);
                 br_port_state_selection(br);
                 spin_unlock_bh(&br->lock);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 7caf7fae2d5b..5f0f5af0ec35 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,9 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                mod_timer(&br->hello_timer, round_jiffies(jiffies + br->hello_time));
+                if (br->stp_enabled != BR_USER_STP)
+                        mod_timer(&br->hello_timer,
+                                  round_jiffies(jiffies + br->hello_time));
         }
         spin_unlock(&br->lock);
 }
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 4967262b2707..617088aee21d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,12 +131,12 @@ out_noerr:
         goto out;
 }
 
-static int skb_set_peeked(struct sk_buff *skb)
+static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
 {
         struct sk_buff *nskb;
 
         if (skb->peeked)
-                return 0;
+                return skb;
 
         /* We have to unshare an skb before modifying it. */
         if (!skb_shared(skb))
@@ -144,7 +144,7 @@ static int skb_set_peeked(struct sk_buff *skb)
 
         nskb = skb_clone(skb, GFP_ATOMIC);
         if (!nskb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         skb->prev->next = nskb;
         skb->next->prev = nskb;
@@ -157,7 +157,7 @@ static int skb_set_peeked(struct sk_buff *skb)
 done:
         skb->peeked = 1;
 
-        return 0;
+        return skb;
 }
 
 /**
@@ -229,8 +229,9 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                         continue;
                                 }
 
-                                error = skb_set_peeked(skb);
-                                if (error)
+                                skb = skb_set_peeked(skb);
+                                error = PTR_ERR(skb);
+                                if (IS_ERR(skb))
                                         goto unlock_err;
 
                                 atomic_inc(&skb->users);
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 1f2a126f4ffa..6441f47b1a8f 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -23,7 +23,8 @@ static inline struct cgroup_cls_state *css_cls_state(struct cgroup_subsys_state
 
 struct cgroup_cls_state *task_cls_state(struct task_struct *p)
 {
-        return css_cls_state(task_css(p, net_cls_cgrp_id));
+        return css_cls_state(task_css_check(p, net_cls_cgrp_id,
+                                            rcu_read_lock_bh_held()));
 }
 EXPORT_SYMBOL_GPL(task_cls_state);
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 1ebdf1c0d118..1cbd209192ea 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3514,8 +3514,6 @@ static int pktgen_thread_worker(void *arg)
 
         set_freezable();
 
-        __set_current_state(TASK_RUNNING);
-
         while (!kthread_should_stop()) {
                 pkt_dev = next_to_run(t);
 
@@ -3560,7 +3558,6 @@ static int pktgen_thread_worker(void *arg)
 
                 try_to_freeze();
         }
-        set_current_state(TASK_INTERRUPTIBLE);
 
         pr_debug("%s stopping all device\n", t->tsk->comm);
         pktgen_stop(t);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 87b22c0bc08c..b42f0e26f89e 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                         spin_lock_bh(&queue->syn_wait_lock);
                         while ((req = lopt->syn_table[i]) != NULL) {
                                 lopt->syn_table[i] = req->dl_next;
+                                /* Because of following del_timer_sync(),
+                                 * we must release the spinlock here
+                                 * or risk a dead lock.
+                                 */
+                                spin_unlock_bh(&queue->syn_wait_lock);
                                 atomic_inc(&lopt->qlen_dec);
-                                if (del_timer(&req->rsk_timer))
+                                if (del_timer_sync(&req->rsk_timer))
                                         reqsk_put(req);
                                 reqsk_put(req);
+                                spin_lock_bh(&queue->syn_wait_lock);
                         }
                         spin_unlock_bh(&queue->syn_wait_lock);
                 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 08f16db46070..193901d09757 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1497,7 +1497,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 sock_copy(newsk, sk);
 
                 /* SANITY */
-                get_net(sock_net(newsk));
+                if (likely(newsk->sk_net_refcnt))
+                        get_net(sock_net(newsk));
                 sk_node_init(&newsk->sk_node);
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
@@ -1967,20 +1968,21 @@ static void __release_sock(struct sock *sk)
  * sk_wait_data - wait for data to arrive at sk_receive_queue
  * @sk:    sock to wait on
  * @timeo: for how long
+ * @skb:   last skb seen on sk_receive_queue
  *
  * Now socket state including sk->sk_err is changed only under lock,
  * hence we may omit checks after joining wait queue.
  * We check receive queue before schedule() only as optimization;
  * it is very likely that release_sock() added new data.
  */
-int sk_wait_data(struct sock *sk, long *timeo)
+int sk_wait_data(struct sock *sk, long *timeo, const struct sk_buff *skb)
 {
         int rc;
         DEFINE_WAIT(wait);
 
         prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-        rc = sk_wait_event(sk, timeo, !skb_queue_empty(&sk->sk_receive_queue));
+        rc = sk_wait_event(sk, timeo, skb_peek_tail(&sk->sk_receive_queue) != skb);
         clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         finish_wait(sk_sleep(sk), &wait);
         return rc;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 52a94016526d..b5cf13a28009 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -886,7 +886,7 @@ verify_sock_status:
                         break;
                 }
 
-                sk_wait_data(sk, &timeo);
+                sk_wait_data(sk, &timeo, NULL);
                 continue;
         found_ok_skb:
                 if (len > skb->len)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 0917123790ea..35c47ddd04f0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -756,7 +756,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p,
                 return -ENODEV;
 
         /* Use already configured phy mode */
-        p->phy_interface = p->phy->interface;
+        if (p->phy_interface == PHY_INTERFACE_MODE_NA)
+                p->phy_interface = p->phy->interface;
         phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
                            p->phy_interface);
 
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index f46e4d1306f2..214d44aef35b 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -207,7 +207,7 @@ found:
         } else {
                 fq->q.meat += skb->len;
         }
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
             fq->q.meat == fq->q.len) {
@@ -287,7 +287,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev,
                 clone->data_len = clone->len;
                 head->data_len -= clone->len;
                 head->len -= clone->len;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         WARN_ON(head == NULL);
@@ -310,7 +310,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&fq->q, sum_truesize);
+        sub_frag_mem_limit(fq->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 933a92820d26..6c8b1fbafce8 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,16 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
 
         neigh = neigh_lookup(&arp_tbl, &ip, dev);
         if (neigh) {
-                read_lock_bh(&neigh->lock);
-                memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
-                r->arp_flags = arp_state_to_flags(neigh);
-                read_unlock_bh(&neigh->lock);
-                r->arp_ha.sa_family = dev->type;
-                strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev));
+                if (!(neigh->nud_state & NUD_NOARP)) {
+                        read_lock_bh(&neigh->lock);
+                        memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
+                        r->arp_flags = arp_state_to_flags(neigh);
+                        read_unlock_bh(&neigh->lock);
+                        r->arp_ha.sa_family = dev->type;
+                        strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev));
+                        err = 0;
+                }
                 neigh_release(neigh);
-                err = 0;
         }
         return err;
 }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e813196c91c7..2d9cb1748f81 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -882,7 +882,6 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 queue_delayed_work(system_power_efficient_wq,
                                 &check_lifetime_work, 0);
                 rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
-                blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
         }
         return 0;
 }
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index c6211ed60b03..9c02920725db 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -13,6 +13,7 @@ struct fib_alias {
         u8                      fa_state;
         u8                      fa_slen;
         u32                     tb_id;
+        s16                     fa_default;
         struct rcu_head         rcu;
 };
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c7358ea4ae93..3a06586b170c 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1202,23 +1202,40 @@ int fib_sync_down_dev(struct net_device *dev, unsigned long event)
 }
 
 /* Must be invoked inside of an RCU protected region.  */
-void fib_select_default(struct fib_result *res)
+void fib_select_default(const struct flowi4 *flp, struct fib_result *res)
 {
         struct fib_info *fi = NULL, *last_resort = NULL;
         struct hlist_head *fa_head = res->fa_head;
         struct fib_table *tb = res->table;
+        u8 slen = 32 - res->prefixlen;
         int order = -1, last_idx = -1;
-        struct fib_alias *fa;
+        struct fib_alias *fa, *fa1 = NULL;
+        u32 last_prio = res->fi->fib_priority;
+        u8 last_tos = 0;
 
         hlist_for_each_entry_rcu(fa, fa_head, fa_list) {
                 struct fib_info *next_fi = fa->fa_info;
 
+                if (fa->fa_slen != slen)
+                        continue;
+                if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+                        continue;
+                if (fa->tb_id != tb->tb_id)
+                        continue;
+                if (next_fi->fib_priority > last_prio &&
+                    fa->fa_tos == last_tos) {
+                        if (last_tos)
+                                continue;
+                        break;
+                }
+                if (next_fi->fib_flags & RTNH_F_DEAD)
+                        continue;
+                last_tos = fa->fa_tos;
+                last_prio = next_fi->fib_priority;
+
                 if (next_fi->fib_scope != res->scope ||
                     fa->fa_type != RTN_UNICAST)
                         continue;
-
-                if (next_fi->fib_priority > res->fi->fib_priority)
-                        break;
                 if (!next_fi->fib_nh[0].nh_gw ||
                     next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                         continue;
@@ -1228,10 +1245,11 @@ void fib_select_default(struct fib_result *res)
                 if (!fi) {
                         if (next_fi != res->fi)
                                 break;
+                        fa1 = fa;
                 } else if (!fib_detect_death(fi, order, &last_resort,
-                                             &last_idx, tb->tb_default)) {
+                                             &last_idx, fa1->fa_default)) {
                         fib_result_assign(res, fi);
-                        tb->tb_default = order;
+                        fa1->fa_default = order;
                         goto out;
                 }
                 fi = next_fi;
@@ -1239,20 +1257,21 @@ void fib_select_default(struct fib_result *res)
         }
 
         if (order <= 0 || !fi) {
-                tb->tb_default = -1;
+                if (fa1)
+                        fa1->fa_default = -1;
                 goto out;
         }
 
         if (!fib_detect_death(fi, order, &last_resort, &last_idx,
-                                tb->tb_default)) {
+                              fa1->fa_default)) {
                 fib_result_assign(res, fi);
-                tb->tb_default = order;
+                fa1->fa_default = order;
                 goto out;
         }
 
         if (last_idx >= 0)
                 fib_result_assign(res, last_resort);
-        tb->tb_default = last_idx;
+        fa1->fa_default = last_idx;
 out:
         return;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 15d32612e3c6..37c4bb89a708 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1171,6 +1171,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
                         new_fa->fa_state = state & ~FA_S_ACCESSED;
                         new_fa->fa_slen = fa->fa_slen;
                         new_fa->tb_id = tb->tb_id;
+                        new_fa->fa_default = -1;
 
                         err = switchdev_fib_ipv4_add(key, plen, fi,
                                                      new_fa->fa_tos,
@@ -1222,6 +1223,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
         new_fa->fa_state = 0;
         new_fa->fa_slen = slen;
         new_fa->tb_id = tb->tb_id;
+        new_fa->fa_default = -1;
 
         /* (Optionally) offload fib entry to switch hardware. */
         err = switchdev_fib_ipv4_add(key, plen, fi, tos, cfg->fc_type,
@@ -1791,8 +1793,6 @@ void fib_table_flush_external(struct fib_table *tb)
                 if (hlist_empty(&n->leaf)) {
                         put_child_root(pn, n->key, NULL);
                         node_free(n);
-                } else {
-                        leaf_pull_suffix(pn, n);
                 }
         }
 }
@@ -1862,8 +1862,6 @@ int fib_table_flush(struct fib_table *tb)
                 if (hlist_empty(&n->leaf)) {
                         put_child_root(pn, n->key, NULL);
                         node_free(n);
-                } else {
-                        leaf_pull_suffix(pn, n);
                 }
         }
 
@@ -1990,7 +1988,6 @@ struct fib_table *fib_trie_table(u32 id, struct fib_table *alias)
                 return NULL;
 
         tb->tb_id = id;
-        tb->tb_default = -1;
         tb->tb_num_default = 0;
         tb->tb_data = (alias ? alias->__data : tb->__data);
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 60021d0d9326..05e3145f7dc3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -593,7 +593,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
         }
 
         spin_unlock(&queue->syn_wait_lock);
-        if (del_timer(&req->rsk_timer))
+        if (del_timer_sync(&req->rsk_timer))
                 reqsk_put(req);
         return found;
 }
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 5e346a082e5f..d0a7c0319e3d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -131,34 +131,22 @@ inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb)
         unsigned int evicted = 0;
         HLIST_HEAD(expired);
 
-evict_again:
         spin_lock(&hb->chain_lock);
 
         hlist_for_each_entry_safe(fq, n, &hb->chain, list) {
                 if (!inet_fragq_should_evict(fq))
                         continue;
 
-                if (!del_timer(&fq->timer)) {
-                        /* q expiring right now thus increment its refcount so
-                         * it won't be freed under us and wait until the timer
-                         * has finished executing then destroy it
-                         */
-                        atomic_inc(&fq->refcnt);
-                        spin_unlock(&hb->chain_lock);
-                        del_timer_sync(&fq->timer);
-                        inet_frag_put(fq, f);
-                        goto evict_again;
-                }
+                if (!del_timer(&fq->timer))
+                        continue;
 
-                fq->flags |= INET_FRAG_EVICTED;
-                hlist_del(&fq->list);
-                hlist_add_head(&fq->list, &expired);
+                hlist_add_head(&fq->list_evictor, &expired);
                 ++evicted;
         }
 
         spin_unlock(&hb->chain_lock);
 
-        hlist_for_each_entry_safe(fq, n, &expired, list)
+        hlist_for_each_entry_safe(fq, n, &expired, list_evictor)
                 f->frag_expire((unsigned long) fq);
 
         return evicted;
@@ -240,18 +228,20 @@ void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f)
         int i;
 
         nf->low_thresh = 0;
-        local_bh_disable();
 
 evict_again:
+        local_bh_disable();
         seq = read_seqbegin(&f->rnd_seqlock);
 
         for (i = 0; i < INETFRAGS_HASHSZ ; i++)
                 inet_evict_bucket(f, &f->hash[i]);
 
-        if (read_seqretry(&f->rnd_seqlock, seq))
-                goto evict_again;
-
         local_bh_enable();
+        cond_resched();
+
+        if (read_seqretry(&f->rnd_seqlock, seq) ||
+            percpu_counter_sum(&nf->mem))
+                goto evict_again;
 
         percpu_counter_destroy(&nf->mem);
 }
@@ -284,8 +274,8 @@ static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f)
         struct inet_frag_bucket *hb;
 
         hb = get_frag_bucket_locked(fq, f);
-        if (!(fq->flags & INET_FRAG_EVICTED))
-                hlist_del(&fq->list);
+        hlist_del(&fq->list);
+        fq->flags |= INET_FRAG_COMPLETE;
         spin_unlock(&hb->chain_lock);
 }
 
@@ -297,7 +287,6 @@ void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f)
         if (!(fq->flags & INET_FRAG_COMPLETE)) {
                 fq_unlink(fq, f);
                 atomic_dec(&fq->refcnt);
-                fq->flags |= INET_FRAG_COMPLETE;
         }
 }
 EXPORT_SYMBOL(inet_frag_kill);
@@ -330,11 +319,12 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f)
                 fp = xp;
         }
         sum = sum_truesize + f->qsize;
-        sub_frag_mem_limit(q, sum);
 
         if (f->destructor)
                 f->destructor(q);
         kmem_cache_free(f->frags_cachep, q);
+
+        sub_frag_mem_limit(nf, sum);
 }
 EXPORT_SYMBOL(inet_frag_destroy);
 
@@ -390,7 +380,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 
         q->net = nf;
         f->constructor(q, arg);
-        add_frag_mem_limit(q, f->qsize);
+        add_frag_mem_limit(nf, f->qsize);
 
         setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
         spin_lock_init(&q->lock);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 31f71b15cfba..921138f6c97c 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -202,7 +202,7 @@ static void ip_expire(unsigned long arg)
         ipq_kill(qp);
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
 
-        if (!(qp->q.flags & INET_FRAG_EVICTED)) {
+        if (!inet_frag_evicting(&qp->q)) {
                 struct sk_buff *head = qp->q.fragments;
                 const struct iphdr *iph;
                 int err;
@@ -309,7 +309,7 @@ static int ip_frag_reinit(struct ipq *qp)
                 kfree_skb(fp);
                 fp = xp;
         } while (fp);
-        sub_frag_mem_limit(&qp->q, sum_truesize);
+        sub_frag_mem_limit(qp->q.net, sum_truesize);
 
         qp->q.flags = 0;
         qp->q.len = 0;
@@ -455,7 +455,7 @@ found:
                                 qp->q.fragments = next;
 
                         qp->q.meat -= free_it->len;
-                        sub_frag_mem_limit(&qp->q, free_it->truesize);
+                        sub_frag_mem_limit(qp->q.net, free_it->truesize);
                         kfree_skb(free_it);
                 }
         }
@@ -479,7 +479,7 @@ found:
         qp->q.stamp = skb->tstamp;
         qp->q.meat += skb->len;
         qp->ecn |= ecn;
-        add_frag_mem_limit(&qp->q, skb->truesize);
+        add_frag_mem_limit(qp->q.net, skb->truesize);
         if (offset == 0)
                 qp->q.flags |= INET_FRAG_FIRST_IN;
 
@@ -587,7 +587,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 head->len -= clone->len;
                 clone->csum = 0;
                 clone->ip_summed = head->ip_summed;
-                add_frag_mem_limit(&qp->q, clone->truesize);
+                add_frag_mem_limit(qp->q.net, clone->truesize);
         }
 
         skb_push(head, head->data - skb_network_header(head));
@@ -615,7 +615,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&qp->q, sum_truesize);
+        sub_frag_mem_limit(qp->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index fe8cc183411e..95ea633e8356 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -226,7 +226,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
 }
 
 static bool
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d0362a2de3d3..e681b852ced1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2176,7 +2176,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
         if (!res.prefixlen &&
             res.table->tb_num_default > 1 &&
             res.type == RTN_UNICAST && !fl4->flowi4_oif)
-                fib_select_default(&res);
+                fib_select_default(fl4, &res);
 
         if (!fl4->saddr)
                 fl4->saddr = FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7f4056785acc..45534a5ab430 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -780,7 +780,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                                 ret = -EAGAIN;
                                 break;
                         }
-                        sk_wait_data(sk, &timeo);
+                        sk_wait_data(sk, &timeo, NULL);
                         if (signal_pending(current)) {
                                 ret = sock_intr_errno(timeo);
                                 break;
@@ -1575,7 +1575,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         int target;             /* Read at least this many bytes */
         long timeo;
         struct task_struct *user_recv = NULL;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *last;
         u32 urg_hole = 0;
 
         if (unlikely(flags & MSG_ERRQUEUE))
@@ -1635,7 +1635,9 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
 
                 /* Next get a buffer. */
 
+                last = skb_peek_tail(&sk->sk_receive_queue);
                 skb_queue_walk(&sk->sk_receive_queue, skb) {
+                        last = skb;
                         /* Now that we have two receive queues this
                          * shouldn't happen.
                          */
@@ -1754,8 +1756,9 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
                         lock_sock(sk);
-                } else
-                        sk_wait_data(sk, &timeo);
+                } else {
+                        sk_wait_data(sk, &timeo, last);
+                }
 
                 if (user_recv) {
                         int chunk;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d7d4c2b79cf2..0ea2e1c5d395 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1348,7 +1348,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         req = inet_csk_search_req(sk, th->source, iph->saddr, iph->daddr);
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                if (!nsk)
+                if (!nsk || nsk == sk)
                         reqsk_put(req);
                 return nsk;
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 83aa604f9273..1b8c5ba7d5f7 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1995,12 +1995,19 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
         skb->sk = sk;
         skb->destructor = sock_efree;
-        dst = sk->sk_rx_dst;
+        dst = READ_ONCE(sk->sk_rx_dst);
 
         if (dst)
                 dst = dst_check(dst, 0);
-        if (dst)
-                skb_dst_set_noref(skb, dst);
+        if (dst) {
+                /* DST_NOCACHE can not be used without taking a reference */
+                if (dst->flags & DST_NOCACHE) {
+                        if (likely(atomic_inc_not_zero(&dst->__refcnt)))
+                                skb_dst_set(skb, dst);
+                } else {
+                        skb_dst_set_noref(skb, dst);
+                }
+        }
 }
 
 int udp_rcv(struct sk_buff *skb)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0a05b35a90fc..c53331cfed95 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1650,6 +1650,7 @@ int ndisc_rcv(struct sk_buff *skb)
 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
 
@@ -1664,6 +1665,11 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                         ndisc_send_unsol_na(dev);
                 in6_dev_put(idev);
                 break;
+        case NETDEV_CHANGE:
+                change_info = ptr;
+                if (change_info->flags_changed & IFF_NOARP)
+                        neigh_changeaddr(&nd_tbl, dev);
+                break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
                 fib6_run_gc(0, net, false);
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 6edb7b106de7..ebbb754c2111 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
 }
 
 static void
-synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+synproxy_send_tcp(const struct synproxy_net *snet,
+                  const struct sk_buff *skb, struct sk_buff *nskb,
                   struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
                   struct ipv6hdr *niph, struct tcphdr *nth,
                   unsigned int tcp_hdr_size)
 {
-        struct net *net = nf_ct_net((struct nf_conn *)nfct);
+        struct net *net = nf_ct_net(snet->tmpl);
         struct dst_entry *dst;
         struct flowi6 fl6;
 
@@ -83,7 +84,8 @@ free_nskb:
 }
 
 static void
-synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+synproxy_send_client_synack(const struct synproxy_net *snet,
+                            const struct sk_buff *skb, const struct tcphdr *th,
                             const struct synproxy_options *opts)
 {
         struct sk_buff *nskb;
@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+        synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static void
@@ -241,7 +243,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
 }
 
 static bool
@@ -301,7 +304,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                                           XT_SYNPROXY_OPT_SACK_PERM |
                                           XT_SYNPROXY_OPT_ECN);
 
-                synproxy_send_client_synack(skb, th, &opts);
+                synproxy_send_client_synack(snet, skb, th, &opts);
                 return NF_DROP;
 
         } else if (th->ack && !(th->fin || th->rst || th->syn)) {
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 6f187c8d8a1b..6d02498172c1 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -348,7 +348,7 @@ found:
         fq->ecn |= ecn;
         if (payload_len > fq->q.max_size)
                 fq->q.max_size = payload_len;
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         /* The first fragment.
          * nhoffset is obtained from the first fragment, of course.
@@ -430,7 +430,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                 clone->ip_summed = head->ip_summed;
 
                 NFCT_FRAG6_CB(clone)->orig = NULL;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         /* We have to remove fragment header from datagram and to relocate
@@ -454,7 +454,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                         head->csum = csum_add(head->csum, fp->csum);
                 head->truesize += fp->truesize;
         }
-        sub_frag_mem_limit(&fq->q, head->truesize);
+        sub_frag_mem_limit(fq->q.net, head->truesize);
 
         head->ignore_df = 1;
         head->next = NULL;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 8ffa2c8cce77..f1159bb76e0a 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -144,7 +144,7 @@ void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
 
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
 
-        if (fq->q.flags & INET_FRAG_EVICTED)
+        if (inet_frag_evicting(&fq->q))
                 goto out_rcu_unlock;
 
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
@@ -330,7 +330,7 @@ found:
         fq->q.stamp = skb->tstamp;
         fq->q.meat += skb->len;
         fq->ecn |= ecn;
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         /* The first fragment.
          * nhoffset is obtained from the first fragment, of course.
@@ -443,7 +443,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 head->len -= clone->len;
                 clone->csum = 0;
                 clone->ip_summed = head->ip_summed;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         /* We have to remove fragment header from datagram and to relocate
@@ -481,7 +481,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&fq->q, sum_truesize);
+        sub_frag_mem_limit(fq->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6090969937f8..9de4d2bcd916 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1831,6 +1831,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 int gwa_type;
 
                 gw_addr = &cfg->fc_gateway;
+                gwa_type = ipv6_addr_type(gw_addr);
 
                 /* if gw_addr is local we will fail to detect this in case
                  * address is still TENTATIVE (DAD in progress). rt6_lookup()
@@ -1838,11 +1839,12 @@ int ip6_route_add(struct fib6_config *cfg)
                  * prefix route was assigned to, which might be non-loopback.
                  */
                 err = -EINVAL;
-                if (ipv6_chk_addr_and_flags(net, gw_addr, NULL, 0, 0))
+                if (ipv6_chk_addr_and_flags(net, gw_addr,
+                                            gwa_type & IPV6_ADDR_LINKLOCAL ?
+                                            dev : NULL, 0, 0))
                         goto out;
 
                 rt->rt6i_gateway = *gw_addr;
-                gwa_type = ipv6_addr_type(gw_addr);
 
                 if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
                         struct rt6_info *grt;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 6748c4277aff..7a6cea5e4274 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -943,7 +943,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
                                    &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                if (!nsk)
+                if (!nsk || nsk == sk)
                         reqsk_put(req);
                 return nsk;
         }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8fd9febaa5ba..8dab4e569571 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -613,7 +613,7 @@ static int llc_wait_data(struct sock *sk, long timeo)
                 if (signal_pending(current))
                         break;
                 rc = 0;
-                if (sk_wait_data(sk, &timeo))
+                if (sk_wait_data(sk, &timeo, NULL))
                         break;
         }
         return rc;
@@ -802,7 +802,7 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                         release_sock(sk);
                         lock_sock(sk);
                 } else
-                        sk_wait_data(sk, &timeo);
+                        sk_wait_data(sk, &timeo, NULL);
 
                 if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
                         net_dbg_ratelimited("LLC(%s:%d): Application bug, race in MSG_PEEK\n",
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 5d2b806a862e..38fbc194b9cb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -319,7 +319,13 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * return *ignored=0 i.e. ICMP and NF_DROP
                  */
                 sched = rcu_dereference(svc->scheduler);
-                dest = sched->schedule(svc, skb, iph);
+                if (sched) {
+                        /* read svc->sched_data after svc->scheduler */
+                        smp_rmb();
+                        dest = sched->schedule(svc, skb, iph);
+                } else {
+                        dest = NULL;
+                }
                 if (!dest) {
                         IP_VS_DBG(1, "p-schedule: no dest found.\n");
                         kfree(param.pe_data);
@@ -467,7 +473,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
         }
 
         sched = rcu_dereference(svc->scheduler);
-        dest = sched->schedule(svc, skb, iph);
+        if (sched) {
+                /* read svc->sched_data after svc->scheduler */
+                smp_rmb();
+                dest = sched->schedule(svc, skb, iph);
+        } else {
+                dest = NULL;
+        }
         if (dest == NULL) {
                 IP_VS_DBG(1, "Schedule: no dest found.\n");
                 return NULL;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 285eae3a1454..24c554201a76 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -842,15 +842,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         __ip_vs_dst_cache_reset(dest);
         spin_unlock_bh(&dest->dst_lock);
 
-        sched = rcu_dereference_protected(svc->scheduler, 1);
         if (add) {
                 ip_vs_start_estimator(svc->net, &dest->stats);
                 list_add_rcu(&dest->n_list, &svc->destinations);
                 svc->num_dests++;
-                if (sched->add_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->add_dest)
                         sched->add_dest(svc, dest);
         } else {
-                if (sched->upd_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->upd_dest)
                         sched->upd_dest(svc, dest);
         }
 }
@@ -1084,7 +1085,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
                 struct ip_vs_scheduler *sched;
 
                 sched = rcu_dereference_protected(svc->scheduler, 1);
-                if (sched->del_dest)
+                if (sched && sched->del_dest)
                         sched->del_dest(svc, dest);
         }
 }
@@ -1175,11 +1176,14 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         ip_vs_use_count_inc();
 
         /* Lookup the scheduler by 'u->sched_name' */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                ret = -ENOENT;
-                goto out_err;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        ret = -ENOENT;
+                        goto out_err;
+                }
         }
 
         if (u->pe_name && *u->pe_name) {
@@ -1240,10 +1244,12 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         spin_lock_init(&svc->stats.lock);
 
         /* Bind the scheduler */
-        ret = ip_vs_bind_scheduler(svc, sched);
-        if (ret)
-                goto out_err;
-        sched = NULL;
+        if (sched) {
+                ret = ip_vs_bind_scheduler(svc, sched);
+                if (ret)
+                        goto out_err;
+                sched = NULL;
+        }
 
         /* Bind the ct retriever */
         RCU_INIT_POINTER(svc->pe, pe);
@@ -1291,17 +1297,20 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
 static int
 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 {
-        struct ip_vs_scheduler *sched, *old_sched;
+        struct ip_vs_scheduler *sched = NULL, *old_sched;
         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
         int ret = 0;
 
         /*
          * Lookup the scheduler, by 'u->sched_name'
          */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                return -ENOENT;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        return -ENOENT;
+                }
         }
         old_sched = sched;
 
@@ -1329,14 +1338,20 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 
         old_sched = rcu_dereference_protected(svc->scheduler, 1);
         if (sched != old_sched) {
+                if (old_sched) {
+                        ip_vs_unbind_scheduler(svc, old_sched);
+                        RCU_INIT_POINTER(svc->scheduler, NULL);
+                        /* Wait all svc->sched_data users */
+                        synchronize_rcu();
+                }
                 /* Bind the new scheduler */
-                ret = ip_vs_bind_scheduler(svc, sched);
-                if (ret) {
-                        old_sched = sched;
-                        goto out;
+                if (sched) {
+                        ret = ip_vs_bind_scheduler(svc, sched);
+                        if (ret) {
+                                ip_vs_scheduler_put(sched);
+                                goto out;
+                        }
                 }
-                /* Unbind the old scheduler on success */
-                ip_vs_unbind_scheduler(svc, old_sched);
         }
 
         /*
@@ -1982,6 +1997,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 const struct ip_vs_iter *iter = seq->private;
                 const struct ip_vs_dest *dest;
                 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+                char *sched_name = sched ? sched->name : "none";
 
                 if (iter->table == ip_vs_svc_table) {
 #ifdef CONFIG_IP_VS_IPV6
@@ -1990,18 +2006,18 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                                            ip_vs_proto_name(svc->protocol),
                                            &svc->addr.in6,
                                            ntohs(svc->port),
-                                           sched->name);
+                                           sched_name);
                         else
 #endif
                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
                                            ip_vs_proto_name(svc->protocol),
                                            ntohl(svc->addr.ip),
                                            ntohs(svc->port),
-                                           sched->name,
+                                           sched_name,
                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 } else {
                         seq_printf(seq, "FWM  %08X %s %s",
-                                   svc->fwmark, sched->name,
+                                   svc->fwmark, sched_name,
                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 }
 
@@ -2427,13 +2443,15 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
 {
         struct ip_vs_scheduler *sched;
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         sched = rcu_dereference_protected(src->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         dst->protocol = src->protocol;
         dst->addr = src->addr.ip;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
-        strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));
+        strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
         dst->flags = src->flags;
         dst->timeout = src->timeout / HZ;
         dst->netmask = src->netmask;
@@ -2892,6 +2910,7 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         struct ip_vs_flags flags = { .flags = svc->flags,
                                      .mask = ~0 };
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
         if (!nl_service)
@@ -2910,8 +2929,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         }
 
         sched = rcu_dereference_protected(svc->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         pe = rcu_dereference_protected(svc->pe, 1);
-        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||
+        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
             (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 199760c71f39..7e8141647943 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
 
         if (sched->done_service)
                 sched->done_service(svc);
-        /* svc->scheduler can not be set to NULL */
+        /* svc->scheduler can be set to NULL only by caller */
 }
 
 
@@ -147,21 +147,21 @@ void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler)
 
 void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg)
 {
-        struct ip_vs_scheduler *sched;
+        struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+        char *sched_name = sched ? sched->name : "none";
 
-        sched = rcu_dereference(svc->scheduler);
         if (svc->fwmark) {
                 IP_VS_ERR_RL("%s: FWM %u 0x%08X - %s\n",
-                             sched->name, svc->fwmark, svc->fwmark, msg);
+                             sched_name, svc->fwmark, svc->fwmark, msg);
 #ifdef CONFIG_IP_VS_IPV6
         } else if (svc->af == AF_INET6) {
                 IP_VS_ERR_RL("%s: %s [%pI6c]:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.in6, ntohs(svc->port), msg);
 #endif
         } else {
                 IP_VS_ERR_RL("%s: %s %pI4:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.ip, ntohs(svc->port), msg);
         }
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index b08ba9538d12..d99ad93eb855 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
                         pkts = atomic_add_return(1, &cp->in_pkts);
                 else
                         pkts = sysctl_sync_threshold(ipvs);
-                ip_vs_sync_conn(net, cp->control, pkts);
+                ip_vs_sync_conn(net, cp, pkts);
         }
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index bf66a8657a5f..258a0b0e82a2 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -130,7 +130,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,
 
         memset(&fl4, 0, sizeof(fl4));
         fl4.daddr = daddr;
-        fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
         fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
                            FLOWI_FLAG_KNOWN_NH : 0;
 
@@ -505,6 +504,13 @@ err_put:
         return -1;
 
 err_unreach:
+        /* The ip6_link_failure function requires the dev field to be set
+         * in order to get the net (further for the sake of fwmark
+         * reflection).
+         */
+        if (!skb->dev)
+                skb->dev = skb_dst(skb)->dev;
+
         dst_link_failure(skb);
         return -1;
 }
@@ -523,10 +529,27 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb,
         if (ret == NF_ACCEPT) {
                 nf_reset(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
         }
         return ret;
 }
 
+/* In the event of a remote destination, it's possible that we would have
+ * matches against an old socket (particularly a TIME-WAIT socket). This
+ * causes havoc down the line (ip_local_out et. al. expect regular sockets
+ * and invalid memory accesses will happen) so simply drop the association
+ * in this case.
+*/
+static inline void ip_vs_drop_early_demux_sk(struct sk_buff *skb)
+{
+        /* If dev is set, the packet came from the LOCAL_IN callback and
+         * not from a local TCP socket.
+         */
+        if (skb->dev)
+                skb_orphan(skb);
+}
+
 /* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */
 static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                                          struct ip_vs_conn *cp, int local)
@@ -538,12 +561,23 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 1);
+
+        /* Remove the early_demux association unless it's bound for the
+         * exact same port and address on this host after translation.
+         */
+        if (!local || cp->vport != cp->dport ||
+            !ip_vs_addr_equal(cp->af, &cp->vaddr, &cp->daddr))
+                ip_vs_drop_early_demux_sk(skb);
+
         if (!local) {
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
                 ret = NF_ACCEPT;
+
         return ret;
 }
 
@@ -557,7 +591,10 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,
         if (likely(!(cp->flags & IP_VS_CONN_F_NFCT)))
                 ip_vs_notrack(skb);
         if (!local) {
+                ip_vs_drop_early_demux_sk(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
@@ -845,6 +882,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
         struct ipv6hdr *old_ipv6h = NULL;
 #endif
 
+        ip_vs_drop_early_demux_sk(skb);
+
         if (skb_headroom(skb) < max_headroom || skb_cloned(skb)) {
                 new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 13fad8668f83..3c20d02aee73 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -287,6 +287,46 @@ static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct)
         spin_unlock(&pcpu->lock);
 }
 
+/* Released via destroy_conntrack() */
+struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags)
+{
+        struct nf_conn *tmpl;
+
+        tmpl = kzalloc(sizeof(*tmpl), flags);
+        if (tmpl == NULL)
+                return NULL;
+
+        tmpl->status = IPS_TEMPLATE;
+        write_pnet(&tmpl->ct_net, net);
+
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        if (zone) {
+                struct nf_conntrack_zone *nf_ct_zone;
+
+                nf_ct_zone = nf_ct_ext_add(tmpl, NF_CT_EXT_ZONE, flags);
+                if (!nf_ct_zone)
+                        goto out_free;
+                nf_ct_zone->id = zone;
+        }
+#endif
+        atomic_set(&tmpl->ct_general.use, 0);
+
+        return tmpl;
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+out_free:
+        kfree(tmpl);
+        return NULL;
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc);
+
+static void nf_ct_tmpl_free(struct nf_conn *tmpl)
+{
+        nf_ct_ext_destroy(tmpl);
+        nf_ct_ext_free(tmpl);
+        kfree(tmpl);
+}
+
 static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
@@ -298,6 +338,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
         NF_CT_ASSERT(!timer_pending(&ct->timeout));
 
+        if (unlikely(nf_ct_is_template(ct))) {
+                nf_ct_tmpl_free(ct);
+                return;
+        }
         rcu_read_lock();
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
         if (l4proto && l4proto->destroy)
@@ -540,28 +584,6 @@ out:
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
-/* deletion from this larval template list happens via nf_ct_put() */
-void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl)
-{
-        struct ct_pcpu *pcpu;
-
-        __set_bit(IPS_TEMPLATE_BIT, &tmpl->status);
-        __set_bit(IPS_CONFIRMED_BIT, &tmpl->status);
-        nf_conntrack_get(&tmpl->ct_general);
-
-        /* add this conntrack to the (per cpu) tmpl list */
-        local_bh_disable();
-        tmpl->cpu = smp_processor_id();
-        pcpu = per_cpu_ptr(nf_ct_net(tmpl)->ct.pcpu_lists, tmpl->cpu);
-
-        spin_lock(&pcpu->lock);
-        /* Overload tuple linked list to put us in template list. */
-        hlist_nulls_add_head_rcu(&tmpl->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                                 &pcpu->tmpl);
-        spin_unlock_bh(&pcpu->lock);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
-
 /* Confirm a connection given skb; places it in hash table */
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
@@ -1522,10 +1544,8 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
         sz = nr_slots * sizeof(struct hlist_nulls_head);
         hash = (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
                                         get_order(sz));
-        if (!hash) {
-                printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
+        if (!hash)
                 hash = vzalloc(sz);
-        }
 
         if (hash && nulls)
                 for (i = 0; i < nr_slots; i++)
@@ -1751,7 +1771,6 @@ int nf_conntrack_init_net(struct net *net)
                 spin_lock_init(&pcpu->lock);
                 INIT_HLIST_NULLS_HEAD(&pcpu->unconfirmed, UNCONFIRMED_NULLS_VAL);
                 INIT_HLIST_NULLS_HEAD(&pcpu->dying, DYING_NULLS_VAL);
-                INIT_HLIST_NULLS_HEAD(&pcpu->tmpl, TEMPLATE_NULLS_VAL);
         }
 
         net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 7a17070c5dab..b45a4223cb05 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
                         a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
         }
 
-        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+               nf_ct_zone(a->master) == nf_ct_zone(b->master);
 }
 
 static inline int expect_matches(const struct nf_conntrack_expect *a,
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d1c23940a86a..6b8b0abbfab4 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2995,11 +2995,6 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         }
 
         err = nf_ct_expect_related_report(exp, portid, report);
-        if (err < 0)
-                goto err_exp;
-
-        return 0;
-err_exp:
         nf_ct_expect_put(exp);
 err_ct:
         nf_ct_put(ct);
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 789feeae6c44..d7f168527903 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -349,23 +349,20 @@ static void __net_exit synproxy_proc_exit(struct net *net)
 static int __net_init synproxy_net_init(struct net *net)
 {
         struct synproxy_net *snet = synproxy_pernet(net);
-        struct nf_conntrack_tuple t;
         struct nf_conn *ct;
         int err = -ENOMEM;
 
-        memset(&t, 0, sizeof(t));
-        ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
-        if (IS_ERR(ct)) {
-                err = PTR_ERR(ct);
+        ct = nf_ct_tmpl_alloc(net, 0, GFP_KERNEL);
+        if (!ct)
                 goto err1;
-        }
 
         if (!nfct_seqadj_ext_add(ct))
                 goto err2;
         if (!nfct_synproxy_ext_add(ct))
                 goto err2;
 
-        nf_conntrack_tmpl_insert(net, ct);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+        nf_conntrack_get(&ct->ct_general);
         snet->tmpl = ct;
 
         snet->stats = alloc_percpu(struct synproxy_stats);
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 75747aecdebe..43ddeee404e9 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -184,7 +184,6 @@ out:
 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                           struct xt_ct_target_info_v1 *info)
 {
-        struct nf_conntrack_tuple t;
         struct nf_conn *ct;
         int ret = -EOPNOTSUPP;
 
@@ -202,11 +201,11 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
         if (ret < 0)
                 goto err1;
 
-        memset(&t, 0, sizeof(t));
-        ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
-        ret = PTR_ERR(ct);
-        if (IS_ERR(ct))
+        ct = nf_ct_tmpl_alloc(par->net, info->zone, GFP_KERNEL);
+        if (!ct) {
+                ret = -ENOMEM;
                 goto err2;
+        }
 
         ret = 0;
         if ((info->ct_events || info->exp_events) &&
@@ -227,8 +226,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                 if (ret < 0)
                         goto err3;
         }
-
-        nf_conntrack_tmpl_insert(par->net, ct);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+        nf_conntrack_get(&ct->ct_general);
 out:
         info->ct = ct;
         return 0;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index f407ebc13481..29d2c31f406c 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -126,6 +126,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
                 goto out;
         }
 
+        sysfs_attr_init(&info->timer->attr.attr);
         info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
         if (!info->timer->attr.attr.name) {
                 ret = -ENOMEM;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index d8e2e3918ce2..67d210477863 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1096,6 +1096,11 @@ static int netlink_insert(struct sock *sk, u32 portid)
 
         err = __netlink_insert(table, sk);
         if (err) {
+                /* In case the hashtable backend returns with -EBUSY
+                 * from here, it must not escape to the caller.
+                 */
+                if (unlikely(err == -EBUSY))
+                        err = -EOVERFLOW;
                 if (err == -EEXIST)
                         err = -EADDRINUSE;
                 nlk_sk(sk)->portid = 0;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 8a8c0b8b4f63..ee34f474ad14 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -273,28 +273,36 @@ static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
         return 0;
 }
 
-static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
-                        __be32 *addr, __be32 new_addr)
+static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
+                                  __be32 addr, __be32 new_addr)
 {
         int transport_len = skb->len - skb_transport_offset(skb);
 
+        if (nh->frag_off & htons(IP_OFFSET))
+                return;
+
         if (nh->protocol == IPPROTO_TCP) {
                 if (likely(transport_len >= sizeof(struct tcphdr)))
                         inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
-                                                 *addr, new_addr, 1);
+                                                 addr, new_addr, 1);
         } else if (nh->protocol == IPPROTO_UDP) {
                 if (likely(transport_len >= sizeof(struct udphdr))) {
                         struct udphdr *uh = udp_hdr(skb);
 
                         if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
                                 inet_proto_csum_replace4(&uh->check, skb,
-                                                         *addr, new_addr, 1);
+                                                         addr, new_addr, 1);
                                 if (!uh->check)
                                         uh->check = CSUM_MANGLED_0;
                         }
                 }
         }
+}
 
+static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
+                        __be32 *addr, __be32 new_addr)
+{
+        update_ip_l4_checksum(skb, nh, *addr, new_addr);
         csum_replace4(&nh->check, *addr, new_addr);
         skb_clear_hash(skb);
         *addr = new_addr;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c9e8741226c6..ed458b315ef4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2403,7 +2403,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 }
                 tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
                                           addr, hlen);
-                if (tp_len > dev->mtu + dev->hard_header_len) {
+                if (likely(tp_len >= 0) &&
+                    tp_len > dev->mtu + dev->hard_header_len) {
                         struct ethhdr *ehdr;
                         /* Earlier code assumed this would be a VLAN pkt,
                          * double-check this now that we have the actual
@@ -2784,7 +2785,7 @@ static int packet_release(struct socket *sock)
 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
 {
         struct packet_sock *po = pkt_sk(sk);
-        const struct net_device *dev_curr;
+        struct net_device *dev_curr;
         __be16 proto_curr;
         bool need_rehook;
 
@@ -2808,15 +2809,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
 
                 po->num = proto;
                 po->prot_hook.type = proto;
-
-                if (po->prot_hook.dev)
-                        dev_put(po->prot_hook.dev);
-
                 po->prot_hook.dev = dev;
 
                 po->ifindex = dev ? dev->ifindex : 0;
                 packet_cached_dev_assign(po, dev);
         }
+        if (dev_curr)
+                dev_put(dev_curr);
 
         if (proto == 0 || !need_rehook)
                 goto out_unlock;
diff --git a/net/rds/info.c b/net/rds/info.c
index 9a6b4f66187c..140a44a5f7b7 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
 
         /* check for all kinds of wrapping and the like */
         start = (unsigned long)optval;
-        if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
+        if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index af427a3dbcba..43ec92680ae8 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -45,7 +45,7 @@ void tcf_hash_destroy(struct tc_action *a)
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
 
-int tcf_hash_release(struct tc_action *a, int bind)
+int __tcf_hash_release(struct tc_action *a, bool bind, bool strict)
 {
         struct tcf_common *p = a->priv;
         int ret = 0;
@@ -53,7 +53,7 @@ int tcf_hash_release(struct tc_action *a, int bind)
         if (p) {
                 if (bind)
                         p->tcfc_bindcnt--;
-                else if (p->tcfc_bindcnt > 0)
+                else if (strict && p->tcfc_bindcnt > 0)
                         return -EPERM;
 
                 p->tcfc_refcnt--;
@@ -64,9 +64,10 @@ int tcf_hash_release(struct tc_action *a, int bind)
                         ret = 1;
                 }
         }
+
         return ret;
 }
-EXPORT_SYMBOL(tcf_hash_release);
+EXPORT_SYMBOL(__tcf_hash_release);
 
 static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                            struct tc_action *a)
@@ -136,7 +137,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
                 head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
                 hlist_for_each_entry_safe(p, n, head, tcfc_head) {
                         a->priv = p;
-                        ret = tcf_hash_release(a, 0);
+                        ret = __tcf_hash_release(a, false, true);
                         if (ret == ACT_P_DELETED) {
                                 module_put(a->ops->owner);
                                 n_i++;
@@ -408,7 +409,7 @@ int tcf_action_destroy(struct list_head *actions, int bind)
         int ret = 0;
 
         list_for_each_entry_safe(a, tmp, actions, list) {
-                ret = tcf_hash_release(a, bind);
+                ret = __tcf_hash_release(a, bind, true);
                 if (ret == ACT_P_DELETED)
                         module_put(a->ops->owner);
                 else if (ret < 0)
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 1df78289e248..d0edeb7a1950 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -27,9 +27,10 @@
 struct tcf_bpf_cfg {
         struct bpf_prog *filter;
         struct sock_filter *bpf_ops;
-        char *bpf_name;
+        const char *bpf_name;
         u32 bpf_fd;
         u16 bpf_num_ops;
+        bool is_ebpf;
 };
 
 static int tcf_bpf(struct sk_buff *skb, const struct tc_action *act,
@@ -207,6 +208,7 @@ static int tcf_bpf_init_from_ops(struct nlattr **tb, struct tcf_bpf_cfg *cfg)
         cfg->bpf_ops = bpf_ops;
         cfg->bpf_num_ops = bpf_num_ops;
         cfg->filter = fp;
+        cfg->is_ebpf = false;
 
         return 0;
 }
@@ -241,18 +243,40 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg)
         cfg->bpf_fd = bpf_fd;
         cfg->bpf_name = name;
         cfg->filter = fp;
+        cfg->is_ebpf = true;
 
         return 0;
 }
 
+static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg)
+{
+        if (cfg->is_ebpf)
+                bpf_prog_put(cfg->filter);
+        else
+                bpf_prog_destroy(cfg->filter);
+
+        kfree(cfg->bpf_ops);
+        kfree(cfg->bpf_name);
+}
+
+static void tcf_bpf_prog_fill_cfg(const struct tcf_bpf *prog,
+                                  struct tcf_bpf_cfg *cfg)
+{
+        cfg->is_ebpf = tcf_bpf_is_ebpf(prog);
+        cfg->filter = prog->filter;
+
+        cfg->bpf_ops = prog->bpf_ops;
+        cfg->bpf_name = prog->bpf_name;
+}
+
 static int tcf_bpf_init(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action *act,
                         int replace, int bind)
 {
         struct nlattr *tb[TCA_ACT_BPF_MAX + 1];
+        struct tcf_bpf_cfg cfg, old;
         struct tc_act_bpf *parm;
         struct tcf_bpf *prog;
-        struct tcf_bpf_cfg cfg;
         bool is_bpf, is_ebpf;
         int ret;
 
@@ -301,6 +325,9 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
         prog = to_bpf(act);
         spin_lock_bh(&prog->tcf_lock);
 
+        if (ret != ACT_P_CREATED)
+                tcf_bpf_prog_fill_cfg(prog, &old);
+
         prog->bpf_ops = cfg.bpf_ops;
         prog->bpf_name = cfg.bpf_name;
 
@@ -316,32 +343,22 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
 
         if (ret == ACT_P_CREATED)
                 tcf_hash_insert(act);
+        else
+                tcf_bpf_cfg_cleanup(&old);
 
         return ret;
 
 destroy_fp:
-        if (is_ebpf)
-                bpf_prog_put(cfg.filter);
-        else
-                bpf_prog_destroy(cfg.filter);
-
-        kfree(cfg.bpf_ops);
-        kfree(cfg.bpf_name);
-
+        tcf_bpf_cfg_cleanup(&cfg);
         return ret;
 }
 
 static void tcf_bpf_cleanup(struct tc_action *act, int bind)
 {
-        const struct tcf_bpf *prog = act->priv;
-
-        if (tcf_bpf_is_ebpf(prog))
-                bpf_prog_put(prog->filter);
-        else
-                bpf_prog_destroy(prog->filter);
+        struct tcf_bpf_cfg tmp;
 
-        kfree(prog->bpf_ops);
-        kfree(prog->bpf_name);
+        tcf_bpf_prog_fill_cfg(act->priv, &tmp);
+        tcf_bpf_cfg_cleanup(&tmp);
 }
 
 static struct tc_action_ops act_bpf_ops __read_mostly = {
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index a42a3b257226..268545050ddb 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -98,6 +98,8 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                         return ret;
                 ret = ACT_P_CREATED;
         } else {
+                if (bind)
+                        return 0;
                 if (!ovr) {
                         tcf_hash_release(a, bind);
                         return -EEXIST;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 17e6d6669c7f..ff8b466a73f6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -68,13 +68,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                 }
                 ret = ACT_P_CREATED;
         } else {
-                p = to_pedit(a);
-                tcf_hash_release(a, bind);
                 if (bind)
                         return 0;
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
-
+                p = to_pedit(a);
                 if (p->tcfp_nkeys && p->tcfp_nkeys != parm->nkeys) {
                         keys = kmalloc(ksize, GFP_KERNEL);
                         if (keys == NULL)
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 93d5742dc7e0..6a783afe4960 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -385,6 +385,19 @@ static void choke_reset(struct Qdisc *sch)
 {
         struct choke_sched_data *q = qdisc_priv(sch);
 
+        while (q->head != q->tail) {
+                struct sk_buff *skb = q->tab[q->head];
+
+                q->head = (q->head + 1) & q->tab_mask;
+                if (!skb)
+                        continue;
+                qdisc_qstats_backlog_dec(sch, skb);
+                --sch->q.qlen;
+                qdisc_drop(skb, sch);
+        }
+
+        memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
+        q->head = q->tail = 0;
         red_restart(&q->vars);
 }
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 21ca33c9f036..a9ba030435a2 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -288,10 +288,26 @@ begin:
 
 static void fq_codel_reset(struct Qdisc *sch)
 {
-        struct sk_buff *skb;
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        int i;
 
-        while ((skb = fq_codel_dequeue(sch)) != NULL)
-                kfree_skb(skb);
+        INIT_LIST_HEAD(&q->new_flows);
+        INIT_LIST_HEAD(&q->old_flows);
+        for (i = 0; i < q->flows_cnt; i++) {
+                struct fq_codel_flow *flow = q->flows + i;
+
+                while (flow->head) {
+                        struct sk_buff *skb = dequeue_head(flow);
+
+                        qdisc_qstats_backlog_dec(sch, skb);
+                        kfree_skb(skb);
+                }
+
+                INIT_LIST_HEAD(&flow->flowchain);
+                codel_vars_init(&flow->cvars);
+        }
+        memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));
+        sch->q.qlen = 0;
 }
 
 static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = {
diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
index 89f8fcf73f18..ade9445a55ab 100644
--- a/net/sched/sch_plug.c
+++ b/net/sched/sch_plug.c
@@ -216,6 +216,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
         .peek        =       qdisc_peek_head,
         .init        =       plug_init,
         .change      =       plug_change,
+        .reset       =       qdisc_reset_queue,
         .owner       =       THIS_MODULE,
 };
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1425ec2bbd5a..17bef01b9aa3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2200,12 +2200,6 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
         if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
                 return -EFAULT;
 
-        if (sctp_sk(sk)->subscribe.sctp_data_io_event)
-                pr_warn_ratelimited(DEPRECATED "%s (pid %d) "
-                                    "Requested SCTP_SNDRCVINFO event.\n"
-                                    "Use SCTP_RCVINFO through SCTP_RECVRCVINFO option instead.\n",
-                                    current->comm, task_pid_nr(current));
-
         /* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
          * if there is no data to be sent or retransmit, the stack will
          * immediately send up this notification.
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 9825ff0f91d6..6255d141133b 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -240,8 +240,8 @@ static struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt, __be32 xid)
                 req = xprt_alloc_bc_req(xprt, GFP_ATOMIC);
                 if (!req)
                         goto not_found;
-                /* Note: this 'free' request adds it to xprt->bc_pa_list */
-                xprt_free_bc_request(req);
+                list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
+                xprt->bc_alloc_count++;
         }
         req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
                                 rq_bc_pa_list);
@@ -336,7 +336,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
 
         spin_lock(&xprt->bc_pa_lock);
         list_del(&req->rq_bc_pa_list);
-        xprt->bc_alloc_count--;
+        xprt_dec_alloc_count(xprt, 1);
         spin_unlock(&xprt->bc_pa_lock);
 
         req->rq_private_buf.len = copied;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index cbc6af923dd1..23608eb0ded2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1902,6 +1902,7 @@ call_transmit_status(struct rpc_task *task)
 
         switch (task->tk_status) {
         case -EAGAIN:
+        case -ENOBUFS:
                 break;
         default:
                 dprint_status(task);
@@ -1928,7 +1929,6 @@ call_transmit_status(struct rpc_task *task)
         case -ECONNABORTED:
         case -EADDRINUSE:
         case -ENOTCONN:
-        case -ENOBUFS:
         case -EPIPE:
                 rpc_task_force_reencode(task);
         }
@@ -2057,12 +2057,13 @@ call_status(struct rpc_task *task)
         case -ECONNABORTED:
                 rpc_force_rebind(clnt);
         case -EADDRINUSE:
-        case -ENOBUFS:
                 rpc_delay(task, 3*HZ);
         case -EPIPE:
         case -ENOTCONN:
                 task->tk_action = call_bind;
                 break;
+        case -ENOBUFS:
+                rpc_delay(task, HZ>>2);
         case -EAGAIN:
                 task->tk_action = call_transmit;
                 break;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e193c2b5476b..0030376327b7 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -527,6 +527,10 @@ static int xs_local_send_request(struct rpc_task *task)
                               true, &sent);
         dprintk("RPC:       %s(%u) = %d\n",
                         __func__, xdr->len - req->rq_bytes_sent, status);
+
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
+
         if (likely(sent > 0) || status == 0) {
                 req->rq_bytes_sent += sent;
                 req->rq_xmit_bytes_sent += sent;
@@ -539,6 +543,7 @@ static int xs_local_send_request(struct rpc_task *task)
 
         switch (status) {
         case -ENOBUFS:
+                break;
         case -EAGAIN:
                 status = xs_nospace(task);
                 break;
@@ -589,6 +594,9 @@ static int xs_udp_send_request(struct rpc_task *task)
         if (status == -EPERM)
                 goto process_status;
 
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
+
         if (sent > 0 || status == 0) {
                 req->rq_xmit_bytes_sent += sent;
                 if (sent >= req->rq_slen)
@@ -669,9 +677,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
                 dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
                                 xdr->len - req->rq_bytes_sent, status);
 
-                if (unlikely(sent == 0 && status < 0))
-                        break;
-
                 /* If we've sent the entire packet, immediately
                  * reset the count of bytes sent. */
                 req->rq_bytes_sent += sent;
@@ -681,18 +686,21 @@ static int xs_tcp_send_request(struct rpc_task *task)
                         return 0;
                 }
 
-                if (sent != 0)
-                        continue;
-                status = -EAGAIN;
-                break;
+                if (status < 0)
+                        break;
+                if (sent == 0) {
+                        status = -EAGAIN;
+                        break;
+                }
         }
+        if (status == -EAGAIN && sk_stream_is_writeable(transport->inet))
+                status = -ENOBUFS;
 
         switch (status) {
         case -ENOTSOCK:
                 status = -ENOTCONN;
                 /* Should we call xs_close() here? */
                 break;
-        case -ENOBUFS:
         case -EAGAIN:
                 status = xs_nospace(task);
                 break;
@@ -703,6 +711,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
         case -ECONNREFUSED:
         case -ENOTCONN:
         case -EADDRINUSE:
+        case -ENOBUFS:
         case -EPIPE:
                 clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
         }
diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
index 9cb8522d8d22..f3d3fb42b873 100755
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -137,7 +137,7 @@ my $ksource = ($ARGV[0] ? $ARGV[0] : '.');
 my $kconfig = $ARGV[1];
 my $lsmod_file = $ENV{'LSMOD'};
 
-my @makefiles = `find $ksource -name Makefile 2>/dev/null`;
+my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`;
 chomp @makefiles;
 
 my %depends;
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index e72548b5897e..d33437007ad2 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
         if (index_key->type == &key_type_keyring)
                 up_write(&keyring_serialise_link_sem);
 
-        if (edit && !edit->dead_leaf) {
-                key_payload_reserve(keyring,
-                                    keyring->datalen - KEYQUOTA_LINK_BYTES);
+        if (edit) {
+                if (!edit->dead_leaf) {
+                        key_payload_reserve(keyring,
+                                keyring->datalen - KEYQUOTA_LINK_BYTES);
+                }
                 assoc_array_cancel_edit(edit);
         }
         up_write(&keyring->sem);
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 9ed32502470e..5ebb89687936 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -406,6 +406,7 @@ static __init int yama_init(void)
          */
         if (!security_module_enable("yama"))
                 return 0;
+        yama_add_hooks();
 #endif
         pr_info("Yama: becoming mindful.\n");
 
diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
index 7bb988fa6b6d..2a153d260836 100644
--- a/sound/firewire/amdtp.c
+++ b/sound/firewire/amdtp.c
@@ -740,8 +740,9 @@ static int handle_in_packet(struct amdtp_stream *s,
             s->data_block_counter != UINT_MAX)
                 data_block_counter = s->data_block_counter;
 
-        if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) && data_block_counter == 0) ||
-            (s->data_block_counter == UINT_MAX)) {
+        if (((s->flags & CIP_SKIP_DBC_ZERO_CHECK) &&
+             data_block_counter == s->tx_first_dbc) ||
+            s->data_block_counter == UINT_MAX) {
                 lost = false;
         } else if (!(s->flags & CIP_DBC_IS_END_EVENT)) {
                 lost = data_block_counter != s->data_block_counter;
diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
index 26b909329e54..b2cf9e75693b 100644
--- a/sound/firewire/amdtp.h
+++ b/sound/firewire/amdtp.h
@@ -157,6 +157,8 @@ struct amdtp_stream {
 
         /* quirk: fixed interval of dbc between previos/current packets. */
         unsigned int tx_dbc_interval;
+        /* quirk: indicate the value of dbc field in a first packet. */
+        unsigned int tx_first_dbc;
 
         bool callbacked;
         wait_queue_head_t callback_wait;
diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
index 2682e7e3e5c9..c94a432f7cc6 100644
--- a/sound/firewire/fireworks/fireworks.c
+++ b/sound/firewire/fireworks/fireworks.c
@@ -248,8 +248,16 @@ efw_probe(struct fw_unit *unit,
         err = get_hardware_info(efw);
         if (err < 0)
                 goto error;
+        /* AudioFire8 (since 2009) and AudioFirePre8 */
         if (entry->model_id == MODEL_ECHO_AUDIOFIRE_9)
                 efw->is_af9 = true;
+        /* These models uses the same firmware. */
+        if (entry->model_id == MODEL_ECHO_AUDIOFIRE_2 ||
+            entry->model_id == MODEL_ECHO_AUDIOFIRE_4 ||
+            entry->model_id == MODEL_ECHO_AUDIOFIRE_9 ||
+            entry->model_id == MODEL_GIBSON_RIP ||
+            entry->model_id == MODEL_GIBSON_GOLDTOP)
+                efw->is_fireworks3 = true;
 
         snd_efw_proc_init(efw);
 
diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
index 4f0201a95222..084d414b228c 100644
--- a/sound/firewire/fireworks/fireworks.h
+++ b/sound/firewire/fireworks/fireworks.h
@@ -71,6 +71,7 @@ struct snd_efw {
 
         /* for quirks */
         bool is_af9;
+        bool is_fireworks3;
         u32 firmware_version;
 
         unsigned int midi_in_ports;
diff --git a/sound/firewire/fireworks/fireworks_stream.c b/sound/firewire/fireworks/fireworks_stream.c
index c55db1bddc80..7e353f1f7bff 100644
--- a/sound/firewire/fireworks/fireworks_stream.c
+++ b/sound/firewire/fireworks/fireworks_stream.c
@@ -172,6 +172,15 @@ int snd_efw_stream_init_duplex(struct snd_efw *efw)
         efw->tx_stream.flags |= CIP_DBC_IS_END_EVENT;
         /* Fireworks reset dbc at bus reset. */
         efw->tx_stream.flags |= CIP_SKIP_DBC_ZERO_CHECK;
+        /*
+         * But Recent firmwares starts packets with non-zero dbc.
+         * Driver version 5.7.6 installs firmware version 5.7.3.
+         */
+        if (efw->is_fireworks3 &&
+            (efw->firmware_version == 0x5070000 ||
+             efw->firmware_version == 0x5070300 ||
+             efw->firmware_version == 0x5080000))
+                efw->tx_stream.tx_first_dbc = 0x02;
         /* AudioFire9 always reports wrong dbs. */
         if (efw->is_af9)
                 efw->tx_stream.flags |= CIP_WRONG_DBS;
diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
index b2da19b60f4e..358f16195483 100644
--- a/sound/hda/ext/hdac_ext_controller.c
+++ b/sound/hda/ext/hdac_ext_controller.c
@@ -44,16 +44,10 @@ int snd_hdac_ext_bus_parse_capabilities(struct hdac_ext_bus *ebus)
 
         offset = snd_hdac_chip_readl(bus, LLCH);
 
-        if (offset < 0)
-                return -EIO;
-
         /* Lets walk the linked capabilities list */
         do {
                 cur_cap = _snd_hdac_chip_read(l, bus, offset);
 
-                if (cur_cap < 0)
-                        return -EIO;
-
                 dev_dbg(bus->dev, "Capability version: 0x%x\n",
                                 ((cur_cap & AZX_CAP_HDR_VER_MASK) >> AZX_CAP_HDR_VER_OFF));
 
diff --git a/sound/hda/ext/hdac_ext_stream.c b/sound/hda/ext/hdac_ext_stream.c
index f8ffbdbb450d..3de47dd1a76d 100644
--- a/sound/hda/ext/hdac_ext_stream.c
+++ b/sound/hda/ext/hdac_ext_stream.c
@@ -299,7 +299,7 @@ hdac_ext_host_stream_assign(struct hdac_ext_bus *ebus,
                 if (stream->direction != substream->stream)
                         continue;
 
-                if (stream->opened) {
+                if (!stream->opened) {
                         if (!hstream->decoupled)
                                 snd_hdac_ext_stream_decouple(ebus, hstream, true);
                         res = hstream;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 735bdcb04ce8..c38c68f57938 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -867,7 +867,7 @@ static int azx_suspend(struct device *dev)
 
         chip = card->private_data;
         hda = container_of(chip, struct hda_intel, chip);
-        if (chip->disabled || hda->init_failed)
+        if (chip->disabled || hda->init_failed || !chip->running)
                 return 0;
 
         bus = azx_bus(chip);
@@ -902,7 +902,7 @@ static int azx_resume(struct device *dev)
 
         chip = card->private_data;
         hda = container_of(chip, struct hda_intel, chip);
-        if (chip->disabled || hda->init_failed)
+        if (chip->disabled || hda->init_failed || !chip->running)
                 return 0;
 
         if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
@@ -1027,7 +1027,7 @@ static int azx_runtime_idle(struct device *dev)
                 return 0;
 
         if (!power_save_controller || !azx_has_pm_runtime(chip) ||
-            azx_bus(chip)->codec_powered)
+            azx_bus(chip)->codec_powered || !chip->running)
                 return -EBUSY;
 
         return 0;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 25ccf781fbe7..584a0343ab0c 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -999,9 +999,7 @@ static void cs4210_spdif_automute(struct hda_codec *codec,
 
         spec->spdif_present = spdif_present;
         /* SPDIF TX on/off */
-        if (spdif_present)
-                snd_hda_set_pin_ctl(codec, spdif_pin,
-                                    spdif_present ? PIN_OUT : 0);
+        snd_hda_set_pin_ctl(codec, spdif_pin, spdif_present ? PIN_OUT : 0);
 
         cs_automute(codec);
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 742fc626f9e1..0b9847affbec 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2222,7 +2222,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
-        SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
+        SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
 
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
@@ -5185,9 +5185,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
+        SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
         SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -5398,8 +5400,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {0x19, 0x411111f0}, \
         {0x1a, 0x411111f0}, \
         {0x1b, 0x411111f0}, \
-        {0x1d, 0x40700001}, \
-        {0x1e, 0x411111f0}, \
         {0x21, 0x02211020}
 
 #define ALC282_STANDARD_PINS \
@@ -5473,6 +5473,28 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x1e, 0x411111f0},
                 {0x21, 0x0221103f}),
         SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x14, 0x90170150},
+                {0x17, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x02011020},
+                {0x1d, 0x4054c029},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0221105f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x14, 0x90170110},
+                {0x17, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x01014020},
+                {0x1d, 0x4054c029},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60160},
                 {0x14, 0x90170120},
                 {0x17, 0x90170140},
@@ -5534,10 +5556,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS,
-                {0x13, 0x40000000}),
+                {0x13, 0x40000000},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS,
-                {0x13, 0x411111f0}),
+                {0x13, 0x411111f0},
+                {0x1d, 0x40700001},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC256_STANDARD_PINS,
+                {0x13, 0x411111f0},
+                {0x1d, 0x4077992d},
+                {0x1e, 0x411111ff}),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
                 {0x12, 0x90a60130},
                 {0x13, 0x40000000},
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index dcc7fe91244c..9d947aef2c8b 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2920,7 +2920,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
                       "HP Mini", STAC_92HD83XXX_HP_LED),
         SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
-        SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
+        /* match both for 0xfa91 and 0xfa93 */
+        SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_TOSHIBA, 0xfffd, 0xfa91,
                       "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
         {} /* terminator */
 };
diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
index 6492bca8c70f..4ca12665ff73 100644
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c
@@ -88,7 +88,7 @@ static int dac_mute_put(struct snd_kcontrol *ctl,
         int changed;
 
         mutex_lock(&chip->mutex);
-        changed = !value->value.integer.value[0] != chip->dac_mute;
+        changed = (!value->value.integer.value[0]) != chip->dac_mute;
         if (changed) {
                 chip->dac_mute = !value->value.integer.value[0];
                 chip->model.update_dac_mute(chip);
diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index d7ec4756e45b..8e36198474d9 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -457,14 +457,14 @@ static int cs4265_pcm_hw_params(struct snd_pcm_substream *substream,
         case SND_SOC_DAIFMT_RIGHT_J:
                 if (params_width(params) == 16) {
                         snd_soc_update_bits(codec, CS4265_DAC_CTL,
-                                CS4265_DAC_CTL_DIF, (1 << 5));
+                                CS4265_DAC_CTL_DIF, (2 << 4));
                         snd_soc_update_bits(codec, CS4265_SPDIF_CTL2,
-                                CS4265_SPDIF_CTL2_DIF, (1 << 7));
+                                CS4265_SPDIF_CTL2_DIF, (2 << 6));
                 } else {
                         snd_soc_update_bits(codec, CS4265_DAC_CTL,
-                                CS4265_DAC_CTL_DIF, (3 << 5));
+                                CS4265_DAC_CTL_DIF, (3 << 4));
                         snd_soc_update_bits(codec, CS4265_SPDIF_CTL2,
-                                CS4265_SPDIF_CTL2_DIF, (1 << 7));
+                                CS4265_SPDIF_CTL2_DIF, (3 << 6));
                 }
                 break;
         case SND_SOC_DAIFMT_LEFT_J:
@@ -473,7 +473,7 @@ static int cs4265_pcm_hw_params(struct snd_pcm_substream *substream,
                 snd_soc_update_bits(codec, CS4265_ADC_CTL,
                         CS4265_ADC_DIF, 0);
                 snd_soc_update_bits(codec, CS4265_SPDIF_CTL2,
-                        CS4265_SPDIF_CTL2_DIF, (1 << 6));
+                        CS4265_SPDIF_CTL2_DIF, 0);
 
                 break;
         default:
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 477e13d30971..e7ba557979cb 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec)
 
         if (val != -1) {
                 regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL,
-                                        PCM1681_DEEMPH_RATE_MASK, val);
+                                   PCM1681_DEEMPH_RATE_MASK, val << 3);
                 enable = 1;
         } else
                 enable = 0;
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 9ce311e088fc..961bd7e5877e 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -2943,6 +2943,9 @@ static int rt5645_irq_detection(struct rt5645_priv *rt5645)
 {
         int val, btn_type, gpio_state = 0, report = 0;
 
+        if (!rt5645->codec)
+                return -EINVAL;
+
         switch (rt5645->pdata.jd_mode) {
         case 0: /* Not using rt5645 JD */
                 if (rt5645->gpiod_hp_det) {
@@ -3338,6 +3341,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
                 break;
 
         case RT5645_DMIC_DATA_GPIO5:
+                regmap_update_bits(rt5645->regmap, RT5645_GPIO_CTRL1,
+                        RT5645_I2S2_DAC_PIN_MASK, RT5645_I2S2_DAC_PIN_GPIO);
                 regmap_update_bits(rt5645->regmap, RT5645_DMIC_CTRL1,
                         RT5645_DMIC_1_DP_MASK, RT5645_DMIC_1_DP_GPIO5);
                 regmap_update_bits(rt5645->regmap, RT5645_GPIO_CTRL1,
diff --git a/sound/soc/codecs/rt5645.h b/sound/soc/codecs/rt5645.h
index 0353a6a273ab..278bb9f464c4 100644
--- a/sound/soc/codecs/rt5645.h
+++ b/sound/soc/codecs/rt5645.h
@@ -1693,6 +1693,10 @@
 #define RT5645_GP6_PIN_SFT                      6
 #define RT5645_GP6_PIN_GPIO6                    (0x0 << 6)
 #define RT5645_GP6_PIN_DMIC2_SDA                (0x1 << 6)
+#define RT5645_I2S2_DAC_PIN_MASK                (0x1 << 4)
+#define RT5645_I2S2_DAC_PIN_SFT                 4
+#define RT5645_I2S2_DAC_PIN_I2S                 (0x0 << 4)
+#define RT5645_I2S2_DAC_PIN_GPIO                (0x1 << 4)
 #define RT5645_GP8_PIN_MASK                     (0x1 << 3)
 #define RT5645_GP8_PIN_SFT                      3
 #define RT5645_GP8_PIN_GPIO8                    (0x0 << 3)
diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
index bd7a344bf8c5..1c317de26176 100644
--- a/sound/soc/codecs/sgtl5000.h
+++ b/sound/soc/codecs/sgtl5000.h
@@ -275,7 +275,7 @@
 #define SGTL5000_BIAS_CTRL_MASK                 0x000e
 #define SGTL5000_BIAS_CTRL_SHIFT                1
 #define SGTL5000_BIAS_CTRL_WIDTH                3
-#define SGTL5000_SMALL_POP                      0
+#define SGTL5000_SMALL_POP                      1
 
 /*
  * SGTL5000_CHIP_MIC_CTRL
diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c
index 938d2cb6d78b..84a4f5ad8064 100644
--- a/sound/soc/codecs/ssm4567.c
+++ b/sound/soc/codecs/ssm4567.c
@@ -315,7 +315,13 @@ static int ssm4567_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         if (invert_fclk)
                 ctrl1 |= SSM4567_SAI_CTRL_1_FSYNC;
 
-        return regmap_write(ssm4567->regmap, SSM4567_REG_SAI_CTRL_1, ctrl1);
+        return regmap_update_bits(ssm4567->regmap, SSM4567_REG_SAI_CTRL_1,
+                        SSM4567_SAI_CTRL_1_BCLK |
+                        SSM4567_SAI_CTRL_1_FSYNC |
+                        SSM4567_SAI_CTRL_1_LJ |
+                        SSM4567_SAI_CTRL_1_TDM |
+                        SSM4567_SAI_CTRL_1_PDM,
+                        ctrl1);
 }
 
 static int ssm4567_set_power(struct ssm4567 *ssm4567, bool enable)
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index c7647e066cfd..c0b940e2019f 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -633,7 +633,7 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
                 sub *= 100000;
                 do_div(sub, freq);
 
-                if (sub < savesub) {
+                if (sub < savesub && !(i == 0 && psr == 0 && div2 == 0)) {
                         baudrate = tmprate;
                         savesub = sub;
                         pm = i;
diff --git a/sound/soc/intel/Makefile b/sound/soc/intel/Makefile
index 3853ec2ddbc7..6de5d5cd3280 100644
--- a/sound/soc/intel/Makefile
+++ b/sound/soc/intel/Makefile
@@ -7,4 +7,4 @@ obj-$(CONFIG_SND_SOC_INTEL_BAYTRAIL) += baytrail/
 obj-$(CONFIG_SND_SST_MFLD_PLATFORM) += atom/
 
 # Machine support
-obj-$(CONFIG_SND_SOC_INTEL_SST) += boards/
+obj-$(CONFIG_SND_SOC) += boards/
diff --git a/sound/soc/intel/atom/sst/sst_drv_interface.c b/sound/soc/intel/atom/sst/sst_drv_interface.c
index 620da1d1b9e3..0e0e4d9c021f 100644
--- a/sound/soc/intel/atom/sst/sst_drv_interface.c
+++ b/sound/soc/intel/atom/sst/sst_drv_interface.c
@@ -42,6 +42,11 @@
 #define MIN_FRAGMENT_SIZE (50 * 1024)
 #define MAX_FRAGMENT_SIZE (1024 * 1024)
 #define SST_GET_BYTES_PER_SAMPLE(pcm_wd_sz)  (((pcm_wd_sz + 15) >> 4) << 1)
+#ifdef CONFIG_PM
+#define GET_USAGE_COUNT(dev) (atomic_read(&dev->power.usage_count))
+#else
+#define GET_USAGE_COUNT(dev) 1
+#endif
 
 int free_stream_context(struct intel_sst_drv *ctx, unsigned int str_id)
 {
@@ -141,15 +146,9 @@ static int sst_power_control(struct device *dev, bool state)
         int ret = 0;
         int usage_count = 0;
 
-#ifdef CONFIG_PM
-        usage_count = atomic_read(&dev->power.usage_count);
-#else
-        usage_count = 1;
-#endif
-
         if (state == true) {
                 ret = pm_runtime_get_sync(dev);
-
+                usage_count = GET_USAGE_COUNT(dev);
                 dev_dbg(ctx->dev, "Enable: pm usage count: %d\n", usage_count);
                 if (ret < 0) {
                         dev_err(ctx->dev, "Runtime get failed with err: %d\n", ret);
@@ -164,6 +163,7 @@ static int sst_power_control(struct device *dev, bool state)
                         }
                 }
         } else {
+                usage_count = GET_USAGE_COUNT(dev);
                 dev_dbg(ctx->dev, "Disable: pm usage count: %d\n", usage_count);
                 return sst_pm_runtime_put(ctx);
         }
diff --git a/sound/soc/intel/baytrail/sst-baytrail-ipc.c b/sound/soc/intel/baytrail/sst-baytrail-ipc.c
index 4c01bb43928d..5bbaa667bec1 100644
--- a/sound/soc/intel/baytrail/sst-baytrail-ipc.c
+++ b/sound/soc/intel/baytrail/sst-baytrail-ipc.c
@@ -701,6 +701,8 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
         if (byt == NULL)
                 return -ENOMEM;
 
+        byt->dev = dev;
+
         ipc = &byt->ipc;
         ipc->dev = dev;
         ipc->ops.tx_msg = byt_tx_msg;
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index d604ee80eda4..70f832114a5a 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -69,12 +69,12 @@ static const struct snd_soc_dapm_route cht_audio_map[] = {
         {"Headphone", NULL, "HPR"},
         {"Ext Spk", NULL, "SPKL"},
         {"Ext Spk", NULL, "SPKR"},
-        {"AIF1 Playback", NULL, "ssp2 Tx"},
+        {"HiFi Playback", NULL, "ssp2 Tx"},
         {"ssp2 Tx", NULL, "codec_out0"},
         {"ssp2 Tx", NULL, "codec_out1"},
         {"codec_in0", NULL, "ssp2 Rx" },
         {"codec_in1", NULL, "ssp2 Rx" },
-        {"ssp2 Rx", NULL, "AIF1 Capture"},
+        {"ssp2 Rx", NULL, "HiFi Capture"},
 };
 
 static const struct snd_kcontrol_new cht_mc_controls[] = {
diff --git a/sound/soc/intel/haswell/sst-haswell-ipc.c b/sound/soc/intel/haswell/sst-haswell-ipc.c
index f95f271aab0c..f6efa9d4acad 100644
--- a/sound/soc/intel/haswell/sst-haswell-ipc.c
+++ b/sound/soc/intel/haswell/sst-haswell-ipc.c
@@ -2119,6 +2119,8 @@ int sst_hsw_dsp_init(struct device *dev, struct sst_pdata *pdata)
         if (hsw == NULL)
                 return -ENOMEM;
 
+        hsw->dev = dev;
+
         ipc = &hsw->ipc;
         ipc->dev = dev;
         ipc->ops.tx_msg = hsw_tx_msg;
diff --git a/sound/soc/mediatek/mt8173-max98090.c b/sound/soc/mediatek/mt8173-max98090.c
index 4d44b5803e55..2d2536af141f 100644
--- a/sound/soc/mediatek/mt8173-max98090.c
+++ b/sound/soc/mediatek/mt8173-max98090.c
@@ -103,7 +103,6 @@ static struct snd_soc_dai_link mt8173_max98090_dais[] = {
                 .name = "MAX98090 Playback",
                 .stream_name = "MAX98090 Playback",
                 .cpu_dai_name = "DL1",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
@@ -114,7 +113,6 @@ static struct snd_soc_dai_link mt8173_max98090_dais[] = {
                 .name = "MAX98090 Capture",
                 .stream_name = "MAX98090 Capture",
                 .cpu_dai_name = "VUL",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
@@ -125,7 +123,6 @@ static struct snd_soc_dai_link mt8173_max98090_dais[] = {
         {
                 .name = "Codec",
                 .cpu_dai_name = "I2S",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .no_pcm = 1,
                 .codec_dai_name = "HiFi",
                 .init = mt8173_max98090_init,
@@ -152,9 +149,21 @@ static struct snd_soc_card mt8173_max98090_card = {
 static int mt8173_max98090_dev_probe(struct platform_device *pdev)
 {
         struct snd_soc_card *card = &mt8173_max98090_card;
-        struct device_node *codec_node;
+        struct device_node *codec_node, *platform_node;
         int ret, i;
 
+        platform_node = of_parse_phandle(pdev->dev.of_node,
+                                         "mediatek,platform", 0);
+        if (!platform_node) {
+                dev_err(&pdev->dev, "Property 'platform' missing or invalid\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < card->num_links; i++) {
+                if (mt8173_max98090_dais[i].platform_name)
+                        continue;
+                mt8173_max98090_dais[i].platform_of_node = platform_node;
+        }
+
         codec_node = of_parse_phandle(pdev->dev.of_node,
                                       "mediatek,audio-codec", 0);
         if (!codec_node) {
diff --git a/sound/soc/mediatek/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173-rt5650-rt5676.c
index 094055323059..6f52eca05e26 100644
--- a/sound/soc/mediatek/mt8173-rt5650-rt5676.c
+++ b/sound/soc/mediatek/mt8173-rt5650-rt5676.c
@@ -138,7 +138,6 @@ static struct snd_soc_dai_link mt8173_rt5650_rt5676_dais[] = {
                 .name = "rt5650_rt5676 Playback",
                 .stream_name = "rt5650_rt5676 Playback",
                 .cpu_dai_name = "DL1",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
@@ -149,7 +148,6 @@ static struct snd_soc_dai_link mt8173_rt5650_rt5676_dais[] = {
                 .name = "rt5650_rt5676 Capture",
                 .stream_name = "rt5650_rt5676 Capture",
                 .cpu_dai_name = "VUL",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
@@ -161,7 +159,6 @@ static struct snd_soc_dai_link mt8173_rt5650_rt5676_dais[] = {
         {
                 .name = "Codec",
                 .cpu_dai_name = "I2S",
-                .platform_name = "11220000.mt8173-afe-pcm",
                 .no_pcm = 1,
                 .codecs = mt8173_rt5650_rt5676_codecs,
                 .num_codecs = 2,
@@ -209,7 +206,21 @@ static struct snd_soc_card mt8173_rt5650_rt5676_card = {
 static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)
 {
         struct snd_soc_card *card = &mt8173_rt5650_rt5676_card;
-        int ret;
+        struct device_node *platform_node;
+        int i, ret;
+
+        platform_node = of_parse_phandle(pdev->dev.of_node,
+                                         "mediatek,platform", 0);
+        if (!platform_node) {
+                dev_err(&pdev->dev, "Property 'platform' missing or invalid\n");
+                return -EINVAL;
+        }
+
+        for (i = 0; i < card->num_links; i++) {
+                if (mt8173_rt5650_rt5676_dais[i].platform_name)
+                        continue;
+                mt8173_rt5650_rt5676_dais[i].platform_of_node = platform_node;
+        }
 
         mt8173_rt5650_rt5676_codecs[0].of_node =
                 of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 0);
diff --git a/sound/soc/mediatek/mtk-afe-pcm.c b/sound/soc/mediatek/mtk-afe-pcm.c
index cc228db5fb76..9863da73dfe0 100644
--- a/sound/soc/mediatek/mtk-afe-pcm.c
+++ b/sound/soc/mediatek/mtk-afe-pcm.c
@@ -1199,6 +1199,8 @@ err_pm_disable:
 static int mtk_afe_pcm_dev_remove(struct platform_device *pdev)
 {
         pm_runtime_disable(&pdev->dev);
+        if (!pm_runtime_status_suspended(&pdev->dev))
+                mtk_afe_runtime_suspend(&pdev->dev);
         snd_soc_unregister_component(&pdev->dev);
         snd_soc_unregister_platform(&pdev->dev);
         return 0;
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 3a4a5c0e3f97..0e1e69c7abd5 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1716,6 +1716,7 @@ card_probe_error:
         if (card->remove)
                 card->remove(card);
 
+        snd_soc_dapm_free(&card->dapm);
         soc_cleanup_card_debugfs(card);
         snd_card_free(card->snd_card);
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index aa327c92480c..e0de8072c514 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -358,9 +358,10 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
                         data->widget =
                                 snd_soc_dapm_new_control_unlocked(widget->dapm,
                                 &template);
+                        kfree(name);
                         if (!data->widget) {
                                 ret = -ENOMEM;
-                                goto err_name;
+                                goto err_data;
                         }
                 }
                 break;
@@ -389,11 +390,12 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
 
                         data->value = template.on_val;
 
-                        data->widget = snd_soc_dapm_new_control(widget->dapm,
-                                        &template);
+                        data->widget = snd_soc_dapm_new_control_unlocked(
+                                                widget->dapm, &template);
+                        kfree(name);
                         if (!data->widget) {
                                 ret = -ENOMEM;
-                                goto err_name;
+                                goto err_data;
                         }
 
                         snd_soc_dapm_add_path(widget->dapm, data->widget,
@@ -408,8 +410,6 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
 
         return 0;
 
-err_name:
-        kfree(name);
 err_data:
         kfree(data);
         return ret;
@@ -418,8 +418,6 @@ err_data:
 static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
 {
         struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
-        if (data->widget)
-                kfree(data->widget->name);
         kfree(data->wlist);
         kfree(data);
 }
@@ -1952,6 +1950,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                                            size_t count, loff_t *ppos)
 {
         struct snd_soc_dapm_widget *w = file->private_data;
+        struct snd_soc_card *card = w->dapm->card;
         char *buf;
         int in, out;
         ssize_t ret;
@@ -1961,6 +1960,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&card->dapm_mutex);
+
         /* Supply widgets are not handled by is_connected_{input,output}_ep() */
         if (w->is_supply) {
                 in = 0;
@@ -2007,6 +2008,8 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                                         p->sink->name);
         }
 
+        mutex_unlock(&card->dapm_mutex);
+
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
         kfree(buf);
@@ -2281,11 +2284,15 @@ static ssize_t dapm_widget_show(struct device *dev,
         struct snd_soc_pcm_runtime *rtd = dev_get_drvdata(dev);
         int i, count = 0;
 
+        mutex_lock(&rtd->card->dapm_mutex);
+
         for (i = 0; i < rtd->num_codecs; i++) {
                 struct snd_soc_codec *codec = rtd->codec_dais[i]->codec;
                 count += dapm_widget_show_codec(codec, buf + count);
         }
 
+        mutex_unlock(&rtd->card->dapm_mutex);
+
         return count;
 }
 
@@ -3334,16 +3341,10 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
         }
 
         prefix = soc_dapm_prefix(dapm);
-        if (prefix) {
+        if (prefix)
                 w->name = kasprintf(GFP_KERNEL, "%s %s", prefix, widget->name);
-                if (widget->sname)
-                        w->sname = kasprintf(GFP_KERNEL, "%s %s", prefix,
-                                             widget->sname);
-        } else {
+        else
                 w->name = kasprintf(GFP_KERNEL, "%s", widget->name);
-                if (widget->sname)
-                        w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
-        }
         if (w->name == NULL) {
                 kfree(w);
                 return NULL;
@@ -3792,7 +3793,7 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
                                 break;
                         }
 
-                        if (!w->sname || !strstr(w->sname, dai_w->name))
+                        if (!w->sname || !strstr(w->sname, dai_w->sname))
                                 continue;
 
                         if (dai_w->id == snd_soc_dapm_dai_in) {
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index d0960683c409..31068b8f3db0 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -33,6 +33,7 @@
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
 #include <sound/soc-topology.h>
+#include <sound/tlv.h>
 
 /*
  * We make several passes over the data (since it wont necessarily be ordered)
@@ -144,7 +145,7 @@ static const struct snd_soc_tplg_kcontrol_ops io_ops[] = {
         {SND_SOC_TPLG_CTL_STROBE, snd_soc_get_strobe,
                 snd_soc_put_strobe, NULL},
         {SND_SOC_TPLG_DAPM_CTL_VOLSW, snd_soc_dapm_get_volsw,
-                snd_soc_dapm_put_volsw, NULL},
+                snd_soc_dapm_put_volsw, snd_soc_info_volsw},
         {SND_SOC_TPLG_DAPM_CTL_ENUM_DOUBLE, snd_soc_dapm_get_enum_double,
                 snd_soc_dapm_put_enum_double, snd_soc_info_enum_double},
         {SND_SOC_TPLG_DAPM_CTL_ENUM_VIRT, snd_soc_dapm_get_enum_double,
@@ -534,7 +535,7 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
                         k->put = bops[i].put;
                 if (k->get == NULL && bops[i].id == hdr->ops.get)
                         k->get = bops[i].get;
-                if (k->info == NULL && ops[i].id == hdr->ops.info)
+                if (k->info == NULL && bops[i].id == hdr->ops.info)
                         k->info = bops[i].info;
         }
 
@@ -579,29 +580,51 @@ static int soc_tplg_init_kcontrol(struct soc_tplg *tplg,
         return 0;
 }
 
+
+static int soc_tplg_create_tlv_db_scale(struct soc_tplg *tplg,
+        struct snd_kcontrol_new *kc, struct snd_soc_tplg_tlv_dbscale *scale)
+{
+        unsigned int item_len = 2 * sizeof(unsigned int);
+        unsigned int *p;
+
+        p = kzalloc(item_len + 2 * sizeof(unsigned int), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        p[0] = SNDRV_CTL_TLVT_DB_SCALE;
+        p[1] = item_len;
+        p[2] = scale->min;
+        p[3] = (scale->step & TLV_DB_SCALE_MASK)
+                        | (scale->mute ? TLV_DB_SCALE_MUTE : 0);
+
+        kc->tlv.p = (void *)p;
+        return 0;
+}
+
 static int soc_tplg_create_tlv(struct soc_tplg *tplg,
-        struct snd_kcontrol_new *kc, u32 tlv_size)
+        struct snd_kcontrol_new *kc, struct snd_soc_tplg_ctl_hdr *tc)
 {
         struct snd_soc_tplg_ctl_tlv *tplg_tlv;
-        struct snd_ctl_tlv *tlv;
 
-        if (tlv_size == 0)
+        if (!(tc->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE))
                 return 0;
 
-        tplg_tlv = (struct snd_soc_tplg_ctl_tlv *) tplg->pos;
-        tplg->pos += tlv_size;
-
-        tlv = kzalloc(sizeof(*tlv) + tlv_size, GFP_KERNEL);
-        if (tlv == NULL)
-                return -ENOMEM;
-
-        dev_dbg(tplg->dev, " created TLV type %d size %d bytes\n",
-                tplg_tlv->numid, tplg_tlv->size);
+        if (tc->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
+                kc->tlv.c = snd_soc_bytes_tlv_callback;
+        } else {
+                tplg_tlv = &tc->tlv;
+                switch (tplg_tlv->type) {
+                case SNDRV_CTL_TLVT_DB_SCALE:
+                        return soc_tplg_create_tlv_db_scale(tplg, kc,
+                                        &tplg_tlv->scale);
 
-        tlv->numid = tplg_tlv->numid;
-        tlv->length = tplg_tlv->size;
-        memcpy(tlv->tlv, tplg_tlv + 1, tplg_tlv->size);
-        kc->tlv.p = (void *)tlv;
+                /* TODO: add support for other TLV types */
+                default:
+                        dev_dbg(tplg->dev, "Unsupported TLV type %d\n",
+                                        tplg_tlv->type);
+                        return -EINVAL;
+                }
+        }
 
         return 0;
 }
@@ -773,7 +796,7 @@ static int soc_tplg_dmixer_create(struct soc_tplg *tplg, unsigned int count,
                 }
 
                 /* create any TLV data */
-                soc_tplg_create_tlv(tplg, &kc, mc->hdr.tlv_size);
+                soc_tplg_create_tlv(tplg, &kc, &mc->hdr);
 
                 /* register control here */
                 err = soc_tplg_add_kcontrol(tplg, &kc,
@@ -1351,6 +1374,7 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
         template.reg = w->reg;
         template.shift = w->shift;
         template.mask = w->mask;
+        template.subseq = w->subseq;
         template.on_val = w->invert ? 0 : 1;
         template.off_val = w->invert ? 1 : 0;
         template.ignore_suspend = w->ignore_suspend;
diff --git a/sound/soc/zte/zx296702-i2s.c b/sound/soc/zte/zx296702-i2s.c
index 98d96e1b17e0..1930c42e1f55 100644
--- a/sound/soc/zte/zx296702-i2s.c
+++ b/sound/soc/zte/zx296702-i2s.c
@@ -393,9 +393,9 @@ static int zx_i2s_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         zx_i2s->mapbase = res->start;
         zx_i2s->reg_base = devm_ioremap_resource(&pdev->dev, res);
-        if (!zx_i2s->reg_base) {
+        if (IS_ERR(zx_i2s->reg_base)) {
                 dev_err(&pdev->dev, "ioremap failed!\n");
-                return -EIO;
+                return PTR_ERR(zx_i2s->reg_base);
         }
 
         writel_relaxed(0, zx_i2s->reg_base + ZX_I2S_FIFO_CTRL);
diff --git a/sound/soc/zte/zx296702-spdif.c b/sound/soc/zte/zx296702-spdif.c
index 11a0e46a1156..26265ce4caca 100644
--- a/sound/soc/zte/zx296702-spdif.c
+++ b/sound/soc/zte/zx296702-spdif.c
@@ -322,9 +322,9 @@ static int zx_spdif_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         zx_spdif->mapbase = res->start;
         zx_spdif->reg_base = devm_ioremap_resource(&pdev->dev, res);
-        if (!zx_spdif->reg_base) {
+        if (IS_ERR(zx_spdif->reg_base)) {
                 dev_err(&pdev->dev, "ioremap failed!\n");
-                return -EIO;
+                return PTR_ERR(zx_spdif->reg_base);
         }
 
         zx_spdif_dev_init(zx_spdif->reg_base);
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index e5000da9e9d7..6a803eff87f7 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -341,6 +341,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
         { 0 }
 };
 
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+        { 3, NULL, .dB = &bose_companion5_dB },
+        { 0 }   /* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+        { 7, NULL, .dB = &dragonfly_1_2_dB },
+        { 0 }   /* terminator */
+};
+
 /*
  * Control map entries
  */
@@ -451,6 +465,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                 .id = USB_ID(0x25c4, 0x0003),
                 .map = scms_usb3318_map,
         },
+        {
+                /* Bose Companion 5 */
+                .id = USB_ID(0x05a7, 0x1020),
+                .map = bose_companion5_map,
+        },
+        {
+                /* Dragonfly DAC 1.2 */
+                .id = USB_ID(0x21b4, 0x0081),
+                .map = dragonfly_1_2_map,
+        },
         { 0 } /* terminator */
 };
 
diff --git a/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c b/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
index 7f0c756993af..3d7dc6afc3f8 100644
--- a/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
+++ b/tools/testing/selftests/futex/functional/futex_requeue_pi_signal_restart.c
@@ -191,7 +191,7 @@ int main(int argc, char *argv[])
                 if (res > 0) {
                         atomic_set(&requeued, 1);
                         break;
-                } else if (res > 0) {
+                } else if (res < 0) {
                         error("FUTEX_CMP_REQUEUE_PI failed\n", errno);
                         ret = RET_ERROR;
                         break;